model-orchestrator 1.0.2 → 1.0.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +28 -1
- package/README.md +1 -1
- package/docs/README.md +1 -0
- package/docs/catalog-advisories.md +116 -0
- package/docs/catalog-advisory-exceptions.json +1019 -0
- package/docs/catalog.md +1 -1
- package/docs/part-2-intermediate.md +1 -1
- package/llms.txt +1 -0
- package/package.json +1 -1
- package/src/README.md +1 -1
- package/src/catalog.js +6 -3
- package/templates/advanced/vm/ENVIRONMENT.md +9 -3
- package/templates/advanced/vm/jobs/README.md +22 -3
- package/templates/advanced/vm/jobs/weekly-audit.service +2 -1
- package/templates/advanced/vm/jobs/weekly-audit.sh +29 -7
- package/templates/agents/snippets/route-metrics.mjs +43 -0
|
@@ -0,0 +1,1019 @@
|
|
|
1
|
+
[
|
|
2
|
+
{
|
|
3
|
+
"ecosystem": "wolfi",
|
|
4
|
+
"package": "glibc-2.44",
|
|
5
|
+
"version": "2.44-r1",
|
|
6
|
+
"advisory": "CVE-2026-18374",
|
|
7
|
+
"target": "ghcr.io/berriai/litellm:v1.100.3",
|
|
8
|
+
"rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
9
|
+
"expires": "2026-10-28"
|
|
10
|
+
},
|
|
11
|
+
{
|
|
12
|
+
"ecosystem": "wolfi",
|
|
13
|
+
"package": "glibc-2.44",
|
|
14
|
+
"version": "2.44-r1",
|
|
15
|
+
"advisory": "CVE-2026-19499",
|
|
16
|
+
"target": "ghcr.io/berriai/litellm:v1.100.3",
|
|
17
|
+
"rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
18
|
+
"expires": "2026-10-28"
|
|
19
|
+
},
|
|
20
|
+
{
|
|
21
|
+
"ecosystem": "wolfi",
|
|
22
|
+
"package": "glibc-2.44-locale-posix",
|
|
23
|
+
"version": "2.44-r1",
|
|
24
|
+
"advisory": "CVE-2026-18374",
|
|
25
|
+
"target": "ghcr.io/berriai/litellm:v1.100.3",
|
|
26
|
+
"rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
27
|
+
"expires": "2026-10-28"
|
|
28
|
+
},
|
|
29
|
+
{
|
|
30
|
+
"ecosystem": "wolfi",
|
|
31
|
+
"package": "glibc-2.44-locale-posix",
|
|
32
|
+
"version": "2.44-r1",
|
|
33
|
+
"advisory": "CVE-2026-19499",
|
|
34
|
+
"target": "ghcr.io/berriai/litellm:v1.100.3",
|
|
35
|
+
"rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
36
|
+
"expires": "2026-10-28"
|
|
37
|
+
},
|
|
38
|
+
{
|
|
39
|
+
"ecosystem": "wolfi",
|
|
40
|
+
"package": "ld-linux-2.44",
|
|
41
|
+
"version": "2.44-r1",
|
|
42
|
+
"advisory": "CVE-2026-18374",
|
|
43
|
+
"target": "ghcr.io/berriai/litellm:v1.100.3",
|
|
44
|
+
"rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
45
|
+
"expires": "2026-10-28"
|
|
46
|
+
},
|
|
47
|
+
{
|
|
48
|
+
"ecosystem": "wolfi",
|
|
49
|
+
"package": "ld-linux-2.44",
|
|
50
|
+
"version": "2.44-r1",
|
|
51
|
+
"advisory": "CVE-2026-19499",
|
|
52
|
+
"target": "ghcr.io/berriai/litellm:v1.100.3",
|
|
53
|
+
"rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
54
|
+
"expires": "2026-10-28"
|
|
55
|
+
},
|
|
56
|
+
{
|
|
57
|
+
"ecosystem": "wolfi",
|
|
58
|
+
"package": "libcrypt1-2.44",
|
|
59
|
+
"version": "2.44-r1",
|
|
60
|
+
"advisory": "CVE-2026-18374",
|
|
61
|
+
"target": "ghcr.io/berriai/litellm:v1.100.3",
|
|
62
|
+
"rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
63
|
+
"expires": "2026-10-28"
|
|
64
|
+
},
|
|
65
|
+
{
|
|
66
|
+
