{
  "schemaVersion": 1,
  "generatedAt": "2026-08-26T19:59:32.682Z",
  "evaluationDate": "2026-08-26",
  "policy": {
    "blockingSeverities": [
      "CRITICAL",
      "HIGH"
    ],
    "waiverRequirements": [
      "CVE or vulnerability ID",
      "explicit target",
      "owner",
      "approver",
      "Jira or tracking issue",
      "decision",
      "rationale",
      "expiry",
      "compensating controls",
      "remediation plan",
      "approval evidence",
      "customer-safe public rationale",
      "customer-safe public compensating controls"
    ],
    "scope": {
      "defaultMode": "blocking",
      "manifestFile": "scan-manifest.json",
      "reportOnlyMode": "Findings from report-only scan reports are retained as evidence but do not fail the release gate."
    }
  },
  "status": "pass",
  "totals": {
    "reports": 10,
    "findings": 1524,
    "blockingFindings": 0,
    "violations": 0,
    "waived": 0,
    "reportOnlyFindings": 1524,
    "invalidWaivers": 0,
    "expiredWaivers": 0
  },
  "violations": [],
  "waived": [],
  "reportOnly": [
    {
      "id": "CVE-2026-45447",
      "severity": "HIGH",
      "component": "garnet",
      "report": "garnet.vuln.json",
      "target": "staging-registry.payment-gateway.app/garnet:1.1.10@sha256:abe94a5ce0809884a582923ac1de0c58e07e22bb8367e120f931d1382936c784 (ubuntu 24.04)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libssl3t64",
      "installedVersion": "3.0.13-0ubuntu3.9",
      "fixedVersion": "3.0.13-0ubuntu3.11",
      "title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()"
    },
    {
      "id": "CVE-2026-45447",
      "severity": "HIGH",
      "component": "garnet",
      "report": "garnet.vuln.json",
      "target": "staging-registry.payment-gateway.app/garnet:1.1.10@sha256:abe94a5ce0809884a582923ac1de0c58e07e22bb8367e120f931d1382936c784 (ubuntu 24.04)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "openssl",
      "installedVersion": "3.0.13-0ubuntu3.9",
      "fixedVersion": "3.0.13-0ubuntu3.11",
      "title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()"
    },
    {
      "id": "CVE-2026-47302",
      "severity": "HIGH",
      "component": "garnet",
      "report": "garnet.vuln.json",
      "target": "usr/share/dotnet/shared/Microsoft.NETCore.App/10.0.8/Microsoft.NETCore.App.deps.json",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "Microsoft.NETCore.App.Runtime.linux-x64",
      "installedVersion": "10.0.8",
      "fixedVersion": "10.0.10, 9.0.18, 8.0.29",
      "title": "dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation"
    },
    {
      "id": "CVE-2026-50524",
      "severity": "HIGH",
      "component": "garnet",
      "report": "garnet.vuln.json",
      "target": "usr/share/dotnet/shared/Microsoft.NETCore.App/10.0.8/Microsoft.NETCore.App.deps.json",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "Microsoft.NETCore.App.Runtime.linux-x64",
      "installedVersion": "10.0.8",
      "fixedVersion": "10.0.10, 9.0.18, 8.0.29",
      "title": "dotnet: .NET Framework: Denial of Service via improper input validation"
    },
    {
      "id": "CVE-2026-50528",
      "severity": "HIGH",
      "component": "garnet",
      "report": "garnet.vuln.json",
      "target": "usr/share/dotnet/shared/Microsoft.NETCore.App/10.0.8/Microsoft.NETCore.App.deps.json",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "Microsoft.NETCore.App.Runtime.linux-x64",
      "installedVersion": "10.0.8",
      "fixedVersion": "10.0.10, 9.0.18, 8.0.29",
      "title": "dotnet: .NET: Security feature bypass due to incorrect authorization"
    },
    {
      "id": "CVE-2026-50651",
      "severity": "HIGH",
      "component": "garnet",
      "report": "garnet.vuln.json",
      "target": "usr/share/dotnet/shared/Microsoft.NETCore.App/10.0.8/Microsoft.NETCore.App.deps.json",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "Microsoft.NETCore.App.Runtime.linux-x64",
      "installedVersion": "10.0.8",
      "fixedVersion": "10.0.10, 9.0.18, 8.0.29",
      "title": "dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM"
    },
    {
      "id": "CVE-2026-57108",
      "severity": "HIGH",
      "component": "garnet",
      "report": "garnet.vuln.json",
      "target": "usr/share/dotnet/shared/Microsoft.NETCore.App/10.0.8/Microsoft.NETCore.App.deps.json",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "Microsoft.NETCore.App.Runtime.linux-x64",
      "installedVersion": "10.0.8",
      "fixedVersion": "10.0.10, 9.0.18, 8.0.29",
      "title": "dotnet: .NET Core: Denial of Service via type confusion"
    },
    {
      "id": "CVE-2026-62901",
      "severity": "HIGH",
      "component": "garnet",
      "report": "garnet.vuln.json",
      "target": "usr/share/dotnet/shared/Microsoft.NETCore.App/10.0.8/Microsoft.NETCore.App.deps.json",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "Microsoft.NETCore.App.Runtime.linux-x64",
      "installedVersion": "10.0.8",
      "fixedVersion": "10.0.11, 9.0.19, 8.0.30",
      "title": ".NET: .NET Denial of Service Vulnerability"
    },
    {
      "id": "CVE-2026-53612",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "bsdutils",
      "installedVersion": "1:2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes"
    },
    {
      "id": "CVE-2026-53613",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "bsdutils",
      "installedVersion": "1:2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path"
    },
    {
      "id": "CVE-2026-53614",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "bsdutils",
      "installedVersion": "1:2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2"
    },
    {
      "id": "CVE-2026-53615",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "bsdutils",
      "installedVersion": "1:2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]"
    },
    {
      "id": "CVE-2026-13032",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in WebGL"
    },
    {
      "id": "CVE-2026-13033",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds read in Blink>InterestGroups"
    },
    {
      "id": "CVE-2026-13038",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Autofill"
    },
    {
      "id": "CVE-2026-13775",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in GPU"
    },
    {
      "id": "CVE-2026-13776",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Type Confusion in Dawn"
    },
    {
      "id": "CVE-2026-13780",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-13781",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Skia"
    },
    {
      "id": "CVE-2026-13782",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Browser"
    },
    {
      "id": "CVE-2026-13785",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Bluetooth"
    },
    {
      "id": "CVE-2026-14101",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient policy enforcement in Sandbox"
    },
    {
      "id": "CVE-2026-14104",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in WebAppInstalls"
    },
    {
      "id": "CVE-2026-14106",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Text"
    },
    {
      "id": "CVE-2026-14109",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient policy enforcement in Mojo"
    },
    {
      "id": "CVE-2026-14120",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in DevTools"
    },
    {
      "id": "CVE-2026-15764",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-15765",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-17651",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Dawn"
    },
    {
      "id": "CVE-2026-17652",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-17653",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Skia"
    },
    {
      "id": "CVE-2026-17654",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Race in Updater"
    },
    {
      "id": "CVE-2026-17655",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-17656",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-12007",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "Use after free in Core in Google Chrome on Windows prior to 149.0.7827 ..."
    },
    {
      "id": "CVE-2026-12008",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  DigitalCredentials"
    },
    {
      "id": "CVE-2026-12009",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input  Accessibility"
    },
    {
      "id": "CVE-2026-12011",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  WebMIDI"
    },
    {
      "id": "CVE-2026-12012",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  Network"
    },
    {
      "id": "CVE-2026-12014",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  Cast"
    },
    {
      "id": "CVE-2026-12016",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input  DevTools"
    },
    {
      "id": "CVE-2026-12017",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input  Extensions"
    },
    {
      "id": "CVE-2026-12018",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation Mojo"
    },
    {
      "id": "CVE-2026-12019",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write  Codecs"
    },
    {
      "id": "CVE-2026-12020",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  Autofill"
    },
    {
      "id": "CVE-2026-12022",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Race  Safe Browsing"
    },
    {
      "id": "CVE-2026-12027",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement  Headless"
    },
    {
      "id": "CVE-2026-12028",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  GPU"
    },
    {
      "id": "CVE-2026-12029",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  Video"
    },
    {
      "id": "CVE-2026-12030",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Heap buffer overflow  GPU"
    },
    {
      "id": "CVE-2026-12031",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation  Views"
    },
    {
      "id": "CVE-2026-12034",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input  Linux Toolkit Theming"
    },
    {
      "id": "CVE-2026-12035",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  Views"
    },
    {
      "id": "CVE-2026-12437",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in WebShare"
    },
    {
      "id": "CVE-2026-12438",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in WebView"
    },
    {
      "id": "CVE-2026-12439",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Digital Credentials"
    },
    {
      "id": "CVE-2026-12440",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in DigitalCredentials"
    },
    {
      "id": "CVE-2026-12441",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in File Input"
    },
    {
      "id": "CVE-2026-12442",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Passwords"
    },
    {
      "id": "CVE-2026-12443",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Web Authentication"
    },
    {
      "id": "CVE-2026-12445",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Extensions"
    },
    {
      "id": "CVE-2026-12447",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Heap buffer overflow in WebRTC"
    },
    {
      "id": "CVE-2026-12448",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in WebView"
    },
    {
      "id": "CVE-2026-12449",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Chromoting"
    },
    {
      "id": "CVE-2026-12451",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in DigitalCredentials"
    },
    {
      "id": "CVE-2026-12452",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Downloads"
    },
    {
      "id": "CVE-2026-12454",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Race in Safe Browsing"
    },
    {
      "id": "CVE-2026-12455",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Tab Strip"
    },
    {
      "id": "CVE-2026-12456",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions"
    },
    {
      "id": "CVE-2026-12457",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient data validation in Extensions"
    },
    {
      "id": "CVE-2026-12459",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Serial"
    },
    {
      "id": "CVE-2026-12460",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in File System Access"
    },
    {
      "id": "CVE-2026-12462",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Media"
    },
    {
      "id": "CVE-2026-12463",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Views"
    },
    {
      "id": "CVE-2026-12464",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Browser"
    },
    {
      "id": "CVE-2026-12465",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Metrics"
    },
    {
      "id": "CVE-2026-12466",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: webrtc: chromium-browser: Heap buffer overflow in WebRTC"
    },
    {
      "id": "CVE-2026-12467",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Extensions"
    },
    {
      "id": "CVE-2026-12468",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Updater"
    },
    {
      "id": "CVE-2026-13021",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in DeviceBoundSessionCredentials"
    },
    {
      "id": "CVE-2026-13023",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in GPU"
    },
    {
      "id": "CVE-2026-13024",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Navigation"
    },
    {
      "id": "CVE-2026-13025",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in DevTools"
    },
    {
      "id": "CVE-2026-13026",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Digital Credentials"
    },
    {
      "id": "CVE-2026-13027",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in FileSystem"
    },
    {
      "id": "CVE-2026-13029",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Web Authentication"
    },
    {
      "id": "CVE-2026-13030",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in GPU"
    },
    {
      "id": "CVE-2026-13031",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Blink"
    },
    {
      "id": "CVE-2026-13034",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Passwords"
    },
    {
      "id": "CVE-2026-13036",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Blink"
    },
    {
      "id": "CVE-2026-13037",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in WebView"
    },
    {
      "id": "CVE-2026-13281",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in Mojo"
    },
    {
      "id": "CVE-2026-13282",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Payments"
    },
    {
      "id": "CVE-2026-13283",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in AdFilter"
    },
    {
      "id": "CVE-2026-13774",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Extensions"
    },
    {
      "id": "CVE-2026-13777",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in iOSWeb"
    },
    {
      "id": "CVE-2026-13778",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in WebUSB"
    },
    {
      "id": "CVE-2026-13779",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Chromoting"
    },
    {
      "id": "CVE-2026-13783",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-13784",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-13786",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-13787",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Chromoting"
    },
    {
      "id": "CVE-2026-13788",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Fullscreen"
    },
    {
      "id": "CVE-2026-13789",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in GPU"
    },
    {
      "id": "CVE-2026-13790",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Side-channel information leakage in Scroll"
    },
    {
      "id": "CVE-2026-13791",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Downloads"
    },
    {
      "id": "CVE-2026-13792",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Touchbar"
    },
    {
      "id": "CVE-2026-13793",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient policy enforcement in SVG"
    },
    {
      "id": "CVE-2026-13794",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in WebAppInstalls"
    },
    {
      "id": "CVE-2026-13796",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Integer overflow in Chromecast"
    },
    {
      "id": "CVE-2026-13797",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Chromecast"
    },
    {
      "id": "CVE-2026-13798",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Heap buffer overflow in Chromecast"
    },
    {
      "id": "CVE-2026-13799",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in QUIC"
    },
    {
      "id": "CVE-2026-13800",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in Updater"
    },
    {
      "id": "CVE-2026-13801",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Integer overflow in Chromecast"
    },
    {
      "id": "CVE-2026-13802",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-13803",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Type Confusion in Chrome Tabs"
    },
    {
      "id": "CVE-2026-13804",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Chromecast"
    },
    {
      "id": "CVE-2026-13805",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in GFX"
    },
    {
      "id": "CVE-2026-13806",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Accessibility"
    },
    {
      "id": "CVE-2026-13807",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Import"
    },
    {
      "id": "CVE-2026-13808",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient data validation in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13809",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Side-channel information leakage in Safe Browsing"
    },
    {
      "id": "CVE-2026-13810",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in Input"
    },
    {
      "id": "CVE-2026-13811",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in IME"
    },
    {
      "id": "CVE-2026-13812",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13813",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13814",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-13815",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Blink"
    },
    {
      "id": "CVE-2026-13816",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in File Input"
    },
    {
      "id": "CVE-2026-13817",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Glic"
    },
    {
      "id": "CVE-2026-13818",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in Passwords"
    },
    {
      "id": "CVE-2026-13819",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Out of bounds read in ANGLE"
    },
    {
      "id": "CVE-2026-13820",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Out of bounds read in Skia"
    },
    {
      "id": "CVE-2026-13821",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Canvas"
    },
    {
      "id": "CVE-2026-13822",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in Extensions"
    },
    {
      "id": "CVE-2026-13823",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Glic"
    },
    {
      "id": "CVE-2026-13824",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Extensions"
    },
    {
      "id": "CVE-2026-13825",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Uninitialized Use in Dawn"
    },
    {
      "id": "CVE-2026-13826",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in Autofill"
    },
    {
      "id": "CVE-2026-13827",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Updater"
    },
    {
      "id": "CVE-2026-13828",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in Enterprise"
    },
    {
      "id": "CVE-2026-13829",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Settings"
    },
    {
      "id": "CVE-2026-13830",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Chromoting"
    },
    {
      "id": "CVE-2026-13831",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in GPU"
    },
    {
      "id": "CVE-2026-13832",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Headless"
    },
    {
      "id": "CVE-2026-13833",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-13834",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-13835",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in XML"
    },
    {
      "id": "CVE-2026-13836",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in CSS"
    },
    {
      "id": "CVE-2026-13837",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in CSS"
    },
    {
      "id": "CVE-2026-13838",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in CSS"
    },
    {
      "id": "CVE-2026-13839",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in CSS"
    },
    {
      "id": "CVE-2026-13840",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient policy enforcement in Canvas"
    },
    {
      "id": "CVE-2026-13841",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Integer overflow in Skia"
    },
    {
      "id": "CVE-2026-13842",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Incorrect security UI in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13843",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13844",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Updater"
    },
    {
      "id": "CVE-2026-13845",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in DOM"
    },
    {
      "id": "CVE-2026-13846",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in USB"
    },
    {
      "id": "CVE-2026-13847",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13848",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Forms"
    },
    {
      "id": "CVE-2026-13849",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Chromoting"
    },
    {
      "id": "CVE-2026-13850",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13851",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in WebAppInstalls"
    },
    {
      "id": "CVE-2026-13852",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in WebAppInstalls"
    },
    {
      "id": "CVE-2026-13853",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Journeys"
    },
    {
      "id": "CVE-2026-13854",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-13855",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-14090",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Out of bounds read in CameraCapture"
    },
    {
      "id": "CVE-2026-14102",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Passwords"
    },
    {
      "id": "CVE-2026-14382",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-14385",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Heap buffer overflow in ANGLE"
    },
    {
      "id": "CVE-2026-14386",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds read in ANGLE"
    },
    {
      "id": "CVE-2026-14390",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in ANGLE"
    },
    {
      "id": "CVE-2026-14392",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write in Tint"
    },
    {
      "id": "CVE-2026-14398",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in ANGLE"
    },
    {
      "id": "CVE-2026-14400",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write in ANGLE"
    },
    {
      "id": "CVE-2026-14401",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-14402",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-14411",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-14412",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-14413",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-14417",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Dawn"
    },
    {
      "id": "CVE-2026-14418",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-14419",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Skia"
    },
    {
      "id": "CVE-2026-14420",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds read and write in Dawn"
    },
    {
      "id": "CVE-2026-14422",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Out of bounds read and write in Tint"
    },
    {
      "id": "CVE-2026-14423",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Type Confusion in Tint"
    },
    {
      "id": "CVE-2026-14424",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Dawn"
    },
    {
      "id": "CVE-2026-14425",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in ANGLE"
    },
    {
      "id": "CVE-2026-14426",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in V8"
    },
    {
      "id": "CVE-2026-14427",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Heap buffer overflow in Skia"
    },
    {
      "id": "CVE-2026-14428",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Dawn"
    },
    {
      "id": "CVE-2026-14429",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Skia"
    },
    {
      "id": "CVE-2026-14430",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in V8"
    },
    {
      "id": "CVE-2026-14431",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Type Confusion in V8"
    },
    {
      "id": "CVE-2026-15108",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in Extensions API"
    },
    {
      "id": "CVE-2026-15109",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-15110",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Extensions"
    },
    {
      "id": "CVE-2026-15111",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-15112",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-15113",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Autofill"
    },
    {
      "id": "CVE-2026-15114",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds read and write in Codecs"
    },
    {
      "id": "CVE-2026-15115",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in WebAppInstalls"
    },
    {
      "id": "CVE-2026-15116",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Actor"
    },
    {
      "id": "CVE-2026-15117",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Payments"
    },
    {
      "id": "CVE-2026-15118",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Input"
    },
    {
      "id": "CVE-2026-15119",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in GetUserMedia"
    },
    {
      "id": "CVE-2026-15120",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Core"
    },
    {
      "id": "CVE-2026-15121",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in WebRTC"
    },
    {
      "id": "CVE-2026-15122",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Codecs"
    },
    {
      "id": "CVE-2026-15123",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient data validation in DOM"
    },
    {
      "id": "CVE-2026-15124",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in Passwords"
    },
    {
      "id": "CVE-2026-15125",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Forms"
    },
    {
      "id": "CVE-2026-15127",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in WebGL"
    },
    {
      "id": "CVE-2026-15128",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Forms"
    },
    {
      "id": "CVE-2026-15129",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-15130",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in Navigation"
    },
    {
      "id": "CVE-2026-15132",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in V8"
    },
    {
      "id": "CVE-2026-15133",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in InterestGroups"
    },
    {
      "id": "CVE-2026-15766",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in Skia"
    },
    {
      "id": "CVE-2026-15767",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: libyuv: chromium-browser: Heap buffer overflow in libyuv"
    },
    {
      "id": "CVE-2026-15768",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in HTML-in-Canvas"
    },
    {
      "id": "CVE-2026-15769",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Linux Toolkit Theming"
    },
    {
      "id": "CVE-2026-15770",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in V8"
    },
    {
      "id": "CVE-2026-15771",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Media"
    },
    {
      "id": "CVE-2026-15772",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in GPU"
    },
    {
      "id": "CVE-2026-15773",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Core"
    },
    {
      "id": "CVE-2026-15774",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Skia"
    },
    {
      "id": "CVE-2026-15775",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in V8"
    },
    {
      "id": "CVE-2026-15776",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Type Confusion in V8"
    },
    {
      "id": "CVE-2026-15777",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in UI"
    },
    {
      "id": "CVE-2026-16414",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.181-1~deb13u1",
      "title": "Insufficient validation of untrusted input in Chromecast in Google Chr ..."
    },
    {
      "id": "CVE-2026-16804",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via crafted HTML page"
    },
    {
      "id": "CVE-2026-16805",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Blink"
    },
    {
      "id": "CVE-2026-16806",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: Chromium: Arbitrary code execution via use after free vulnerability in WebMCP"
    },
    {
      "id": "CVE-2026-16807",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: Google Chrome Codecs: Sandbox escape via crafted HTML page"
    },
    {
      "id": "CVE-2026-17650",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Compositing"
    },
    {
      "id": "CVE-2026-17657",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Navigation"
    },
    {
      "id": "CVE-2026-17658",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in V8"
    },
    {
      "id": "CVE-2026-17659",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in SiteIsolation"
    },
    {
      "id": "CVE-2026-17660",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Network"
    },
    {
      "id": "CVE-2026-17661",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Loader"
    },
    {
      "id": "CVE-2026-17662",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in Prefetch"
    },
    {
      "id": "CVE-2026-17663",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in GPU"
    },
    {
      "id": "CVE-2026-17664",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Loader"
    },
    {
      "id": "CVE-2026-17665",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in V8"
    },
    {
      "id": "CVE-2026-17666",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Cryptographic Flaw in Enterprise"
    },
    {
      "id": "CVE-2026-17667",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-17668",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-17670",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-17671",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-17672",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Chromecast"
    },
    {
      "id": "CVE-2026-17673",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in QUIC"
    },
    {
      "id": "CVE-2026-17674",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in HTML"
    },
    {
      "id": "CVE-2026-17675",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write in ANGLE"
    },
    {
      "id": "CVE-2026-17676",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in ANGLE"
    },
    {
      "id": "CVE-2026-17677",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in ANGLE"
    },
    {
      "id": "CVE-2026-17678",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds read in ANGLE"
    },
    {
      "id": "CVE-2026-17679",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Print Preview"
    },
    {
      "id": "CVE-2026-17680",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Heap buffer overflow in Color"
    },
    {
      "id": "CVE-2026-17681",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Web Authentication"
    },
    {
      "id": "CVE-2026-17682",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in ANGLE"
    },
    {
      "id": "CVE-2026-17683",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in ANGLE"
    },
    {
      "id": "CVE-2026-17685",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Autofill"
    },
    {
      "id": "CVE-2026-17686",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Passwords"
    },
    {
      "id": "CVE-2026-17687",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: ANGLE: chromium-browser: Type Confusion in ANGLE"
    },
    {
      "id": "CVE-2026-17688",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Input"
    },
    {
      "id": "CVE-2026-17689",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-17690",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in PDF"
    },
    {
      "id": "CVE-2026-17691",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write in ANGLE"
    },
    {
      "id": "CVE-2026-17692",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in DataTransfer"
    },
    {
      "id": "CVE-2026-17693",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in FileSystem"
    },
    {
      "id": "CVE-2026-17694",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in DOM"
    },
    {
      "id": "CVE-2026-17695",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in ANGLE"
    },
    {
      "id": "CVE-2026-17696",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Side-channel information leakage in Media"
    },
    {
      "id": "CVE-2026-17697",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Type Confusion in ANGLE"
    },
    {
      "id": "CVE-2026-17698",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in UI"
    },
    {
      "id": "CVE-2026-17699",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-17700",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Actor"
    },
    {
      "id": "CVE-2026-17701",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds read in ANGLE"
    },
    {
      "id": "CVE-2026-17702",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Skia"
    },
    {
      "id": "CVE-2026-17704",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in ANGLE"
    },
    {
      "id": "CVE-2026-17705",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: libxml: chromium-browser: Integer overflow in libxml"
    },
    {
      "id": "CVE-2026-17706",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Media"
    },
    {
      "id": "CVE-2026-17707",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in Media"
    },
    {
      "id": "CVE-2026-17708",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Audio"
    },
    {
      "id": "CVE-2026-17709",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Race in Downloads"
    },
    {
      "id": "CVE-2026-17710",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in MHTML"
    },
    {
      "id": "CVE-2026-17711",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Race in Downloads"
    },
    {
      "id": "CVE-2026-17712",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Race in Skia"
    },
    {
      "id": "CVE-2026-17713",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Accessibility"
    },
    {
      "id": "CVE-2026-17714",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-17715",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Passwords"
    },
    {
      "id": "CVE-2026-17716",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Updater"
    },
    {
      "id": "CVE-2026-17717",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in ANGLE"
    },
    {
      "id": "CVE-2026-17718",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in ANGLE"
    },
    {
      "id": "CVE-2026-17719",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Input"
    },
    {
      "id": "CVE-2026-17720",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in Passwords"
    },
    {
      "id": "CVE-2026-17721",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write in ANGLE"
    },
    {
      "id": "CVE-2026-17722",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Object lifecycle issue in WebView"
    },
    {
      "id": "CVE-2026-17723",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Media"
    },
    {
      "id": "CVE-2026-17725",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Type Confusion in V8"
    },
    {
      "id": "CVE-2026-17726",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in WebGL"
    },
    {
      "id": "CVE-2026-17727",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write in WebGL"
    },
    {
      "id": "CVE-2026-17778",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Arbitrary code execution via crafted Chrome Extension"
    },
    {
      "id": "CVE-2026-17823",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Same-Origin Policy Bypass via Insufficient Policy Enforcement in WebXR"
    },
    {
      "id": "CVE-2026-19137",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome on Android: Sandbox escape via use after free in WebGL"
    },
    {
      "id": "CVE-2026-19138",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via heap buffer overflow in CrashReporting"
    },
    {
      "id": "CVE-2026-19140",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome GPU: Sandbox escape via use after free vulnerability in crafted HTML."
    },
    {
      "id": "CVE-2026-19141",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape due to use-after-free vulnerability"
    },
    {
      "id": "CVE-2026-19142",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Remote code execution via use after free in Views"
    },
    {
      "id": "CVE-2026-19143",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome on Android: Sandbox escape via malicious WebAPK input"
    },
    {
      "id": "CVE-2026-19144",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Arbitrary code execution via crafted HTML page"
    },
    {
      "id": "CVE-2026-19145",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Arbitrary code execution via use-after-free in Translate component"
    },
    {
      "id": "CVE-2026-19147",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via use-after-free vulnerability in Aura"
    },
    {
      "id": "CVE-2026-19148",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via out-of-bounds write in GPU"
    },
    {
      "id": "CVE-2026-19149",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via use-after-free vulnerability in Aura"
    },
    {
      "id": "CVE-2026-19150",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome (V8): Arbitrary code execution via crafted HTML page"
    },
    {
      "id": "CVE-2026-19151",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium-browser: Arbitrary code execution via use-after-free in V8"
    },
    {
      "id": "CVE-2026-19152",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape via insufficient policy enforcement in Navigation"
    },
    {
      "id": "CVE-2026-19153",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Site isolation bypass via insufficient input validation in Workers"
    },
    {
      "id": "CVE-2026-19155",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape via use-after-free in Payments"
    },
    {
      "id": "CVE-2026-19156",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Heap buffer overflow allows heap corruption via malicious extension"
    },
    {
      "id": "CVE-2026-19157",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: ANGLE: Sandbox escape via out-of-bounds write in Google Chrome on Android"
    },
    {
      "id": "CVE-2026-19158",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Arbitrary code execution via use-after-free in Views"
    },
    {
      "id": "CVE-2026-19159",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Arbitrary code execution via use-after-free in Views"
    },
    {
      "id": "CVE-2026-19162",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Arbitrary code execution via out-of-bounds write in V8."
    },
    {
      "id": "CVE-2026-19163",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via use-after-free in Media component"
    },
    {
      "id": "CVE-2026-19164",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome Codecs: Sandbox escape via crafted HTML page"
    },
    {
      "id": "CVE-2026-19166",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape due to use-after-free in Web Authentication"
    },
    {
      "id": "CVE-2026-19168",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome V8: Arbitrary Code Execution via crafted HTML page"
    },
    {
      "id": "CVE-2026-19169",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Privilege escalation via crafted HTML page in Contextual Tasks"
    },
    {
      "id": "CVE-2026-19170",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via use after free in WebGL"
    },
    {
      "id": "CVE-2026-19171",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape via use-after-free in Media component"
    },
    {
      "id": "CVE-2026-19172",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape via use after free in Views"
    },
    {
      "id": "CVE-2026-19173",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium"
    },
    {
      "id": "CVE-2026-19174",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome V8: Arbitrary code execution via crafted HTML page"
    },
    {
      "id": "CVE-2026-19175",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Remote sandbox escape via use-after-free in Payments"
    },
    {
      "id": "CVE-2026-19177",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape via crafted HTML page"
    },
    {
      "id": "CVE-2026-19556",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.137-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Arbitrary code execution via use-after-free in V8"
    },
    {
      "id": "CVE-2026-19557",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.137-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape via use-after-free in TabStrip"
    },
    {
      "id": "CVE-2026-19558",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.137-1~deb13u1",
      "title": "chromium-browser: Google Chrome Extensions: Arbitrary code execution via malicious extension installation"
    },
    {
      "id": "CVE-2026-19559",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.137-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Arbitrary code execution via use after free in HTML"
    },
    {
      "id": "CVE-2026-19560",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.137-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Arbitrary code execution via use-after-free in Blink"
    },
    {
      "id": "CVE-2026-76033",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Site isolation bypass due to inappropriate CORS implementation"
    },
    {
      "id": "CVE-2026-76036",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page"
    },
    {
      "id": "CVE-2026-76037",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Arbitrary Code Execution via Link Following"
    },
    {
      "id": "CVE-2026-76038",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: v8: V8: Remote code execution via type confusion in crafted HTML."