"ecosystem": "wolfi",
|
|
67
|
+
"package": "libcrypt1-2.44",
|
|
68
|
+
"version": "2.44-r1",
|
|
69
|
+
"advisory": "CVE-2026-19499",
|
|
70
|
+
"target": "ghcr.io/berriai/litellm:v1.100.3",
|
|
71
|
+
"rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
72
|
+
"expires": "2026-10-28"
|
|
73
|
+
},
|
|
74
|
+
{
|
|
75
|
+
"ecosystem": "wolfi",
|
|
76
|
+
"package": "zlib",
|
|
77
|
+
"version": "1.3.2-r5",
|
|
78
|
+
"advisory": "CVE-2026-85091",
|
|
79
|
+
"target": "ghcr.io/berriai/litellm:v1.100.3",
|
|
80
|
+
"rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
81
|
+
"expires": "2026-10-28"
|
|
82
|
+
},
|
|
83
|
+
{
|
|
84
|
+
"ecosystem": "ubuntu",
|
|
85
|
+
"package": "libc-bin",
|
|
86
|
+
"version": "2.39-0ubuntu8.9",
|
|
87
|
+
"advisory": "CVE-2026-18374",
|
|
88
|
+
"target": "ollama/ollama:0.34.4",
|
|
89
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
90
|
+
"expires": "2026-10-28"
|
|
91
|
+
},
|
|
92
|
+
{
|
|
93
|
+
"ecosystem": "ubuntu",
|
|
94
|
+
"package": "libc-bin",
|
|
95
|
+
"version": "2.39-0ubuntu8.9",
|
|
96
|
+
"advisory": "CVE-2026-89092",
|
|
97
|
+
"target": "ollama/ollama:0.34.4",
|
|
98
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
99
|
+
"expires": "2026-10-28"
|
|
100
|
+
},
|
|
101
|
+
{
|
|
102
|
+
"ecosystem": "ubuntu",
|
|
103
|
+
"package": "libc6",
|
|
104
|
+
"version": "2.39-0ubuntu8.9",
|
|
105
|
+
"advisory": "CVE-2026-18374",
|
|
106
|
+
"target": "ollama/ollama:0.34.4",
|
|
107
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
108
|
+
"expires": "2026-10-28"
|
|
109
|
+
},
|
|
110
|
+
{
|
|
111
|
+
"ecosystem": "ubuntu",
|
|
112
|
+
"package": "libc6",
|
|
113
|
+
"version": "2.39-0ubuntu8.9",
|
|
114
|
+
"advisory": "CVE-2026-89092",
|
|
115
|
+
"target": "ollama/ollama:0.34.4",
|
|
116
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
117
|
+
"expires": "2026-10-28"
|
|
118
|
+
},
|
|
119
|
+
{
|
|
120
|
+
"ecosystem": "ubuntu",
|
|
121
|
+
"package": "libelf1t64",
|
|
122
|
+
"version": "0.190-1.1ubuntu0.1",
|
|
123
|
+
"advisory": "CVE-2025-1352",
|
|
124
|
+
"target": "ollama/ollama:0.34.4",
|
|
125
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
126
|
+
"expires": "2026-10-28"
|
|
127
|
+
},
|
|
128
|
+
{
|
|
129
|
+
"ecosystem": "ubuntu",
|
|
130
|
+
"package": "libelf1t64",
|
|
131
|
+
"version": "0.190-1.1ubuntu0.1",
|
|
132
|
+
"advisory": "CVE-2025-1376",
|
|
133
|
+
"target": "ollama/ollama:0.34.4",
|
|
134
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
135
|
+
"expires": "2026-10-28"
|
|
136
|
+
},
|
|
137
|
+
{
|
|
138
|
+
"ecosystem": "ubuntu",
|
|
139
|
+
"package": "libexpat1",
|
|
140
|
+
"version": "2.6.1-2ubuntu0.5",
|
|
141
|
+
"advisory": "CVE-2025-66382",
|
|
142
|
+
"target": "ollama/ollama:0.34.4",
|
|
143
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
144
|
+
"expires": "2026-10-28"
|
|
145
|
+
},
|
|
146
|
+
{
|
|
147
|
+
"ecosystem": "ubuntu",
|
|
148
|
+
"package": "libexpat1",
|
|
149
|
+
"version": "2.6.1-2ubuntu0.5",
|
|
150
|
+
"advisory": "CVE-2026-56131",
|
|
151
|
+
"target": "ollama/ollama:0.34.4",
|
|
152
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
153
|
+
"expires": "2026-10-28"
|
|
154
|
+
},
|
|
155
|
+
{
|
|
156
|
+
"ecosystem": "ubuntu",
|
|
157
|
+
"package": "libexpat1",
|
|
158
|
+
"version": "2.6.1-2ubuntu0.5",
|
|
159
|
+
"advisory": "CVE-2026-56132",
|
|
160
|
+
"target": "ollama/ollama:0.34.4",
|
|
161
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
162
|
+
"expires": "2026-10-28"
|
|
163
|
+
},
|
|
164
|
+
{
|
|
165
|
+
"ecosystem": "ubuntu",
|
|
166
|
+
"package": "libexpat1",
|
|
167
|
+
"version": "2.6.1-2ubuntu0.5",
|
|
168
|
+
"advisory": "CVE-2026-56406",
|
|
169
|
+
"target": "ollama/ollama:0.34.4",
|
|
170
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
171
|
+
"expires": "2026-10-28"
|
|
172
|
+
},
|
|
173
|
+
{
|
|
174
|
+
"ecosystem": "ubuntu",
|
|
175
|
+
"package": "libexpat1",
|
|
176
|
+
"version": "2.6.1-2ubuntu0.5",
|
|
177
|
+
"advisory": "CVE-2026-56407",
|
|
178
|
+
"target": "ollama/ollama:0.34.4",
|
|
179
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
180
|
+
"expires": "2026-10-28"
|
|
181
|
+
},
|
|
182
|
+
{
|
|
183
|
+
"ecosystem": "ubuntu",
|
|
184
|
+
"package": "libexpat1",
|
|
185
|
+
"version": "2.6.1-2ubuntu0.5",
|
|
186
|
+
"advisory": "CVE-2026-56409",
|
|
187
|
+
"target": "ollama/ollama:0.34.4",
|
|
188
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
189
|
+
"expires": "2026-10-28"
|
|
190
|
+
},
|
|
191
|
+
{
|
|
192
|
+
"ecosystem": "ubuntu",
|
|
193
|
+
"package": "libexpat1",
|
|
194
|
+
"version": "2.6.1-2ubuntu0.5",
|
|
195
|
+
"advisory": "CVE-2026-56410",
|
|
196
|
+
"target": "ollama/ollama:0.34.4",
|
|
197
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
198
|
+
"expires": "2026-10-28"
|
|
199
|
+
},
|
|
200
|
+
{
|
|
201
|
+
"ecosystem": "ubuntu",
|
|
202
|
+
"package": "libexpat1",
|
|
203
|
+
"version": "2.6.1-2ubuntu0.5",
|
|
204
|
+
"advisory": "CVE-2026-56411",
|
|
205
|
+
"target": "ollama/ollama:0.34.4",
|
|
206
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
207
|
+
"expires": "2026-10-28"
|
|
208
|
+
},
|
|
209
|
+
{
|
|
210
|
+
"ecosystem": "ubuntu",
|
|
211
|
+
"package": "libexpat1",
|
|
212
|
+
"version": "2.6.1-2ubuntu0.5",
|
|
213
|
+
"advisory": "CVE-2026-66046",
|
|
214
|
+
"target": "ollama/ollama:0.34.4",
|
|
215
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
216
|
+
"expires": "2026-10-28"
|
|
217
|
+
},
|
|
218
|
+
{
|
|
219
|
+
"ecosystem": "ubuntu",
|
|
220
|
+
"package": "libexpat1",
|
|
221
|
+
"version": "2.6.1-2ubuntu0.5",
|
|
222
|
+
"advisory": "CVE-2026-72522",
|
|
223
|
+
"target": "ollama/ollama:0.34.4",
|
|
224
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
225
|
+
"expires": "2026-10-28"
|
|
226
|
+
},
|
|
227
|
+
{
|
|
228
|
+
"ecosystem": "ubuntu",
|
|
229
|
+
"package": "libexpat1",
|
|
230
|
+
"version": "2.6.1-2ubuntu0.5",
|
|
231
|
+
"advisory": "CVE-2026-76641",
|
|
232
|
+
"target": "ollama/ollama:0.34.4",
|
|
233
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
234
|
+
"expires": "2026-10-28"
|
|
235
|
+
},
|
|
236
|
+
{
|
|
237
|
+
"ecosystem": "ubuntu",
|
|
238
|
+
"package": "libexpat1",
|