    },
    {
      "id": "CVE-2026-76039",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Chromium: Information disclosure via incorrect reference resolution"
    },
    {
      "id": "CVE-2026-76040",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Arbitrary code execution via use-after-free vulnerability"
    },
    {
      "id": "CVE-2026-76041",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Chromium: Information leak allows web origin policy bypass"
    },
    {
      "id": "CVE-2026-76043",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: v8: Google Chrome V8: Arbitrary code execution via incorrect calculation in HTML processing"
    },
    {
      "id": "CVE-2026-76044",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Arbitrary code execution due to a race condition in USB"
    },
    {
      "id": "CVE-2026-76045",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Google Chrome WebGL: Arbitrary code execution via use-after-free"
    },
    {
      "id": "CVE-2026-76047",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Chromium-browser: Arbitrary code execution via type confusion in V8"
    },
    {
      "id": "CVE-2026-13032",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in WebGL"
    },
    {
      "id": "CVE-2026-13033",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds read in Blink>InterestGroups"
    },
    {
      "id": "CVE-2026-13038",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Autofill"
    },
    {
      "id": "CVE-2026-13775",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in GPU"
    },
    {
      "id": "CVE-2026-13776",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Type Confusion in Dawn"
    },
    {
      "id": "CVE-2026-13780",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-13781",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Skia"
    },
    {
      "id": "CVE-2026-13782",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Browser"
    },
    {
      "id": "CVE-2026-13785",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Bluetooth"
    },
    {
      "id": "CVE-2026-14101",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient policy enforcement in Sandbox"
    },
    {
      "id": "CVE-2026-14104",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in WebAppInstalls"
    },
    {
      "id": "CVE-2026-14106",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Text"
    },
    {
      "id": "CVE-2026-14109",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient policy enforcement in Mojo"
    },
    {
      "id": "CVE-2026-14120",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in DevTools"
    },
    {
      "id": "CVE-2026-15764",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-15765",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-17651",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Dawn"
    },
    {
      "id": "CVE-2026-17652",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-17653",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Skia"
    },
    {
      "id": "CVE-2026-17654",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Race in Updater"
    },
    {
      "id": "CVE-2026-17655",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-17656",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-12007",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "Use after free in Core in Google Chrome on Windows prior to 149.0.7827 ..."
    },
    {
      "id": "CVE-2026-12008",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  DigitalCredentials"
    },
    {
      "id": "CVE-2026-12009",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input  Accessibility"
    },
    {
      "id": "CVE-2026-12011",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  WebMIDI"
    },
    {
      "id": "CVE-2026-12012",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  Network"
    },
    {
      "id": "CVE-2026-12014",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  Cast"
    },
    {
      "id": "CVE-2026-12016",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input  DevTools"
    },
    {
      "id": "CVE-2026-12017",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input  Extensions"
    },
    {
      "id": "CVE-2026-12018",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation Mojo"
    },
    {
      "id": "CVE-2026-12019",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write  Codecs"
    },
    {
      "id": "CVE-2026-12020",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  Autofill"
    },
    {
      "id": "CVE-2026-12022",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Race  Safe Browsing"
    },
    {
      "id": "CVE-2026-12027",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement  Headless"
    },
    {
      "id": "CVE-2026-12028",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  GPU"
    },
    {
      "id": "CVE-2026-12029",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  Video"
    },
    {
      "id": "CVE-2026-12030",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Heap buffer overflow  GPU"
    },
    {
      "id": "CVE-2026-12031",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation  Views"
    },
    {
      "id": "CVE-2026-12034",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input  Linux Toolkit Theming"
    },
    {
      "id": "CVE-2026-12035",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free  Views"
    },
    {
      "id": "CVE-2026-12437",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in WebShare"
    },
    {
      "id": "CVE-2026-12438",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in WebView"
    },
    {
      "id": "CVE-2026-12439",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Digital Credentials"
    },
    {
      "id": "CVE-2026-12440",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in DigitalCredentials"
    },
    {
      "id": "CVE-2026-12441",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in File Input"
    },
    {
      "id": "CVE-2026-12442",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Passwords"
    },
    {
      "id": "CVE-2026-12443",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Web Authentication"
    },
    {
      "id": "CVE-2026-12445",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Extensions"
    },
    {
      "id": "CVE-2026-12447",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Heap buffer overflow in WebRTC"
    },
    {
      "id": "CVE-2026-12448",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in WebView"
    },
    {
      "id": "CVE-2026-12449",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Chromoting"
    },
    {
      "id": "CVE-2026-12451",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in DigitalCredentials"
    },
    {
      "id": "CVE-2026-12452",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Downloads"
    },
    {
      "id": "CVE-2026-12454",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Race in Safe Browsing"
    },
    {
      "id": "CVE-2026-12455",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Tab Strip"
    },
    {
      "id": "CVE-2026-12456",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Extensions"
    },
    {
      "id": "CVE-2026-12457",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient data validation in Extensions"
    },
    {
      "id": "CVE-2026-12459",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Serial"
    },
    {
      "id": "CVE-2026-12460",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in File System Access"
    },
    {
      "id": "CVE-2026-12462",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Media"
    },
    {
      "id": "CVE-2026-12463",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Views"
    },
    {
      "id": "CVE-2026-12464",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Browser"
    },
    {
      "id": "CVE-2026-12465",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Metrics"
    },
    {
      "id": "CVE-2026-12466",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: webrtc: chromium-browser: Heap buffer overflow in WebRTC"
    },
    {
      "id": "CVE-2026-12467",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Extensions"
    },
    {
      "id": "CVE-2026-12468",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.155-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Updater"
    },
    {
      "id": "CVE-2026-13021",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in DeviceBoundSessionCredentials"
    },
    {
      "id": "CVE-2026-13023",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in GPU"
    },
    {
      "id": "CVE-2026-13024",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Navigation"
    },
    {
      "id": "CVE-2026-13025",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in DevTools"
    },
    {
      "id": "CVE-2026-13026",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Digital Credentials"
    },
    {
      "id": "CVE-2026-13027",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in FileSystem"
    },
    {
      "id": "CVE-2026-13029",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Web Authentication"
    },
    {
      "id": "CVE-2026-13030",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in GPU"
    },
    {
      "id": "CVE-2026-13031",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Blink"
    },
    {
      "id": "CVE-2026-13034",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Passwords"
    },
    {
      "id": "CVE-2026-13036",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Blink"
    },
    {
      "id": "CVE-2026-13037",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "149.0.7827.196-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in WebView"
    },
    {
      "id": "CVE-2026-13281",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in Mojo"
    },
    {
      "id": "CVE-2026-13282",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Payments"
    },
    {
      "id": "CVE-2026-13283",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in AdFilter"
    },
    {
      "id": "CVE-2026-13774",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Extensions"
    },
    {
      "id": "CVE-2026-13777",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in iOSWeb"
    },
    {
      "id": "CVE-2026-13778",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in WebUSB"
    },
    {
      "id": "CVE-2026-13779",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Chromoting"
    },
    {
      "id": "CVE-2026-13783",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-13784",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-13786",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-13787",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Chromoting"
    },
    {
      "id": "CVE-2026-13788",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Fullscreen"
    },
    {
      "id": "CVE-2026-13789",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in GPU"
    },
    {
      "id": "CVE-2026-13790",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Side-channel information leakage in Scroll"
    },
    {
      "id": "CVE-2026-13791",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Downloads"
    },
    {
      "id": "CVE-2026-13792",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Touchbar"
    },
    {
      "id": "CVE-2026-13793",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient policy enforcement in SVG"
    },
    {
      "id": "CVE-2026-13794",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in WebAppInstalls"
    },
    {
      "id": "CVE-2026-13796",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Integer overflow in Chromecast"
    },
    {
      "id": "CVE-2026-13797",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Chromecast"
    },
    {
      "id": "CVE-2026-13798",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Heap buffer overflow in Chromecast"
    },
    {
      "id": "CVE-2026-13799",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in QUIC"
    },
    {
      "id": "CVE-2026-13800",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in Updater"
    },
    {
      "id": "CVE-2026-13801",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Integer overflow in Chromecast"
    },
    {
      "id": "CVE-2026-13802",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-13803",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Type Confusion in Chrome Tabs"
    },
    {
      "id": "CVE-2026-13804",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Chromecast"
    },
    {
      "id": "CVE-2026-13805",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in GFX"
    },
    {
      "id": "CVE-2026-13806",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Accessibility"
    },
    {
      "id": "CVE-2026-13807",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Import"
    },
    {
      "id": "CVE-2026-13808",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient data validation in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13809",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Side-channel information leakage in Safe Browsing"
    },
    {
      "id": "CVE-2026-13810",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in Input"
    },
    {
      "id": "CVE-2026-13811",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in IME"
    },
    {
      "id": "CVE-2026-13812",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13813",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13814",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-13815",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Blink"
    },
    {
      "id": "CVE-2026-13816",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in File Input"
    },
    {
      "id": "CVE-2026-13817",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Glic"
    },
    {
      "id": "CVE-2026-13818",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in Passwords"
    },
    {
      "id": "CVE-2026-13819",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Out of bounds read in ANGLE"
    },
    {
      "id": "CVE-2026-13820",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Out of bounds read in Skia"
    },
    {
      "id": "CVE-2026-13821",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Canvas"
    },
    {
      "id": "CVE-2026-13822",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in Extensions"
    },
    {
      "id": "CVE-2026-13823",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Glic"
    },
    {
      "id": "CVE-2026-13824",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Extensions"
    },
    {
      "id": "CVE-2026-13825",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Uninitialized Use in Dawn"
    },
    {
      "id": "CVE-2026-13826",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in Autofill"
    },
    {
      "id": "CVE-2026-13827",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Updater"
    },
    {
      "id": "CVE-2026-13828",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in Enterprise"
    },
    {
      "id": "CVE-2026-13829",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Settings"
    },
    {
      "id": "CVE-2026-13830",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Chromoting"
    },
    {
      "id": "CVE-2026-13831",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in GPU"
    },
    {
      "id": "CVE-2026-13832",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Headless"
    },
    {
      "id": "CVE-2026-13833",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-13834",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-13835",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in XML"
    },
    {
      "id": "CVE-2026-13836",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in CSS"
    },
    {
      "id": "CVE-2026-13837",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in CSS"
    },
    {
      "id": "CVE-2026-13838",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in CSS"
    },
    {
      "id": "CVE-2026-13839",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Inappropriate implementation in CSS"
    },
    {
      "id": "CVE-2026-13840",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient policy enforcement in Canvas"
    },
    {
      "id": "CVE-2026-13841",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Integer overflow in Skia"
    },
    {
      "id": "CVE-2026-13842",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Incorrect security UI in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13843",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13844",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Updater"
    },
    {
      "id": "CVE-2026-13845",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in DOM"
    },
    {
      "id": "CVE-2026-13846",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in USB"
    },
    {
      "id": "CVE-2026-13847",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13848",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Forms"
    },
    {
      "id": "CVE-2026-13849",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in Chromoting"
    },
    {
      "id": "CVE-2026-13850",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Chrome for iOS"
    },
    {
      "id": "CVE-2026-13851",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in WebAppInstalls"
    },
    {
      "id": "CVE-2026-13852",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Insufficient validation of untrusted input in WebAppInstalls"
    },
    {
      "id": "CVE-2026-13853",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Journeys"
    },
    {
      "id": "CVE-2026-13854",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-13855",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-14090",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Out of bounds read in CameraCapture"
    },
    {
      "id": "CVE-2026-14102",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Use after free in Passwords"
    },
    {
      "id": "CVE-2026-14382",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-14385",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Heap buffer overflow in ANGLE"
    },
    {
      "id": "CVE-2026-14386",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds read in ANGLE"
    },
    {
      "id": "CVE-2026-14390",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in ANGLE"
    },
    {
      "id": "CVE-2026-14392",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write in Tint"
    },
    {
      "id": "CVE-2026-14398",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in ANGLE"
    },
    {
      "id": "CVE-2026-14400",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write in ANGLE"
    },
    {
      "id": "CVE-2026-14401",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-14402",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-14411",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-14412",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-14413",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-14417",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Dawn"
    },
    {
      "id": "CVE-2026-14418",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-14419",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Skia"
    },
    {
      "id": "CVE-2026-14420",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds read and write in Dawn"
    },
    {
      "id": "CVE-2026-14422",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: Out of bounds read and write in Tint"
    },
    {
      "id": "CVE-2026-14423",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Type Confusion in Tint"
    },
    {
      "id": "CVE-2026-14424",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Dawn"
    },
    {
      "id": "CVE-2026-14425",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in ANGLE"
    },
    {
      "id": "CVE-2026-14426",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in V8"
    },
    {
      "id": "CVE-2026-14427",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Heap buffer overflow in Skia"
    },
    {
      "id": "CVE-2026-14428",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Dawn"
    },
    {
      "id": "CVE-2026-14429",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Skia"
    },
    {
      "id": "CVE-2026-14430",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in V8"
    },
    {
      "id": "CVE-2026-14431",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.46-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Type Confusion in V8"
    },
    {
      "id": "CVE-2026-15108",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in Extensions API"
    },
    {
      "id": "CVE-2026-15109",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-15110",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Extensions"
    },
    {
      "id": "CVE-2026-15111",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-15112",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Ozone"
    },
    {
      "id": "CVE-2026-15113",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Autofill"
    },
    {
      "id": "CVE-2026-15114",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds read and write in Codecs"
    },
    {
      "id": "CVE-2026-15115",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in WebAppInstalls"
    },
    {
      "id": "CVE-2026-15116",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Actor"
    },
    {
      "id": "CVE-2026-15117",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Payments"
    },
    {
      "id": "CVE-2026-15118",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Input"
    },
    {
      "id": "CVE-2026-15119",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in GetUserMedia"
    },
    {
      "id": "CVE-2026-15120",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Core"
    },
    {
      "id": "CVE-2026-15121",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in WebRTC"
    },
    {
      "id": "CVE-2026-15122",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Codecs"
    },
    {
      "id": "CVE-2026-15123",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient data validation in DOM"
    },
    {
      "id": "CVE-2026-15124",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in Passwords"
    },
    {
      "id": "CVE-2026-15125",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Forms"
    },
    {
      "id": "CVE-2026-15127",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in WebGL"
    },
    {
      "id": "CVE-2026-15128",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Forms"
    },
    {
      "id": "CVE-2026-15129",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-15130",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in Navigation"
    },
    {
      "id": "CVE-2026-15132",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in V8"
    },
    {
      "id": "CVE-2026-15133",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.114-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in InterestGroups"
    },
    {
      "id": "CVE-2026-15766",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in Skia"
    },
    {
      "id": "CVE-2026-15767",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: libyuv: chromium-browser: Heap buffer overflow in libyuv"
    },
    {
      "id": "CVE-2026-15768",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in HTML-in-Canvas"
    },
    {
      "id": "CVE-2026-15769",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Linux Toolkit Theming"
    },
    {
      "id": "CVE-2026-15770",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in V8"
    },
    {
      "id": "CVE-2026-15771",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Media"
    },
    {
      "id": "CVE-2026-15772",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in GPU"
    },
    {
      "id": "CVE-2026-15773",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Core"
    },
    {
      "id": "CVE-2026-15774",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Skia"
    },
    {
      "id": "CVE-2026-15775",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in V8"
    },
    {
      "id": "CVE-2026-15776",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Type Confusion in V8"
    },
    {
      "id": "CVE-2026-15777",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.124-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in UI"
    },
    {
      "id": "CVE-2026-16414",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "150.0.7871.181-1~deb13u1",
      "title": "Insufficient validation of untrusted input in Chromecast in Google Chr ..."