|
239
|
+
"version": "2.6.1-2ubuntu0.5",
|
|
240
|
+
"advisory": "CVE-2026-76957",
|
|
241
|
+
"target": "ollama/ollama:0.34.4",
|
|
242
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
243
|
+
"expires": "2026-10-28"
|
|
244
|
+
},
|
|
245
|
+
{
|
|
246
|
+
"ecosystem": "ubuntu",
|
|
247
|
+
"package": "libicu74",
|
|
248
|
+
"version": "74.2-1ubuntu3.1",
|
|
249
|
+
"advisory": "CVE-2025-5222",
|
|
250
|
+
"target": "ollama/ollama:0.34.4",
|
|
251
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
252
|
+
"expires": "2026-10-28"
|
|
253
|
+
},
|
|
254
|
+
{
|
|
255
|
+
"ecosystem": "ubuntu",
|
|
256
|
+
"package": "libpcre2-8-0",
|
|
257
|
+
"version": "10.42-4ubuntu2.1",
|
|
258
|
+
"advisory": "CVE-2026-86145",
|
|
259
|
+
"target": "ollama/ollama:0.34.4",
|
|
260
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
261
|
+
"expires": "2026-10-28"
|
|
262
|
+
},
|
|
263
|
+
{
|
|
264
|
+
"ecosystem": "ubuntu",
|
|
265
|
+
"package": "libpcre2-8-0",
|
|
266
|
+
"version": "10.42-4ubuntu2.1",
|
|
267
|
+
"advisory": "CVE-2026-89161",
|
|
268
|
+
"target": "ollama/ollama:0.34.4",
|
|
269
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
270
|
+
"expires": "2026-10-28"
|
|
271
|
+
},
|
|
272
|
+
{
|
|
273
|
+
"ecosystem": "ubuntu",
|
|
274
|
+
"package": "libsystemd0",
|
|
275
|
+
"version": "255.4-1ubuntu8.17",
|
|
276
|
+
"advisory": "CVE-2026-40228",
|
|
277
|
+
"target": "ollama/ollama:0.34.4",
|
|
278
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
279
|
+
"expires": "2026-10-28"
|
|
280
|
+
},
|
|
281
|
+
{
|
|
282
|
+
"ecosystem": "ubuntu",
|
|
283
|
+
"package": "libudev1",
|
|
284
|
+
"version": "255.4-1ubuntu8.17",
|
|
285
|
+
"advisory": "CVE-2026-40228",
|
|
286
|
+
"target": "ollama/ollama:0.34.4",
|
|
287
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
288
|
+
"expires": "2026-10-28"
|
|
289
|
+
},
|
|
290
|
+
{
|
|
291
|
+
"ecosystem": "ubuntu",
|
|
292
|
+
"package": "login",
|
|
293
|
+
"version": "1:4.13+dfsg1-4ubuntu3.2",
|
|
294
|
+
"advisory": "CVE-2024-56433",
|
|
295
|
+
"target": "ollama/ollama:0.34.4",
|
|
296
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
297
|
+
"expires": "2026-10-28"
|
|
298
|
+
},
|
|
299
|
+
{
|
|
300
|
+
"ecosystem": "ubuntu",
|
|
301
|
+
"package": "passwd",
|
|
302
|
+
"version": "1:4.13+dfsg1-4ubuntu3.2",
|
|
303
|
+
"advisory": "CVE-2024-56433",
|
|
304
|
+
"target": "ollama/ollama:0.34.4",
|
|
305
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
306
|
+
"expires": "2026-10-28"
|
|
307
|
+
},
|
|
308
|
+
{
|
|
309
|
+
"ecosystem": "ubuntu",
|
|
310
|
+
"package": "perl-base",
|
|
311
|
+
"version": "5.38.2-3.2ubuntu0.4",
|
|
312
|
+
"advisory": "CVE-2026-15534",
|
|
313
|
+
"target": "ollama/ollama:0.34.4",
|
|
314
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
315
|
+
"expires": "2026-10-28"
|
|
316
|
+
},
|
|
317
|
+
{
|
|
318
|
+
"ecosystem": "ubuntu",
|
|
319
|
+
"package": "perl-base",
|
|
320
|
+
"version": "5.38.2-3.2ubuntu0.4",
|
|
321
|
+
"advisory": "CVE-2026-19487",
|
|
322
|
+
"target": "ollama/ollama:0.34.4",
|
|
323
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
324
|
+
"expires": "2026-10-28"
|
|
325
|
+
},
|
|
326
|
+
{
|
|
327
|
+
"ecosystem": "ubuntu",
|
|
328
|
+
"package": "tar",
|
|
329
|
+
"version": "1.35+dfsg-3ubuntu0.4",
|
|
330
|
+
"advisory": "CVE-2026-18477",
|
|
331
|
+
"target": "ollama/ollama:0.34.4",
|
|
332
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
333
|
+
"expires": "2026-10-28"
|
|
334
|
+
},
|
|
335
|
+
{
|
|
336
|
+
"ecosystem": "ubuntu",
|
|
337
|
+
"package": "tar",
|
|
338
|
+
"version": "1.35+dfsg-3ubuntu0.4",
|
|
339
|
+
"advisory": "CVE-2026-18508",
|
|
340
|
+
"target": "ollama/ollama:0.34.4",
|
|
341
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
342
|
+
"expires": "2026-10-28"
|
|
343
|
+
},
|
|
344
|
+
{
|
|
345
|
+
"ecosystem": "ubuntu",
|
|
346
|
+
"package": "zlib1g",
|
|
347
|
+
"version": "1:1.3.dfsg-3.1ubuntu2.2",
|
|
348
|
+
"advisory": "CVE-2026-85091",
|
|
349
|
+
"target": "ollama/ollama:0.34.4",
|
|
350
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
351
|
+
"expires": "2026-10-28"
|
|
352
|
+
},
|
|
353
|
+
{
|
|
354
|
+
"ecosystem": "gobinary",
|
|
355
|
+
"package": "github.com/buger/jsonparser",
|
|
356
|
+
"version": "v1.1.1",
|
|
357
|
+
"advisory": "CVE-2026-32285",
|
|
358
|
+
"target": "ollama/ollama:0.34.4",
|
|
359
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
360
|
+
"expires": "2026-10-28"
|
|
361
|
+
},
|
|
362
|
+
{
|
|
363
|
+
"ecosystem": "gobinary",
|
|
364
|
+
"package": "golang.org/x/crypto",
|
|
365
|
+
"version": "v0.43.0",
|
|
366
|
+
"advisory": "CVE-2026-39828",
|
|
367
|
+
"target": "ollama/ollama:0.34.4",
|
|
368
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
369
|
+
"expires": "2026-10-28"
|
|
370
|
+
},
|
|
371
|
+
{
|
|
372
|
+
"ecosystem": "gobinary",
|
|
373
|
+
"package": "golang.org/x/crypto",
|
|
374
|
+
"version": "v0.43.0",
|
|
375
|
+
"advisory": "CVE-2026-39829",
|
|
376
|
+
"target": "ollama/ollama:0.34.4",
|
|
377
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
378
|
+
"expires": "2026-10-28"
|
|
379
|
+
},
|
|
380
|
+
{
|
|
381
|
+
"ecosystem": "gobinary",
|
|
382
|
+
"package": "golang.org/x/crypto",
|
|
383
|
+
"version": "v0.43.0",
|
|
384
|
+
"advisory": "CVE-2026-39830",
|
|
385
|
+
"target": "ollama/ollama:0.34.4",
|
|
386
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
387
|
+
"expires": "2026-10-28"
|
|
388
|
+
},
|
|
389
|
+
{
|
|
390
|
+
"ecosystem": "gobinary",
|
|
391
|
+
"package": "golang.org/x/crypto",
|
|
392
|
+
"version": "v0.43.0",
|
|
393
|
+
"advisory": "CVE-2026-39831",
|
|
394
|
+
"target": "ollama/ollama:0.34.4",
|
|
395
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
396
|
+
"expires": "2026-10-28"
|
|
397
|
+
},
|
|
398
|
+
{
|
|
399
|
+
"ecosystem": "gobinary",
|
|
400
|
+
"package": "golang.org/x/crypto",
|
|
401
|
+
"version": "v0.43.0",
|
|
402
|
+
"advisory": "CVE-2026-39832",
|
|
403
|
+
"target": "ollama/ollama:0.34.4",
|
|
404
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
405
|
+
"expires": "2026-10-28"
|
|
406
|
+
},
|
|
407
|
+
{
|
|
408
|
+
"ecosystem": "gobinary",
|
|
409
|
+