    },
    {
      "id": "CVE-2026-16804",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via crafted HTML page"
    },
    {
      "id": "CVE-2026-16805",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Blink"
    },
    {
      "id": "CVE-2026-16806",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: Chromium: Arbitrary code execution via use after free vulnerability in WebMCP"
    },
    {
      "id": "CVE-2026-16807",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: Google Chrome Codecs: Sandbox escape via crafted HTML page"
    },
    {
      "id": "CVE-2026-17650",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Compositing"
    },
    {
      "id": "CVE-2026-17657",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Navigation"
    },
    {
      "id": "CVE-2026-17658",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in V8"
    },
    {
      "id": "CVE-2026-17659",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in SiteIsolation"
    },
    {
      "id": "CVE-2026-17660",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Network"
    },
    {
      "id": "CVE-2026-17661",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Loader"
    },
    {
      "id": "CVE-2026-17662",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in Prefetch"
    },
    {
      "id": "CVE-2026-17663",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in GPU"
    },
    {
      "id": "CVE-2026-17664",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Loader"
    },
    {
      "id": "CVE-2026-17665",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in V8"
    },
    {
      "id": "CVE-2026-17666",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Cryptographic Flaw in Enterprise"
    },
    {
      "id": "CVE-2026-17667",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-17668",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-17670",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-17671",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in ANGLE"
    },
    {
      "id": "CVE-2026-17672",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Chromecast"
    },
    {
      "id": "CVE-2026-17673",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in QUIC"
    },
    {
      "id": "CVE-2026-17674",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in HTML"
    },
    {
      "id": "CVE-2026-17675",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write in ANGLE"
    },
    {
      "id": "CVE-2026-17676",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in ANGLE"
    },
    {
      "id": "CVE-2026-17677",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in ANGLE"
    },
    {
      "id": "CVE-2026-17678",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds read in ANGLE"
    },
    {
      "id": "CVE-2026-17679",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Print Preview"
    },
    {
      "id": "CVE-2026-17680",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Heap buffer overflow in Color"
    },
    {
      "id": "CVE-2026-17681",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Web Authentication"
    },
    {
      "id": "CVE-2026-17682",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in ANGLE"
    },
    {
      "id": "CVE-2026-17683",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in ANGLE"
    },
    {
      "id": "CVE-2026-17685",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Autofill"
    },
    {
      "id": "CVE-2026-17686",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Passwords"
    },
    {
      "id": "CVE-2026-17687",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: ANGLE: chromium-browser: Type Confusion in ANGLE"
    },
    {
      "id": "CVE-2026-17688",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Input"
    },
    {
      "id": "CVE-2026-17689",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-17690",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in PDF"
    },
    {
      "id": "CVE-2026-17691",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write in ANGLE"
    },
    {
      "id": "CVE-2026-17692",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in DataTransfer"
    },
    {
      "id": "CVE-2026-17693",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in FileSystem"
    },
    {
      "id": "CVE-2026-17694",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in DOM"
    },
    {
      "id": "CVE-2026-17695",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in ANGLE"
    },
    {
      "id": "CVE-2026-17696",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Side-channel information leakage in Media"
    },
    {
      "id": "CVE-2026-17697",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Type Confusion in ANGLE"
    },
    {
      "id": "CVE-2026-17698",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in UI"
    },
    {
      "id": "CVE-2026-17699",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Views"
    },
    {
      "id": "CVE-2026-17700",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Actor"
    },
    {
      "id": "CVE-2026-17701",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds read in ANGLE"
    },
    {
      "id": "CVE-2026-17702",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Skia"
    },
    {
      "id": "CVE-2026-17704",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in ANGLE"
    },
    {
      "id": "CVE-2026-17705",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: libxml: chromium-browser: Integer overflow in libxml"
    },
    {
      "id": "CVE-2026-17706",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Media"
    },
    {
      "id": "CVE-2026-17707",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in Media"
    },
    {
      "id": "CVE-2026-17708",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Audio"
    },
    {
      "id": "CVE-2026-17709",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Race in Downloads"
    },
    {
      "id": "CVE-2026-17710",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in MHTML"
    },
    {
      "id": "CVE-2026-17711",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Race in Downloads"
    },
    {
      "id": "CVE-2026-17712",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Race in Skia"
    },
    {
      "id": "CVE-2026-17713",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient validation of untrusted input in Accessibility"
    },
    {
      "id": "CVE-2026-17714",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Uninitialized Use in ANGLE"
    },
    {
      "id": "CVE-2026-17715",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Inappropriate implementation in Passwords"
    },
    {
      "id": "CVE-2026-17716",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Updater"
    },
    {
      "id": "CVE-2026-17717",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in ANGLE"
    },
    {
      "id": "CVE-2026-17718",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in ANGLE"
    },
    {
      "id": "CVE-2026-17719",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Input"
    },
    {
      "id": "CVE-2026-17720",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Insufficient policy enforcement in Passwords"
    },
    {
      "id": "CVE-2026-17721",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write in ANGLE"
    },
    {
      "id": "CVE-2026-17722",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Object lifecycle issue in WebView"
    },
    {
      "id": "CVE-2026-17723",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Use after free in Media"
    },
    {
      "id": "CVE-2026-17725",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Type Confusion in V8"
    },
    {
      "id": "CVE-2026-17726",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Integer overflow in WebGL"
    },
    {
      "id": "CVE-2026-17727",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Out of bounds write in WebGL"
    },
    {
      "id": "CVE-2026-17778",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Arbitrary code execution via crafted Chrome Extension"
    },
    {
      "id": "CVE-2026-17823",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.71-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Same-Origin Policy Bypass via Insufficient Policy Enforcement in WebXR"
    },
    {
      "id": "CVE-2026-19137",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome on Android: Sandbox escape via use after free in WebGL"
    },
    {
      "id": "CVE-2026-19138",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via heap buffer overflow in CrashReporting"
    },
    {
      "id": "CVE-2026-19140",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome GPU: Sandbox escape via use after free vulnerability in crafted HTML."
    },
    {
      "id": "CVE-2026-19141",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape due to use-after-free vulnerability"
    },
    {
      "id": "CVE-2026-19142",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Remote code execution via use after free in Views"
    },
    {
      "id": "CVE-2026-19143",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome on Android: Sandbox escape via malicious WebAPK input"
    },
    {
      "id": "CVE-2026-19144",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Arbitrary code execution via crafted HTML page"
    },
    {
      "id": "CVE-2026-19145",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Arbitrary code execution via use-after-free in Translate component"
    },
    {
      "id": "CVE-2026-19147",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via use-after-free vulnerability in Aura"
    },
    {
      "id": "CVE-2026-19148",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via out-of-bounds write in GPU"
    },
    {
      "id": "CVE-2026-19149",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via use-after-free vulnerability in Aura"
    },
    {
      "id": "CVE-2026-19150",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome (V8): Arbitrary code execution via crafted HTML page"
    },
    {
      "id": "CVE-2026-19151",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium-browser: Arbitrary code execution via use-after-free in V8"
    },
    {
      "id": "CVE-2026-19152",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape via insufficient policy enforcement in Navigation"
    },
    {
      "id": "CVE-2026-19153",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Site isolation bypass via insufficient input validation in Workers"
    },
    {
      "id": "CVE-2026-19155",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape via use-after-free in Payments"
    },
    {
      "id": "CVE-2026-19156",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Heap buffer overflow allows heap corruption via malicious extension"
    },
    {
      "id": "CVE-2026-19157",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: ANGLE: Sandbox escape via out-of-bounds write in Google Chrome on Android"
    },
    {
      "id": "CVE-2026-19158",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Arbitrary code execution via use-after-free in Views"
    },
    {
      "id": "CVE-2026-19159",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Arbitrary code execution via use-after-free in Views"
    },
    {
      "id": "CVE-2026-19162",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Arbitrary code execution via out-of-bounds write in V8."
    },
    {
      "id": "CVE-2026-19163",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via use-after-free in Media component"
    },
    {
      "id": "CVE-2026-19164",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome Codecs: Sandbox escape via crafted HTML page"
    },
    {
      "id": "CVE-2026-19166",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape due to use-after-free in Web Authentication"
    },
    {
      "id": "CVE-2026-19168",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome V8: Arbitrary Code Execution via crafted HTML page"
    },
    {
      "id": "CVE-2026-19169",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Privilege escalation via crafted HTML page in Contextual Tasks"
    },
    {
      "id": "CVE-2026-19170",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Sandbox escape via use after free in WebGL"
    },
    {
      "id": "CVE-2026-19171",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape via use-after-free in Media component"
    },
    {
      "id": "CVE-2026-19172",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape via use after free in Views"
    },
    {
      "id": "CVE-2026-19173",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium"
    },
    {
      "id": "CVE-2026-19174",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome V8: Arbitrary code execution via crafted HTML page"
    },
    {
      "id": "CVE-2026-19175",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Remote sandbox escape via use-after-free in Payments"
    },
    {
      "id": "CVE-2026-19177",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.108-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape via crafted HTML page"
    },
    {
      "id": "CVE-2026-19556",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.137-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Arbitrary code execution via use-after-free in V8"
    },
    {
      "id": "CVE-2026-19557",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.137-1~deb13u1",
      "title": "chromium-browser: Chromium: Sandbox escape via use-after-free in TabStrip"
    },
    {
      "id": "CVE-2026-19558",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.137-1~deb13u1",
      "title": "chromium-browser: Google Chrome Extensions: Arbitrary code execution via malicious extension installation"
    },
    {
      "id": "CVE-2026-19559",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.137-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Arbitrary code execution via use after free in HTML"
    },
    {
      "id": "CVE-2026-19560",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.137-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Arbitrary code execution via use-after-free in Blink"
    },
    {
      "id": "CVE-2026-76033",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Site isolation bypass due to inappropriate CORS implementation"
    },
    {
      "id": "CVE-2026-76036",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page"
    },
    {
      "id": "CVE-2026-76037",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Arbitrary Code Execution via Link Following"
    },
    {
      "id": "CVE-2026-76038",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: v8: V8: Remote code execution via type confusion in crafted HTML."
    },
    {
      "id": "CVE-2026-76039",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Chromium: Information disclosure via incorrect reference resolution"
    },
    {
      "id": "CVE-2026-76040",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: chromium-browser: Arbitrary code execution via use-after-free vulnerability"
    },
    {
      "id": "CVE-2026-76041",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Chromium: Information leak allows web origin policy bypass"
    },
    {
      "id": "CVE-2026-76043",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: v8: Google Chrome V8: Arbitrary code execution via incorrect calculation in HTML processing"
    },
    {
      "id": "CVE-2026-76044",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Google Chrome: Arbitrary code execution due to a race condition in USB"
    },
    {
      "id": "CVE-2026-76045",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Google Chrome WebGL: Arbitrary code execution via use-after-free"
    },
    {
      "id": "CVE-2026-76047",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "chromium-common",
      "installedVersion": "149.0.7827.102-1~deb13u1",
      "fixedVersion": "151.0.7922.169-1~deb13u1",
      "title": "chromium-browser: Chromium-browser: Arbitrary code execution via type confusion in V8"
    },
    {
      "id": "CVE-2026-12064",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "curl",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP"
    },
    {
      "id": "CVE-2026-8286",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "curl",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch"
    },
    {
      "id": "CVE-2026-8458",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "curl",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: libcurl: Unauthorized connection reuse due to a logical error"
    },
    {
      "id": "CVE-2026-8927",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "curl",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: Information disclosure due to uncleared proxy authentication state"
    },
    {
      "id": "CVE-2026-24882",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "dirmngr",
      "installedVersion": "2.4.7-21+deb13u1+b3",
      "fixedVersion": "",
      "title": "GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution"
    },
    {
      "id": "CVE-2026-24882",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "gnupg",
      "installedVersion": "2.4.7-21+deb13u1",
      "fixedVersion": "",
      "title": "GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution"
    },
    {
      "id": "CVE-2026-24882",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "gnupg-l10n",
      "installedVersion": "2.4.7-21+deb13u1",
      "fixedVersion": "",
      "title": "GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution"
    },
    {
      "id": "CVE-2026-24882",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "gpg",
      "installedVersion": "2.4.7-21+deb13u1+b3",
      "fixedVersion": "",
      "title": "GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution"
    },
    {
      "id": "CVE-2026-24882",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "gpg-agent",
      "installedVersion": "2.4.7-21+deb13u1+b3",
      "fixedVersion": "",
      "title": "GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution"
    },
    {
      "id": "CVE-2026-24882",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "gpgconf",
      "installedVersion": "2.4.7-21+deb13u1+b3",
      "fixedVersion": "",
      "title": "GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution"
    },
    {
      "id": "CVE-2026-24882",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "gpgsm",
      "installedVersion": "2.4.7-21+deb13u1+b3",
      "fixedVersion": "",
      "title": "GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution"
    },
    {
      "id": "CVE-2026-41992",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "gzip",
      "installedVersion": "1.13-1",
      "fixedVersion": "",
      "title": "GNU gzip contains a global buffer overflow vulnerability in the LZH de ..."