"package": "golang.org/x/crypto",
|
|
410
|
+
"version": "v0.43.0",
|
|
411
|
+
"advisory": "CVE-2026-39835",
|
|
412
|
+
"target": "ollama/ollama:0.34.4",
|
|
413
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
414
|
+
"expires": "2026-10-28"
|
|
415
|
+
},
|
|
416
|
+
{
|
|
417
|
+
"ecosystem": "gobinary",
|
|
418
|
+
"package": "golang.org/x/crypto",
|
|
419
|
+
"version": "v0.43.0",
|
|
420
|
+
"advisory": "CVE-2026-42508",
|
|
421
|
+
"target": "ollama/ollama:0.34.4",
|
|
422
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
423
|
+
"expires": "2026-10-28"
|
|
424
|
+
},
|
|
425
|
+
{
|
|
426
|
+
"ecosystem": "gobinary",
|
|
427
|
+
"package": "golang.org/x/crypto",
|
|
428
|
+
"version": "v0.43.0",
|
|
429
|
+
"advisory": "CVE-2026-46595",
|
|
430
|
+
"target": "ollama/ollama:0.34.4",
|
|
431
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
432
|
+
"expires": "2026-10-28"
|
|
433
|
+
},
|
|
434
|
+
{
|
|
435
|
+
"ecosystem": "gobinary",
|
|
436
|
+
"package": "golang.org/x/crypto",
|
|
437
|
+
"version": "v0.43.0",
|
|
438
|
+
"advisory": "CVE-2026-46597",
|
|
439
|
+
"target": "ollama/ollama:0.34.4",
|
|
440
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
441
|
+
"expires": "2026-10-28"
|
|
442
|
+
},
|
|
443
|
+
{
|
|
444
|
+
"ecosystem": "gobinary",
|
|
445
|
+
"package": "golang.org/x/crypto",
|
|
446
|
+
"version": "v0.43.0",
|
|
447
|
+
"advisory": "CVE-2026-56854",
|
|
448
|
+
"target": "ollama/ollama:0.34.4",
|
|
449
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
450
|
+
"expires": "2026-10-28"
|
|
451
|
+
},
|
|
452
|
+
{
|
|
453
|
+
"ecosystem": "gobinary",
|
|
454
|
+
"package": "golang.org/x/crypto",
|
|
455
|
+
"version": "v0.43.0",
|
|
456
|
+
"advisory": "CVE-2025-47914",
|
|
457
|
+
"target": "ollama/ollama:0.34.4",
|
|
458
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
459
|
+
"expires": "2026-10-28"
|
|
460
|
+
},
|
|
461
|
+
{
|
|
462
|
+
"ecosystem": "gobinary",
|
|
463
|
+
"package": "golang.org/x/crypto",
|
|
464
|
+
"version": "v0.43.0",
|
|
465
|
+
"advisory": "CVE-2025-58181",
|
|
466
|
+
"target": "ollama/ollama:0.34.4",
|
|
467
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
468
|
+
"expires": "2026-10-28"
|
|
469
|
+
},
|
|
470
|
+
{
|
|
471
|
+
"ecosystem": "gobinary",
|
|
472
|
+
"package": "golang.org/x/crypto",
|
|
473
|
+
"version": "v0.43.0",
|
|
474
|
+
"advisory": "CVE-2026-39827",
|
|
475
|
+
"target": "ollama/ollama:0.34.4",
|
|
476
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
477
|
+
"expires": "2026-10-28"
|
|
478
|
+
},
|
|
479
|
+
{
|
|
480
|
+
"ecosystem": "gobinary",
|
|
481
|
+
"package": "golang.org/x/crypto",
|
|
482
|
+
"version": "v0.43.0",
|
|
483
|
+
"advisory": "CVE-2026-39833",
|
|
484
|
+
"target": "ollama/ollama:0.34.4",
|
|
485
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
486
|
+
"expires": "2026-10-28"
|
|
487
|
+
},
|
|
488
|
+
{
|
|
489
|
+
"ecosystem": "gobinary",
|
|
490
|
+
"package": "golang.org/x/crypto",
|
|
491
|
+
"version": "v0.43.0",
|
|
492
|
+
"advisory": "CVE-2026-39834",
|
|
493
|
+
"target": "ollama/ollama:0.34.4",
|
|