    },
    {
      "id": "CVE-2026-54369",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libacl1",
      "installedVersion": "2.3.2-2+b1",
      "fixedVersion": "",
      "title": "acl: Symlink traversal privilege escalation via libacl functions"
    },
    {
      "id": "CVE-2026-53612",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libblkid1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes"
    },
    {
      "id": "CVE-2026-53613",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libblkid1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path"
    },
    {
      "id": "CVE-2026-53614",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libblkid1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2"
    },
    {
      "id": "CVE-2026-53615",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libblkid1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]"
    },
    {
      "id": "CVE-2026-34980",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcups2t64",
      "installedVersion": "2.4.10-3+deb13u2",
      "fixedVersion": "",
      "title": "cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network"
    },
    {
      "id": "CVE-2026-12064",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcurl3t64-gnutls",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP"
    },
    {
      "id": "CVE-2026-8286",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcurl3t64-gnutls",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch"
    },
    {
      "id": "CVE-2026-8458",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcurl3t64-gnutls",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: libcurl: Unauthorized connection reuse due to a logical error"
    },
    {
      "id": "CVE-2026-8927",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcurl3t64-gnutls",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: Information disclosure due to uncleared proxy authentication state"
    },
    {
      "id": "CVE-2026-12064",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcurl4-gnutls",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP"
    },
    {
      "id": "CVE-2026-8286",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcurl4-gnutls",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch"
    },
    {
      "id": "CVE-2026-8458",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcurl4-gnutls",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: libcurl: Unauthorized connection reuse due to a logical error"
    },
    {
      "id": "CVE-2026-8927",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcurl4-gnutls",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: Information disclosure due to uncleared proxy authentication state"
    },
    {
      "id": "CVE-2026-12064",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcurl4t64",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP"
    },
    {
      "id": "CVE-2026-8286",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcurl4t64",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch"
    },
    {
      "id": "CVE-2026-8458",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcurl4t64",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: libcurl: Unauthorized connection reuse due to a logical error"
    },
    {
      "id": "CVE-2026-8927",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcurl4t64",
      "installedVersion": "8.20.0-5~bpo13+1",
      "fixedVersion": "",
      "title": "curl: Information disclosure due to uncleared proxy authentication state"
    },
    {
      "id": "CVE-2025-59375",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libexpat1",
      "installedVersion": "2.7.1-2",
      "fixedVersion": "2.8.2-1~deb13u1",
      "title": "firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing"
    },
    {
      "id": "CVE-2026-25210",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libexpat1",
      "installedVersion": "2.7.1-2",
      "fixedVersion": "2.8.2-1~deb13u1",
      "title": "libexpat: libexpat: Information disclosure and data integrity issues due to integer overflow in buffer reallocation"
    },
    {
      "id": "CVE-2026-45186",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libexpat1",
      "installedVersion": "2.7.1-2",
      "fixedVersion": "2.8.2-1~deb13u1",
      "title": "libexpat: denial of service via crafted XML input"
    },
    {
      "id": "CVE-2026-56408",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libexpat1",
      "installedVersion": "2.7.1-2",
      "fixedVersion": "2.8.2-1~deb13u1",
      "title": "libexpat before 2.8.2 has an integer overflow in copyString."
    },
    {
      "id": "CVE-2026-40393",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libgbm1",
      "installedVersion": "25.0.7-2",
      "fixedVersion": "25.0.7-2+deb13u1",
      "title": "In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory acces ..."
    },
    {
      "id": "CVE-2026-40393",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libgl1-mesa-dri",
      "installedVersion": "25.0.7-2",
      "fixedVersion": "25.0.7-2+deb13u1",
      "title": "In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory acces ..."
    },
    {
      "id": "CVE-2026-58016",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libglib2.0-0t64",
      "installedVersion": "2.84.4-3~deb13u3",
      "fixedVersion": "",
      "title": "glib: integer underflow in gio/gdbusintrospection.c via \"g_dbus_node_info_new_for_xml\""
    },
    {
      "id": "CVE-2026-58010",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libglib2.0-0t64",
      "installedVersion": "2.84.4-3~deb13u3",
      "fixedVersion": "",
      "title": "glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()"
    },
    {
      "id": "CVE-2026-58011",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libglib2.0-0t64",
      "installedVersion": "2.84.4-3~deb13u3",
      "fixedVersion": "",
      "title": "glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime"
    },
    {
      "id": "CVE-2026-58012",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libglib2.0-0t64",
      "installedVersion": "2.84.4-3~deb13u3",
      "fixedVersion": "",
      "title": "glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()"
    },
    {
      "id": "CVE-2026-58013",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libglib2.0-0t64",
      "installedVersion": "2.84.4-3~deb13u3",
      "fixedVersion": "",
      "title": "glib: buffer over-read in glib/giochannel.c via \"g_io_channel_read_line_backend\""
    },
    {
      "id": "CVE-2026-58014",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libglib2.0-0t64",
      "installedVersion": "2.84.4-3~deb13u3",
      "fixedVersion": "",
      "title": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\""
    },
    {
      "id": "CVE-2026-58015",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libglib2.0-0t64",
      "installedVersion": "2.84.4-3~deb13u3",
      "fixedVersion": "",
      "title": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive"
    },
    {
      "id": "CVE-2026-40393",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libglx-mesa0",
      "installedVersion": "25.0.7-2",
      "fixedVersion": "25.0.7-2+deb13u1",
      "title": "In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory acces ..."
    },
    {
      "id": "CVE-2026-18297",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libgstreamer-plugins-base1.0-0",
      "installedVersion": "1.26.2-1+deb13u1",
      "fixedVersion": "",
      "title": "gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow"
    },
    {
      "id": "CVE-2026-53612",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "liblastlog2-2",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes"
    },
    {
      "id": "CVE-2026-53613",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "liblastlog2-2",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path"
    },
    {
      "id": "CVE-2026-53614",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "liblastlog2-2",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2"
    },
    {
      "id": "CVE-2026-53615",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "liblastlog2-2",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]"
    },
    {
      "id": "CVE-2026-53612",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libmount1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes"
    },
    {
      "id": "CVE-2026-53613",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libmount1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path"
    },
    {
      "id": "CVE-2026-53614",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libmount1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2"
    },
    {
      "id": "CVE-2026-53615",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libmount1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]"
    },
    {
      "id": "CVE-2025-69720",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libncursesw6",
      "installedVersion": "6.5+20250216-2",
      "fixedVersion": "",
      "title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution."
    },
    {
      "id": "CVE-2026-13221",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libperl5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl: Perl: Incorrect regular expression processing via large regular expressions"
    },
    {
      "id": "CVE-2026-42496",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libperl5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access"
    },
    {
      "id": "CVE-2026-8376",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libperl5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds"
    },
    {
      "id": "CVE-2026-42497",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libperl5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction"
    },
    {
      "id": "CVE-2026-48962",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libperl5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob"
    },
    {
      "id": "CVE-2026-57432",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libperl5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations"
    },
    {
      "id": "CVE-2026-57433",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libperl5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization"
    },
    {
      "id": "CVE-2026-9538",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libperl5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size"
    },
    {
      "id": "CVE-2026-11940",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libpython3.13",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory"
    },
    {
      "id": "CVE-2026-15308",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libpython3.13",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations"
    },
    {
      "id": "CVE-2026-7210",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libpython3.13",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: expat: Python/Expat: Denial of Service via crafted XML document"
    },
    {
      "id": "CVE-2026-11940",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libpython3.13-minimal",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory"
    },
    {
      "id": "CVE-2026-15308",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libpython3.13-minimal",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations"
    },
    {
      "id": "CVE-2026-7210",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libpython3.13-minimal",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: expat: Python/Expat: Denial of Service via crafted XML document"
    },
    {
      "id": "CVE-2026-11940",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libpython3.13-stdlib",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory"
    },
    {
      "id": "CVE-2026-15308",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libpython3.13-stdlib",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations"
    },
    {
      "id": "CVE-2026-7210",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libpython3.13-stdlib",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: expat: Python/Expat: Denial of Service via crafted XML document"
    },
    {
      "id": "CVE-2026-53612",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libsmartcols1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes"
    },
    {
      "id": "CVE-2026-53613",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libsmartcols1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path"
    },
    {
      "id": "CVE-2026-53614",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libsmartcols1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2"
    },
    {
      "id": "CVE-2026-53615",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libsmartcols1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]"
    },
    {
      "id": "CVE-2026-37555",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libsndfile1",
      "installedVersion": "1.2.2-2+deb13u1",
      "fixedVersion": "",
      "title": "libsndfile: integer overflow in ima_reader_init()"
    },
    {
      "id": "CVE-2026-11822",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libsqlite3-0",
      "installedVersion": "3.46.1-7+deb13u1",
      "fixedVersion": "",
      "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data"
    },
    {
      "id": "CVE-2026-11824",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libsqlite3-0",
      "installedVersion": "3.46.1-7+deb13u1",
      "fixedVersion": "",
      "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5"
    },
    {
      "id": "CVE-2026-55199",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libssh2-1t64",
      "installedVersion": "1.11.1-1",
      "fixedVersion": "1.11.1-1+deb13u1",
      "title": "libssh2: libssh2: Denial of Service via crafted SSH_MSG_EXT_INFO message"
    },
    {
      "id": "CVE-2026-55200",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libssh2-1t64",
      "installedVersion": "1.11.1-1",
      "fixedVersion": "1.11.1-1+deb13u1",
      "title": "libssh2: libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c"
    },
    {
      "id": "CVE-2026-58050",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libssh2-1t64",
      "installedVersion": "1.11.1-1",
      "fixedVersion": "",
      "title": "libssh2: libssh2: Heap buffer overflow via integer overflow in publickey attribute allocation"
    },
    {
      "id": "CVE-2026-7598",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libssh2-1t64",
      "installedVersion": "1.11.1-1",
      "fixedVersion": "1.11.1-1+deb13u1",
      "title": "libssh2: integer overflow via large username or password arguments"
    },
    {
      "id": "CVE-2026-14456",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libssl3t64",
      "installedVersion": "3.5.6-1~deb13u2",
      "fixedVersion": "3.5.7-1~deb13u2",
      "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server"
    },
    {
      "id": "CVE-2026-12912",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libtiff6",
      "installedVersion": "4.7.0-3+deb13u2",
      "fixedVersion": "4.7.0-3+deb13u3",
      "title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image"
    },
    {
      "id": "CVE-2026-36849",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libtiff6",
      "installedVersion": "4.7.0-3+deb13u2",
      "fixedVersion": "",
      "title": "[Denial of Service via large SamplesPerPixel tag]"
    },
    {
      "id": "CVE-2026-52490",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libtiff6",
      "installedVersion": "4.7.0-3+deb13u2",
      "fixedVersion": "",
      "title": "libtiff: libtiff: Arbitrary code execution via process_command_opts() function"
    },
    {
      "id": "CVE-2025-69720",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libtinfo6",
      "installedVersion": "6.5+20250216-2",
      "fixedVersion": "",
      "title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution."
    },
    {
      "id": "CVE-2026-53612",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libuuid1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes"
    },
    {
      "id": "CVE-2026-53613",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libuuid1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path"
    },
    {
      "id": "CVE-2026-53614",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libuuid1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2"
    },
    {
      "id": "CVE-2026-53615",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libuuid1",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]"
    },
    {
      "id": "CVE-2026-6653",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libxml2",
      "installedVersion": "2.12.7+dfsg+really2.9.14-2.1+deb13u2",
      "fixedVersion": "",
      "title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free"
    },
    {
      "id": "CVE-2026-53612",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "login",
      "installedVersion": "1:4.16.0-2+really2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes"
    },
    {
      "id": "CVE-2026-53613",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "login",
      "installedVersion": "1:4.16.0-2+really2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path"
    },
    {
      "id": "CVE-2026-53614",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "login",
      "installedVersion": "1:4.16.0-2+really2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2"
    },
    {
      "id": "CVE-2026-53615",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "login",
      "installedVersion": "1:4.16.0-2+really2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]"
    },
    {
      "id": "CVE-2026-40393",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "mesa-libgallium",
      "installedVersion": "25.0.7-2",
      "fixedVersion": "25.0.7-2+deb13u1",
      "title": "In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory acces ..."
    },
    {
      "id": "CVE-2026-53612",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "mount",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes"
    },
    {
      "id": "CVE-2026-53613",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "mount",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path"
    },
    {
      "id": "CVE-2026-53614",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "mount",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2"
    },
    {
      "id": "CVE-2026-53615",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "mount",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]"
    },
    {
      "id": "CVE-2025-69720",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "ncurses-base",
      "installedVersion": "6.5+20250216-2",
      "fixedVersion": "",
      "title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution."
    },
    {
      "id": "CVE-2025-69720",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "ncurses-bin",
      "installedVersion": "6.5+20250216-2",
      "fixedVersion": "",
      "title": "ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution."
    },
    {
      "id": "CVE-2026-14456",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "openssl",
      "installedVersion": "3.5.6-1~deb13u2",
      "fixedVersion": "3.5.7-1~deb13u2",
      "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server"
    },
    {
      "id": "CVE-2026-14456",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "openssl-provider-legacy",
      "installedVersion": "3.5.6-1~deb13u2",
      "fixedVersion": "3.5.7-1~deb13u2",
      "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server"
    },
    {
      "id": "CVE-2026-13221",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl: Perl: Incorrect regular expression processing via large regular expressions"
    },
    {
      "id": "CVE-2026-42496",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access"
    },
    {
      "id": "CVE-2026-8376",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds"
    },
    {
      "id": "CVE-2026-42497",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction"
    },
    {
      "id": "CVE-2026-48962",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob"
    },
    {
      "id": "CVE-2026-57432",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations"
    },
    {
      "id": "CVE-2026-57433",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization"
    },
    {
      "id": "CVE-2026-9538",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size"
    },
    {
      "id": "CVE-2026-13221",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-base",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl: Perl: Incorrect regular expression processing via large regular expressions"
    },
    {
      "id": "CVE-2026-42496",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-base",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access"
    },
    {
      "id": "CVE-2026-8376",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-base",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds"
    },
    {
      "id": "CVE-2026-42497",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-base",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction"
    },
    {
      "id": "CVE-2026-48962",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-base",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob"
    },
    {
      "id": "CVE-2026-57432",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-base",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations"
    },
    {
      "id": "CVE-2026-57433",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-base",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization"
    },
    {
      "id": "CVE-2026-9538",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-base",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size"
    },
    {
      "id": "CVE-2026-13221",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-modules-5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl: Perl: Incorrect regular expression processing via large regular expressions"
    },
    {
      "id": "CVE-2026-42496",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-modules-5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access"
    },
    {
      "id": "CVE-2026-8376",
      "severity": "CRITICAL",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-modules-5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds"
    },
    {
      "id": "CVE-2026-42497",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-modules-5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-Archive-Tar: perl-Archive-Tar: Arbitrary file modification via crafted hardlinks during archive extraction"
    },
    {
      "id": "CVE-2026-48962",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-modules-5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob"
    },
    {
      "id": "CVE-2026-57432",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-modules-5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations"
    },
    {
      "id": "CVE-2026-57433",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-modules-5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization"
    },
    {
      "id": "CVE-2026-9538",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "perl-modules-5.40",
      "installedVersion": "5.40.1-6",
      "fixedVersion": "",
      "title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size"
    },
    {
      "id": "CVE-2026-23949",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "python3-pkg-resources",
      "installedVersion": "78.1.1-0.1",
      "fixedVersion": "",
      "title": "jaraco.context: jaraco.context: Path traversal via malicious tar archives"
    },
    {
      "id": "CVE-2026-23949",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "python3-setuptools",
      "installedVersion": "78.1.1-0.1",
      "fixedVersion": "",
      "title": "jaraco.context: jaraco.context: Path traversal via malicious tar archives"
    },
    {
      "id": "CVE-2026-11940",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "python3.13",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory"
    },
    {
      "id": "CVE-2026-15308",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "python3.13",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations"
    },
    {
      "id": "CVE-2026-7210",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "python3.13",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: expat: Python/Expat: Denial of Service via crafted XML document"
    },
    {
      "id": "CVE-2026-11940",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "python3.13-minimal",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory"
    },
    {
      "id": "CVE-2026-15308",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "python3.13-minimal",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations"
    },
    {
      "id": "CVE-2026-7210",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "python3.13-minimal",
      "installedVersion": "3.13.5-2+deb13u2",
      "fixedVersion": "",
      "title": "python: expat: Python/Expat: Denial of Service via crafted XML document"
    },
    {
      "id": "CVE-2026-53612",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "util-linux",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes"
    },
    {
      "id": "CVE-2026-53613",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "util-linux",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: TOCTOU in the mount program via ancestor directory swap on target path"
    },
    {
      "id": "CVE-2026-53614",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "util-linux",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2"
    },
    {
      "id": "CVE-2026-53615",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "util-linux",
      "installedVersion": "2.41-5",
      "fixedVersion": "2.41.5-0+deb13u1",
      "title": "[Integer Overflow or Wraparound in libblkid/src/partitions/dos.c]"
    },
    {
      "id": "CVE-2022-4055",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "staging-registry.payment-gateway.app/gotenberg:8.34.0@sha256:67097317623a503ba2a6a7e9ae8db6929a1f7e1bbd88077bacf2d325fbdab923 (debian 13.5)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "xdg-utils",
      "installedVersion": "1.2.1-2",
      "fixedVersion": "",
      "title": "xdg-utils: improper parse of mailto URIs allows bypass of Thunderbird security mechanism for attachments"
    },
    {
      "id": "CVE-2026-55677",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/labstack/echo/v4",
      "installedVersion": "v4.15.2",
      "fixedVersion": "4.15.3",
      "title": "github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.55.0",
      "fixedVersion": "0.56.0",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56852",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/text",
      "installedVersion": "v0.37.0",
      "fixedVersion": "0.39.0",
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "id": "GHSA-hrxh-6v49-42gf",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "google.golang.org/grpc",
      "installedVersion": "v1.81.1",
      "fixedVersion": "1.82.1",
      "title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/gotenberg",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2026-39828",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.50.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
    },
    {
      "id": "CVE-2026-39829",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.50.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
    },
    {
      "id": "CVE-2026-39830",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.50.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
    },
    {
      "id": "CVE-2026-39831",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.50.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
    },
    {
      "id": "CVE-2026-39832",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.50.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
    },
    {
      "id": "CVE-2026-39835",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.50.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
    },
    {
      "id": "CVE-2026-42508",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.50.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
    },
    {
      "id": "CVE-2026-46595",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.50.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
    },
    {
      "id": "CVE-2026-46597",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.50.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
    },
    {
      "id": "CVE-2026-46602",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/image",
      "installedVersion": "v0.39.0",
      "fixedVersion": "0.43.0",
      "title": "The TIFF decoder does not set a limit on the size of tiles in tiled im ..."
    },
    {
      "id": "CVE-2026-56852",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/text",
      "installedVersion": "v0.36.0",
      "fixedVersion": "0.39.0",
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "gotenberg",
      "report": "gotenberg.vuln.json",
      "target": "usr/bin/pdfcpu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.2",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2025-26519",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "staging-registry.payment-gateway.app/mgob:2.0.28@sha256:ad347cfd1b453541d855ef0af88aaaecfee4cf18332bfbecd50520e3c4718f27 (alpine 3.18.11)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "musl",
      "installedVersion": "1.2.4-r2",
      "fixedVersion": "1.2.4-r3",
      "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ..."
    },
    {
      "id": "CVE-2025-26519",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "staging-registry.payment-gateway.app/mgob:2.0.28@sha256:ad347cfd1b453541d855ef0af88aaaecfee4cf18332bfbecd50520e3c4718f27 (alpine 3.18.11)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "musl-utils",
      "installedVersion": "1.2.4-r2",
      "fixedVersion": "1.2.4-r3",
      "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ..."
    },
    {
      "id": "CVE-2025-6965",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "staging-registry.payment-gateway.app/mgob:2.0.28@sha256:ad347cfd1b453541d855ef0af88aaaecfee4cf18332bfbecd50520e3c4718f27 (alpine 3.18.11)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "sqlite-libs",
      "installedVersion": "3.41.2-r3",
      "fixedVersion": "3.41.2-r4",
      "title": "sqlite: Integer Truncation in SQLite"
    },
    {
      "id": "CVE-2025-31115",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "staging-registry.payment-gateway.app/mgob:2.0.28@sha256:ad347cfd1b453541d855ef0af88aaaecfee4cf18332bfbecd50520e3c4718f27 (alpine 3.18.11)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "xz-libs",
      "installedVersion": "5.4.3-r0",
      "fixedVersion": "5.4.3-r1",
      "title": "xz: XZ has a heap-use-after-free bug in threaded .xz decoder"
    },
    {
      "id": "CVE-2026-32597",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "PyJWT",
      "installedVersion": "2.10.1",
      "fixedVersion": "2.12.0",
      "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)"
    },
    {
      "id": "CVE-2026-48526",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "PyJWT",
      "installedVersion": "2.10.1",
      "fixedVersion": "2.13.0",
      "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
    },
    {
      "id": "CVE-2026-21226",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "azure-core",
      "installedVersion": "1.32.0",
      "fixedVersion": "1.38.0",
      "title": "Azure Core is vulnerable to deserialization of untrusted data"
    },
    {
      "id": "CVE-2026-26007",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "cryptography",
      "installedVersion": "43.0.1",
      "fixedVersion": "46.0.5",
      "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves"
    },
    {
      "id": "CVE-2026-69249",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "cryptography",
      "installedVersion": "43.0.1",
      "fixedVersion": "49.0.0",
      "title": "python-cryptography is a package designed to expose cryptographic prim ..."
    },
    {
      "id": "GHSA-537c-gmf6-5ccf",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "cryptography",
      "installedVersion": "43.0.1",
      "fixedVersion": "48.0.1",
      "title": "Vulnerable OpenSSL included in cryptography wheels"
    },
    {
      "id": "CVE-2026-26007",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "cryptography",
      "installedVersion": "44.0.0",
      "fixedVersion": "46.0.5",
      "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves"
    },
    {
      "id": "CVE-2026-69247",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "cryptography",
      "installedVersion": "44.0.0",
      "fixedVersion": "50.0.0",
      "title": "cryptography is a package designed to expose cryptographic primitives  ..."
    },
    {
      "id": "CVE-2026-69249",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "cryptography",
      "installedVersion": "44.0.0",
      "fixedVersion": "49.0.0",
      "title": "python-cryptography is a package designed to expose cryptographic prim ..."
    },
    {
      "id": "GHSA-537c-gmf6-5ccf",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "cryptography",
      "installedVersion": "44.0.0",
      "fixedVersion": "48.0.1",
      "title": "Vulnerable OpenSSL included in cryptography wheels"
    },
    {
      "id": "CVE-2026-27459",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "pyOpenSSL",
      "installedVersion": "24.2.1",
      "fixedVersion": "26.0.0",
      "title": "pyOpenSSL: DTLS cookie callback buffer overflow"
    },
    {
      "id": "CVE-2026-27459",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "pyOpenSSL",
      "installedVersion": "25.0.0",
      "fixedVersion": "26.0.0",
      "title": "pyOpenSSL: DTLS cookie callback buffer overflow"
    },
    {
      "id": "CVE-2026-23490",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "pyasn1",
      "installedVersion": "0.6.1",
      "fixedVersion": "0.6.2",
      "title": "pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID"
    },
    {
      "id": "CVE-2026-30922",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "pyasn1",
      "installedVersion": "0.6.1",
      "fixedVersion": "0.6.3",
      "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion"
    },
    {
      "id": "CVE-2026-59884",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "pyasn1",
      "installedVersion": "0.6.1",
      "fixedVersion": "0.6.4",
      "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input"
    },
    {
      "id": "CVE-2026-59885",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "pyasn1",
      "installedVersion": "0.6.1",
      "fixedVersion": "0.6.4",
      "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER"
    },
    {
      "id": "CVE-2026-59886",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "pyasn1",
      "installedVersion": "0.6.1",
      "fixedVersion": "0.6.4",
      "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values"
    },
    {
      "id": "CVE-2022-40897",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "setuptools",
      "installedVersion": "65.5.0",
      "fixedVersion": "65.5.1",
      "title": "pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py"
    },
    {
      "id": "CVE-2022-40897",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "setuptools",
      "installedVersion": "65.5.0",
      "fixedVersion": "65.5.1",
      "title": "pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py"
    },
    {
      "id": "CVE-2024-6345",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "setuptools",
      "installedVersion": "65.5.0",
      "fixedVersion": "70.0.0",
      "title": "pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools"
    },
    {
      "id": "CVE-2024-6345",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "setuptools",
      "installedVersion": "65.5.0",
      "fixedVersion": "70.0.0",
      "title": "pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools"
    },
    {
      "id": "CVE-2025-47273",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "setuptools",
      "installedVersion": "65.5.0",
      "fixedVersion": "78.1.1",
      "title": "setuptools: Path Traversal Vulnerability in setuptools PackageIndex"
    },
    {
      "id": "CVE-2025-47273",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "setuptools",
      "installedVersion": "65.5.0",
      "fixedVersion": "78.1.1",
      "title": "setuptools: Path Traversal Vulnerability in setuptools PackageIndex"
    },
    {
      "id": "CVE-2025-47273",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "setuptools",
      "installedVersion": "70.3.0",
      "fixedVersion": "78.1.1",
      "title": "setuptools: Path Traversal Vulnerability in setuptools PackageIndex"
    },
    {
      "id": "CVE-2025-66418",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "urllib3",
      "installedVersion": "1.26.20",
      "fixedVersion": "2.6.0",
      "title": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion"
    },
    {
      "id": "CVE-2025-66471",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "urllib3",
      "installedVersion": "1.26.20",
      "fixedVersion": "2.6.0",
      "title": "urllib3: urllib3 Streaming API improperly handles highly compressed data"
    },
    {
      "id": "CVE-2026-21441",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "urllib3",
      "installedVersion": "1.26.20",
      "fixedVersion": "2.6.3",
      "title": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)"
    },
    {
      "id": "CVE-2026-44431",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "urllib3",
      "installedVersion": "1.26.20",
      "fixedVersion": "2.7.0",
      "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
    },
    {
      "id": "CVE-2026-24049",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "wheel",
      "installedVersion": "0.44.0",
      "fixedVersion": "0.46.2",
      "title": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking"
    },
    {
      "id": "CVE-2026-24049",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "Python",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "wheel",
      "installedVersion": "0.45.1",
      "fixedVersion": "0.46.2",
      "title": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking"
    },
    {
      "id": "CVE-2025-68121",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3",
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "id": "CVE-2024-34156",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.22.7, 1.23.1",
      "title": "encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion"
    },
    {
      "id": "CVE-2025-61726",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.24.12, 1.25.6",
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "CVE-2025-61729",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.24.11, 1.25.5",
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "id": "CVE-2026-25679",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.8, 1.26.1",
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-32280",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "id": "CVE-2026-32281",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "id": "CVE-2026-32283",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "google-cloud-sdk/bin/gcloud-crc32c",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2025-30204",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/golang-jwt/jwt/v5",
      "installedVersion": "v5.2.1",
      "fixedVersion": "5.2.2",
      "title": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing"
    },
    {
      "id": "CVE-2025-22869",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.35.0",
      "title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh"
    },
    {
      "id": "CVE-2025-47913",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.43.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS"
    },
    {
      "id": "CVE-2026-39828",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
    },
    {
      "id": "CVE-2026-39829",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
    },
    {
      "id": "CVE-2026-39830",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
    },
    {
      "id": "CVE-2026-39831",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
    },
    {
      "id": "CVE-2026-39832",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
    },
    {
      "id": "CVE-2026-39835",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
    },
    {
      "id": "CVE-2026-42508",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
    },
    {
      "id": "CVE-2026-46595",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
    },
    {
      "id": "CVE-2026-46597",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
    },
    {
      "id": "CVE-2026-25681",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
    },
    {
      "id": "CVE-2026-27136",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.53.0",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.56.0",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56852",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/text",
      "installedVersion": "v0.21.0",
      "fixedVersion": "0.39.0",
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "id": "CVE-2025-68121",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3",
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "id": "CVE-2025-61726",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.12, 1.25.6",
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "CVE-2025-61729",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.11, 1.25.5",
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "id": "CVE-2026-25679",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.8, 1.26.1",
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-32280",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "id": "CVE-2026-32281",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "id": "CVE-2026-32283",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2025-30204",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/golang-jwt/jwt/v4",
      "installedVersion": "v4.5.1",
      "fixedVersion": "4.5.2",
      "title": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing"
    },
    {
      "id": "CVE-2026-42151",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/prometheus/prometheus",
      "installedVersion": "v0.301.0",
      "fixedVersion": "0.311.3",
      "title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
    },
    {
      "id": "CVE-2026-42154",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/prometheus/prometheus",
      "installedVersion": "v0.301.0",
      "fixedVersion": "0.311.3, 0.305.2",
      "title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint"
    },
    {
      "id": "CVE-2025-22869",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.35.0",
      "title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh"
    },
    {
      "id": "CVE-2025-47913",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.43.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS"
    },
    {
      "id": "CVE-2026-39828",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
    },
    {
      "id": "CVE-2026-39829",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
    },
    {
      "id": "CVE-2026-39830",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
    },
    {
      "id": "CVE-2026-39831",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
    },
    {
      "id": "CVE-2026-39832",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
    },
    {
      "id": "CVE-2026-39835",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
    },
    {
      "id": "CVE-2026-42508",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
    },
    {
      "id": "CVE-2026-46595",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
    },
    {
      "id": "CVE-2026-46597",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
    },
    {
      "id": "CVE-2026-25681",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
    },
    {
      "id": "CVE-2026-27136",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.53.0",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.56.0",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56852",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/text",
      "installedVersion": "v0.21.0",
      "fixedVersion": "0.39.0",
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "id": "CVE-2026-33186",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "google.golang.org/grpc",
      "installedVersion": "v1.69.4",
      "fixedVersion": "1.79.3",
      "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
    },
    {
      "id": "GHSA-hrxh-6v49-42gf",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "google.golang.org/grpc",
      "installedVersion": "v1.69.4",
      "fixedVersion": "1.82.1",
      "title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities"
    },
    {
      "id": "CVE-2025-68121",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3",
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "id": "CVE-2025-61726",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.24.12, 1.25.6",
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "CVE-2025-61729",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.24.11, 1.25.5",
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "id": "CVE-2026-25679",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.8, 1.26.1",
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-32280",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "id": "CVE-2026-32281",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "id": "CVE-2026-32283",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mc",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2025-30204",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/golang-jwt/jwt/v5",
      "installedVersion": "v5.2.1",
      "fixedVersion": "5.2.2",
      "title": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing"
    },
    {
      "id": "CVE-2025-22869",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.35.0",
      "title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh"
    },
    {
      "id": "CVE-2025-47913",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.43.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS"
    },
    {
      "id": "CVE-2026-39828",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
    },
    {
      "id": "CVE-2026-39829",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
    },
    {
      "id": "CVE-2026-39830",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
    },
    {
      "id": "CVE-2026-39831",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
    },
    {
      "id": "CVE-2026-39832",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
    },
    {
      "id": "CVE-2026-39835",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
    },
    {
      "id": "CVE-2026-42508",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
    },
    {
      "id": "CVE-2026-46595",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
    },
    {
      "id": "CVE-2026-46597",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
    },
    {
      "id": "CVE-2026-25681",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
    },
    {
      "id": "CVE-2026-27136",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.53.0",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.56.0",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56852",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/text",
      "installedVersion": "v0.21.0",
      "fixedVersion": "0.39.0",
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "id": "CVE-2025-68121",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3",
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "id": "CVE-2025-61726",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.12, 1.25.6",
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "CVE-2025-61729",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.11, 1.25.5",
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "id": "CVE-2026-25679",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.8, 1.26.1",
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-32280",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "id": "CVE-2026-32281",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "id": "CVE-2026-32283",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2025-30204",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/golang-jwt/jwt/v5",
      "installedVersion": "v5.2.1",
      "fixedVersion": "5.2.2",
      "title": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing"
    },
    {
      "id": "CVE-2025-22869",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.35.0",
      "title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh"
    },
    {
      "id": "CVE-2025-47913",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.43.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS"
    },
    {
      "id": "CVE-2026-39828",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
    },
    {
      "id": "CVE-2026-39829",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
    },
    {
      "id": "CVE-2026-39830",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
    },
    {
      "id": "CVE-2026-39831",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
    },
    {
      "id": "CVE-2026-39832",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
    },
    {
      "id": "CVE-2026-39835",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
    },
    {
      "id": "CVE-2026-42508",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
    },
    {
      "id": "CVE-2026-46595",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
    },
    {
      "id": "CVE-2026-46597",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
    },
    {
      "id": "CVE-2026-25681",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
    },
    {
      "id": "CVE-2026-27136",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.53.0",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.56.0",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56852",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/text",
      "installedVersion": "v0.21.0",
      "fixedVersion": "0.39.0",
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "id": "CVE-2025-68121",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3",
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "id": "CVE-2025-61726",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.12, 1.25.6",
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "CVE-2025-61729",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.11, 1.25.5",
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "id": "CVE-2026-25679",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.8, 1.26.1",
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-32280",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "id": "CVE-2026-32281",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "id": "CVE-2026-32283",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2025-30204",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/golang-jwt/jwt/v5",
      "installedVersion": "v5.2.1",
      "fixedVersion": "5.2.2",
      "title": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing"
    },
    {
      "id": "CVE-2025-22869",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.35.0",
      "title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh"
    },
    {
      "id": "CVE-2025-47913",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.43.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS"
    },
    {
      "id": "CVE-2026-39828",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
    },
    {
      "id": "CVE-2026-39829",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
    },
    {
      "id": "CVE-2026-39830",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
    },
    {
      "id": "CVE-2026-39831",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
    },
    {
      "id": "CVE-2026-39832",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
    },
    {
      "id": "CVE-2026-39835",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
    },
    {
      "id": "CVE-2026-42508",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
    },
    {
      "id": "CVE-2026-46595",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
    },
    {
      "id": "CVE-2026-46597",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
    },
    {
      "id": "CVE-2026-25681",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
    },
    {
      "id": "CVE-2026-27136",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.53.0",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.56.0",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56852",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/text",
      "installedVersion": "v0.21.0",
      "fixedVersion": "0.39.0",
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "id": "CVE-2025-68121",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3",
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "id": "CVE-2025-61726",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.12, 1.25.6",
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "CVE-2025-61729",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.11, 1.25.5",
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "id": "CVE-2026-25679",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.8, 1.26.1",
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-32280",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "id": "CVE-2026-32281",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "id": "CVE-2026-32283",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2025-30204",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/golang-jwt/jwt/v5",
      "installedVersion": "v5.2.1",
      "fixedVersion": "5.2.2",
      "title": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing"
    },
    {
      "id": "CVE-2025-22869",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.35.0",
      "title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh"
    },
    {
      "id": "CVE-2025-47913",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.43.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS"
    },
    {
      "id": "CVE-2026-39828",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
    },
    {
      "id": "CVE-2026-39829",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
    },
    {
      "id": "CVE-2026-39830",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
    },
    {
      "id": "CVE-2026-39831",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
    },
    {
      "id": "CVE-2026-39832",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
    },
    {
      "id": "CVE-2026-39835",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
    },
    {
      "id": "CVE-2026-42508",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
    },
    {
      "id": "CVE-2026-46595",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
    },
    {
      "id": "CVE-2026-46597",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
    },
    {
      "id": "CVE-2026-25681",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
    },
    {
      "id": "CVE-2026-27136",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.53.0",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.56.0",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56852",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/text",
      "installedVersion": "v0.21.0",
      "fixedVersion": "0.39.0",
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "id": "CVE-2025-68121",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3",
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "id": "CVE-2025-61726",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.12, 1.25.6",
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "CVE-2025-61729",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.11, 1.25.5",
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "id": "CVE-2026-25679",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.8, 1.26.1",
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-32280",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "id": "CVE-2026-32281",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "id": "CVE-2026-32283",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2025-30204",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/golang-jwt/jwt/v5",
      "installedVersion": "v5.2.1",
      "fixedVersion": "5.2.2",
      "title": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing"
    },
    {
      "id": "CVE-2025-22869",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.35.0",
      "title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh"
    },
    {
      "id": "CVE-2025-47913",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.43.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS"
    },
    {
      "id": "CVE-2026-39828",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
    },
    {
      "id": "CVE-2026-39829",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
    },
    {
      "id": "CVE-2026-39830",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
    },
    {
      "id": "CVE-2026-39831",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
    },
    {
      "id": "CVE-2026-39832",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
    },
    {
      "id": "CVE-2026-39835",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
    },
    {
      "id": "CVE-2026-42508",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
    },
    {
      "id": "CVE-2026-46595",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
    },
    {
      "id": "CVE-2026-46597",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
    },
    {
      "id": "CVE-2026-25681",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
    },
    {
      "id": "CVE-2026-27136",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.53.0",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.56.0",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56852",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/text",
      "installedVersion": "v0.21.0",
      "fixedVersion": "0.39.0",
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "id": "CVE-2025-68121",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3",
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "id": "CVE-2025-61726",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.12, 1.25.6",
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "CVE-2025-61729",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.11, 1.25.5",
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "id": "CVE-2026-25679",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.8, 1.26.1",
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-32280",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "id": "CVE-2026-32281",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "id": "CVE-2026-32283",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2025-30204",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/golang-jwt/jwt/v5",
      "installedVersion": "v5.2.1",
      "fixedVersion": "5.2.2",
      "title": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing"
    },
    {
      "id": "CVE-2025-22869",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.35.0",
      "title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh"
    },
    {
      "id": "CVE-2025-47913",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.43.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS"
    },
    {
      "id": "CVE-2026-39828",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
    },
    {
      "id": "CVE-2026-39829",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
    },
    {
      "id": "CVE-2026-39830",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
    },
    {
      "id": "CVE-2026-39831",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
    },
    {
      "id": "CVE-2026-39832",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
    },
    {
      "id": "CVE-2026-39835",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
    },
    {
      "id": "CVE-2026-42508",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
    },
    {
      "id": "CVE-2026-46595",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
    },
    {
      "id": "CVE-2026-46597",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
    },
    {
      "id": "CVE-2026-25681",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
    },
    {
      "id": "CVE-2026-27136",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.53.0",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.56.0",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56852",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/text",
      "installedVersion": "v0.21.0",
      "fixedVersion": "0.39.0",
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "id": "CVE-2025-68121",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3",
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "id": "CVE-2025-61726",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.12, 1.25.6",
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "CVE-2025-61729",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.11, 1.25.5",
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "id": "CVE-2026-25679",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.8, 1.26.1",
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-32280",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "id": "CVE-2026-32281",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "id": "CVE-2026-32283",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2025-30204",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/golang-jwt/jwt/v5",
      "installedVersion": "v5.2.1",
      "fixedVersion": "5.2.2",
      "title": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing"
    },
    {
      "id": "CVE-2025-22869",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.35.0",
      "title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh"
    },
    {
      "id": "CVE-2025-47913",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.43.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS"
    },
    {
      "id": "CVE-2026-39828",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
    },
    {
      "id": "CVE-2026-39829",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
    },
    {
      "id": "CVE-2026-39830",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
    },
    {
      "id": "CVE-2026-39831",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
    },
    {
      "id": "CVE-2026-39832",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
    },
    {
      "id": "CVE-2026-39835",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
    },
    {
      "id": "CVE-2026-42508",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
    },
    {
      "id": "CVE-2026-46595",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
    },
    {
      "id": "CVE-2026-46597",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.32.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
    },
    {
      "id": "CVE-2026-25681",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
    },
    {
      "id": "CVE-2026-27136",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.53.0",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.34.0",
      "fixedVersion": "0.56.0",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56852",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/text",
      "installedVersion": "v0.21.0",
      "fixedVersion": "0.39.0",
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "id": "CVE-2025-68121",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3",
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "id": "CVE-2025-61726",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.12, 1.25.6",
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "CVE-2025-61729",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.24.11, 1.25.5",
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "id": "CVE-2026-25679",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.8, 1.26.1",
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-32280",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "id": "CVE-2026-32281",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "id": "CVE-2026-32283",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.22.8",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2026-44973",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/go-git/go-billy/v5",
      "installedVersion": "v5.6.0",
      "fixedVersion": "5.9.0",
      "title": "github.com/go-git/go-billy: Go-billy: Arbitrary file access due to path traversal vulnerability"
    },
    {
      "id": "CVE-2025-30204",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/golang-jwt/jwt/v4",
      "installedVersion": "v4.5.1",
      "fixedVersion": "4.5.2",
      "title": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing"
    },
    {
      "id": "CVE-2025-30204",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "github.com/golang-jwt/jwt/v5",
      "installedVersion": "v5.2.1",
      "fixedVersion": "5.2.2",
      "title": "golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing"
    },
    {
      "id": "CVE-2025-22869",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.35.0",
      "title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh"
    },
    {
      "id": "CVE-2025-47913",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.43.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS"
    },
    {
      "id": "CVE-2026-39828",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
    },
    {
      "id": "CVE-2026-39829",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
    },
    {
      "id": "CVE-2026-39830",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
    },
    {
      "id": "CVE-2026-39831",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
    },
    {
      "id": "CVE-2026-39832",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
    },
    {
      "id": "CVE-2026-39835",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
    },
    {
      "id": "CVE-2026-42508",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
    },
    {
      "id": "CVE-2026-46595",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
    },
    {
      "id": "CVE-2026-46597",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
    },
    {
      "id": "CVE-2026-25681",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.33.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
    },
    {
      "id": "CVE-2026-27136",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.33.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.33.0",
      "fixedVersion": "0.53.0",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.33.0",
      "fixedVersion": "0.55.0",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/net",
      "installedVersion": "v0.33.0",
      "fixedVersion": "0.56.0",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2025-22868",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/oauth2",
      "installedVersion": "v0.24.0",
      "fixedVersion": "0.27.0",
      "title": "golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws"
    },
    {
      "id": "CVE-2026-56852",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/text",
      "installedVersion": "v0.21.0",
      "fixedVersion": "0.39.0",
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "id": "CVE-2026-33186",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "google.golang.org/grpc",
      "installedVersion": "v1.67.1",
      "fixedVersion": "1.79.3",
      "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
    },
    {
      "id": "GHSA-hrxh-6v49-42gf",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "google.golang.org/grpc",
      "installedVersion": "v1.67.1",
      "fixedVersion": "1.82.1",
      "title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities"
    },
    {
      "id": "CVE-2025-68121",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3",
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "id": "CVE-2025-61726",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.24.12, 1.25.6",
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "CVE-2025-61729",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.24.11, 1.25.5",
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "id": "CVE-2026-25679",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.8, 1.26.1",
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-32280",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "id": "CVE-2026-32281",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "id": "CVE-2026-32283",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/bin/rclone",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.23.4",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2025-22869",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.35.0",
      "title": "golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh"
    },
    {
      "id": "CVE-2025-47913",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.43.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS"
    },
    {
      "id": "CVE-2026-39828",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
    },
    {
      "id": "CVE-2026-39829",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
    },
    {
      "id": "CVE-2026-39830",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
    },
    {
      "id": "CVE-2026-39831",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
    },
    {
      "id": "CVE-2026-39832",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
    },
    {
      "id": "CVE-2026-39835",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
    },
    {
      "id": "CVE-2026-42508",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
    },
    {
      "id": "CVE-2026-46595",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
    },
    {
      "id": "CVE-2026-46597",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/crypto",
      "installedVersion": "v0.31.0",
      "fixedVersion": "0.52.0",
      "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
    },
    {
      "id": "CVE-2026-56852",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "golang.org/x/text",
      "installedVersion": "v0.21.0",
      "fixedVersion": "0.39.0",
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "id": "CVE-2025-68121",
      "severity": "CRITICAL",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3",
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "id": "CVE-2024-34156",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.22.7, 1.23.1",
      "title": "encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion"
    },
    {
      "id": "CVE-2025-61726",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.24.12, 1.25.6",
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "CVE-2025-61729",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.24.11, 1.25.5",
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "id": "CVE-2026-25679",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.8, 1.26.1",
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-32280",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "id": "CVE-2026-32281",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "id": "CVE-2026-32283",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mgob",
      "report": "mgob.vuln.json",
      "target": "usr/local/bin/mgob",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.21.13",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2024-6119",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "staging-registry.payment-gateway.app/mongo-express:latest@sha256:1b23d7976f0210dbec74045c209e52fbb26d29b2e873d6c6fa3d3f0ae32c2a64 (alpine 3.18.6)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libcrypto3",
      "installedVersion": "3.1.4-r5",
      "fixedVersion": "3.1.7-r0",
      "title": "openssl: Possible denial of service in X.509 name checks"
    },
    {
      "id": "CVE-2024-6119",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "staging-registry.payment-gateway.app/mongo-express:latest@sha256:1b23d7976f0210dbec74045c209e52fbb26d29b2e873d6c6fa3d3f0ae32c2a64 (alpine 3.18.6)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "libssl3",
      "installedVersion": "3.1.4-r5",
      "fixedVersion": "3.1.7-r0",
      "title": "openssl: Possible denial of service in X.509 name checks"
    },
    {
      "id": "CVE-2025-26519",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "staging-registry.payment-gateway.app/mongo-express:latest@sha256:1b23d7976f0210dbec74045c209e52fbb26d29b2e873d6c6fa3d3f0ae32c2a64 (alpine 3.18.6)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "musl",
      "installedVersion": "1.2.4-r2",
      "fixedVersion": "1.2.4-r3",
      "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ..."
    },
    {
      "id": "CVE-2025-26519",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "staging-registry.payment-gateway.app/mongo-express:latest@sha256:1b23d7976f0210dbec74045c209e52fbb26d29b2e873d6c6fa3d3f0ae32c2a64 (alpine 3.18.6)",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "musl-utils",
      "installedVersion": "1.2.4-r2",
      "fixedVersion": "1.2.4-r3",
      "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ..."
    },
    {
      "id": "CVE-2023-45133",
      "severity": "CRITICAL",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "@babel/traverse",
      "installedVersion": "7.19.6",
      "fixedVersion": "7.23.2, 8.0.0-alpha.4",
      "title": "babel: arbitrary code execution"
    },
    {
      "id": "CVE-2024-47178",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "basic-auth-connect",
      "installedVersion": "1.0.0",
      "fixedVersion": "1.1.0",
      "title": "basic-auth-connect: timing-unsafe equality comparison can leak timing information"
    },
    {
      "id": "CVE-2024-45590",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "body-parser",
      "installedVersion": "1.20.1",
      "fixedVersion": "1.20.3",
      "title": "body-parser: Denial of Service Vulnerability in body-parser"
    },
    {
      "id": "CVE-2026-13149",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "brace-expansion",
      "installedVersion": "1.1.11",
      "fixedVersion": "5.0.7, 1.1.16, 2.1.2",
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "id": "CVE-2026-14257",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "brace-expansion",
      "installedVersion": "1.1.11",
      "fixedVersion": "5.0.8, 3.0.3, 2.1.3, 1.1.17",
      "title": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function"
    },
    {
      "id": "CVE-2026-69152",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "brace-expansion",
      "installedVersion": "1.1.11",
      "fixedVersion": "1.1.18, 2.1.4, 3.0.6, 5.0.9",
      "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"
    },
    {
      "id": "CVE-2026-13149",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "brace-expansion",
      "installedVersion": "2.0.1",
      "fixedVersion": "5.0.7, 1.1.16, 2.1.2",
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "id": "CVE-2026-14257",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "brace-expansion",
      "installedVersion": "2.0.1",
      "fixedVersion": "5.0.8, 3.0.3, 2.1.3, 1.1.17",
      "title": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function"
    },
    {
      "id": "CVE-2026-69152",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "brace-expansion",
      "installedVersion": "2.0.1",
      "fixedVersion": "1.1.18, 2.1.4, 3.0.6, 5.0.9",
      "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"
    },
    {
      "id": "CVE-2024-21538",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "cross-spawn",
      "installedVersion": "7.0.3",
      "fixedVersion": "7.0.5, 6.0.6",
      "title": "cross-spawn: regular expression denial of service"
    },
    {
      "id": "CVE-2024-21538",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "cross-spawn",
      "installedVersion": "7.0.3",
      "fixedVersion": "7.0.5, 6.0.6",
      "title": "cross-spawn: regular expression denial of service"
    },
    {
      "id": "CVE-2026-33036",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "fast-xml-parser",
      "installedVersion": "4.0.11",
      "fixedVersion": "5.5.6, 4.5.5",
      "title": "fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass"
    },
    {
      "id": "CVE-2025-64756",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "glob",
      "installedVersion": "10.3.12",
      "fixedVersion": "11.1.0, 10.5.0",
      "title": "glob: glob: Command Injection Vulnerability via Malicious Filenames"
    },
    {
      "id": "CVE-2024-29415",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "ip",
      "installedVersion": "2.0.0",
      "fixedVersion": "",
      "title": "node-ip: Incomplete fix for CVE-2023-42282"
    },
    {
      "id": "CVE-2026-69192",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "ip-address",
      "installedVersion": "9.0.5",
      "fixedVersion": "10.3.1",
      "title": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass"
    },
    {
      "id": "CVE-2026-59869",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "js-yaml",
      "installedVersion": "3.14.1",
      "fixedVersion": "3.15.0, 4.3.0",
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
    },
    {
      "id": "GHSA-5p4m-2wfm-xmqj",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "js-yaml",
      "installedVersion": "3.14.1",
      "fixedVersion": "4.3.1, 3.15.1",
      "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported"
    },
    {
      "id": "CVE-2022-46175",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "json5",
      "installedVersion": "2.2.1",
      "fixedVersion": "2.2.2, 1.0.2",
      "title": "json5: Prototype Pollution in JSON5 via Parse Method"
    },
    {
      "id": "CVE-2026-4800",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "lodash",
      "installedVersion": "4.17.21",
      "fixedVersion": "4.18.0",
      "title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
    },
    {
      "id": "CVE-2026-4800",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "lodash-es",
      "installedVersion": "4.17.21",
      "fixedVersion": "4.18.0",
      "title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
    },
    {
      "id": "CVE-2026-26996",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "minimatch",
      "installedVersion": "3.1.2",
      "fixedVersion": "10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3",
      "title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
    },
    {
      "id": "CVE-2026-27903",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "minimatch",
      "installedVersion": "3.1.2",
      "fixedVersion": "10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3",
      "title": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns"
    },
    {
      "id": "CVE-2026-27904",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "minimatch",
      "installedVersion": "3.1.2",
      "fixedVersion": "10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4",
      "title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
    },
    {
      "id": "CVE-2026-26996",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "minimatch",
      "installedVersion": "9.0.4",
      "fixedVersion": "10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3",
      "title": "minimatch: minimatch: Denial of Service via specially crafted glob patterns"
    },
    {
      "id": "CVE-2026-27903",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "minimatch",
      "installedVersion": "9.0.4",
      "fixedVersion": "10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3",
      "title": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns"
    },
    {
      "id": "CVE-2026-27904",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "minimatch",
      "installedVersion": "9.0.4",
      "fixedVersion": "10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4",
      "title": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions"
    },
    {
      "id": "CVE-2024-45296",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "path-to-regexp",
      "installedVersion": "0.1.7",
      "fixedVersion": "1.9.0, 0.1.10, 8.0.0, 3.3.0, 6.3.0",
      "title": "path-to-regexp: Backtracking regular expressions cause ReDoS"
    },
    {
      "id": "CVE-2024-52798",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "path-to-regexp",
      "installedVersion": "0.1.7",
      "fixedVersion": "0.1.12",
      "title": "path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x"
    },
    {
      "id": "CVE-2026-4867",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "path-to-regexp",
      "installedVersion": "0.1.7",
      "fixedVersion": "0.1.13",
      "title": "path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters"
    },
    {
      "id": "CVE-2022-25883",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "semver",
      "installedVersion": "6.3.0",
      "fixedVersion": "7.5.2, 6.3.1, 5.7.2",
      "title": "nodejs-semver: Regular expression denial of service"
    },
    {
      "id": "CVE-2026-48815",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "sigstore",
      "installedVersion": "2.3.0",
      "fixedVersion": "4.1.1",
      "title": "sigstore: Sigstore: Unauthorized certificates accepted due to ignored `certificateOIDs` verification option"
    },
    {
      "id": "CVE-2026-59873",
      "severity": "CRITICAL",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "tar",
      "installedVersion": "6.2.1",
      "fixedVersion": "7.5.19",
      "title": "tar: node-tar: Denial of Service via crafted gzip bomb"
    },
    {
      "id": "CVE-2026-23745",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "tar",
      "installedVersion": "6.2.1",
      "fixedVersion": "7.5.3",
      "title": "node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives"
    },
    {
      "id": "CVE-2026-23950",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "tar",
      "installedVersion": "6.2.1",
      "fixedVersion": "7.5.4",
      "title": "node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition"
    },
    {
      "id": "CVE-2026-24842",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "tar",
      "installedVersion": "6.2.1",
      "fixedVersion": "7.5.7",
      "title": "node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check"
    },
    {
      "id": "CVE-2026-26960",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "tar",
      "installedVersion": "6.2.1",
      "fixedVersion": "7.5.8",
      "title": "node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation"
    },
    {
      "id": "CVE-2026-29786",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "tar",
      "installedVersion": "6.2.1",
      "fixedVersion": "7.5.10",
      "title": "node-tar: hardlink path traversal via drive-relative linkpath"
    },
    {
      "id": "CVE-2026-31802",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "tar",
      "installedVersion": "6.2.1",
      "fixedVersion": "7.5.11",
      "title": "tar: tar: File overwrite via drive-relative symlink traversal"
    },
    {
      "id": "CVE-2026-59874",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "tar",
      "installedVersion": "6.2.1",
      "fixedVersion": "7.5.18",
      "title": "tar: Node-tar: Denial of Service via malformed tar archive header"
    },
    {
      "id": "CVE-2026-73566",
      "severity": "HIGH",
      "component": "mongo-express",
      "report": "mongo-express.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "tar",
      "installedVersion": "6.2.1",
      "fixedVersion": "7.5.21",
      "title": "tar: node-tar: Denial of Service via crafted long-path tar archive"
    },
    {
      "id": "CVE-2026-59869",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "js-yaml",
      "installedVersion": "3.13.1",
      "fixedVersion": "3.15.0, 4.3.0",
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
    },
    {
      "id": "GHSA-5p4m-2wfm-xmqj",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "Node.js",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "js-yaml",
      "installedVersion": "3.13.1",
      "fixedVersion": "4.3.1, 3.15.1",
      "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/bsondump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongodump",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoexport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongofiles",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongoimport",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongorestore",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongostat",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-46600",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/bin/mongotop",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.26.5",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "id": "CVE-2025-68121",
      "severity": "CRITICAL",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3",
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "id": "CVE-2025-61726",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.24.12, 1.25.6",
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "CVE-2025-61729",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.24.11, 1.25.5",
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "id": "CVE-2026-25679",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.8, 1.26.1",
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "CVE-2026-27145",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
    },
    {
      "id": "CVE-2026-32280",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "id": "CVE-2026-32281",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
    },
    {
      "id": "CVE-2026-32283",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.9, 1.26.2",
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "id": "CVE-2026-33811",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "id": "CVE-2026-33814",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame"
    },
    {
      "id": "CVE-2026-33818",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "id": "CVE-2026-39820",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "id": "CVE-2026-39821",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "id": "CVE-2026-39822",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2",
      "title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal"
    },
    {
      "id": "CVE-2026-39836",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    },
    {
      "id": "CVE-2026-42499",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.10, 1.26.3",
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "id": "CVE-2026-42504",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.11, 1.26.4",
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "id": "CVE-2026-56853",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "id": "CVE-2026-56858",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "id": "CVE-2026-56859",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "id": "CVE-2026-56860",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "id": "CVE-2026-56862",
      "severity": "HIGH",
      "component": "mongo",
      "report": "mongo.vuln.json",
      "target": "usr/local/bin/gosu",
      "policyMode": "report-only",
      "scanType": "runtimeImage",
      "componentChanged": false,
      "package": "stdlib",
      "installedVersion": "v1.24.6",
      "fixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3",
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    }
  ],
  "invalidWaivers": [],
  "expiredWaivers": []
}