494
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
495
|
+
"expires": "2026-10-28"
|
|
496
|
+
},
|
|
497
|
+
{
|
|
498
|
+
"ecosystem": "gobinary",
|
|
499
|
+
"package": "golang.org/x/crypto",
|
|
500
|
+
"version": "v0.43.0",
|
|
501
|
+
"advisory": "CVE-2026-46598",
|
|
502
|
+
"target": "ollama/ollama:0.34.4",
|
|
503
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
504
|
+
"expires": "2026-10-28"
|
|
505
|
+
},
|
|
506
|
+
{
|
|
507
|
+
"ecosystem": "gobinary",
|
|
508
|
+
"package": "golang.org/x/crypto",
|
|
509
|
+
"version": "v0.43.0",
|
|
510
|
+
"advisory": "CVE-2026-56855",
|
|
511
|
+
"target": "ollama/ollama:0.34.4",
|
|
512
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
513
|
+
"expires": "2026-10-28"
|
|
514
|
+
},
|
|
515
|
+
{
|
|
516
|
+
"ecosystem": "gobinary",
|
|
517
|
+
"package": "golang.org/x/crypto",
|
|
518
|
+
"version": "v0.43.0",
|
|
519
|
+
"advisory": "CVE-2026-78662",
|
|
520
|
+
"target": "ollama/ollama:0.34.4",
|
|
521
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
522
|
+
"expires": "2026-10-28"
|
|
523
|
+
},
|
|
524
|
+
{
|
|
525
|
+
"ecosystem": "gobinary",
|
|
526
|
+
"package": "golang.org/x/crypto",
|
|
527
|
+
"version": "v0.43.0",
|
|
528
|
+
"advisory": "GO-2026-5932",
|
|
529
|
+
"target": "ollama/ollama:0.34.4",
|
|
530
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
531
|
+
"expires": "2026-10-28"
|
|
532
|
+
},
|
|
533
|
+
{
|
|
534
|
+
"ecosystem": "gobinary",
|
|
535
|
+
"package": "golang.org/x/image",
|
|
536
|
+
"version": "v0.22.0",
|
|
537
|
+
"advisory": "CVE-2026-46602",
|
|
538
|
+
"target": "ollama/ollama:0.34.4",
|
|
539
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
540
|
+
"expires": "2026-10-28"
|
|
541
|
+
},
|
|
542
|
+
{
|
|
543
|
+
"ecosystem": "gobinary",
|
|
544
|
+
"package": "golang.org/x/image",
|
|
545
|
+
"version": "v0.22.0",
|
|
546
|
+
"advisory": "CVE-2026-46603",
|
|
547
|
+
"target": "ollama/ollama:0.34.4",
|
|
548
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
549
|
+
"expires": "2026-10-28"
|
|
550
|
+
},
|
|
551
|
+
{
|
|
552
|
+
"ecosystem": "gobinary",
|
|
553
|
+
"package": "golang.org/x/image",
|
|
554
|
+
"version": "v0.22.0",
|
|
555
|
+
"advisory": "CVE-2026-33809",
|
|
556
|
+
"target": "ollama/ollama:0.34.4",
|
|
557
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
558
|
+
"expires": "2026-10-28"
|
|
559
|
+
},
|
|
560
|
+
{
|
|
561
|
+
"ecosystem": "gobinary",
|
|
562
|
+
"package": "golang.org/x/image",
|
|
563
|
+
"version": "v0.22.0",
|
|
564
|
+
"advisory": "CVE-2026-33812",
|
|
565
|
+
"target": "ollama/ollama:0.34.4",
|
|
566
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
567
|
+
"expires": "2026-10-28"
|
|
568
|
+
},
|
|
569
|
+
{
|
|
570
|
+
"ecosystem": "gobinary",
|
|
571
|
+
"package": "golang.org/x/image",
|
|
572
|
+
"version": "v0.22.0",
|
|
573
|
+
"advisory": "CVE-2026-33813",
|
|
574
|
+
"target": "ollama/ollama:0.34.4",
|
|
575
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
576
|
+
"expires": "2026-10-28"
|
|
577
|
+
},
|
|
578
|
+
{
|
|
579
|
+
"ecosystem": "gobinary",
|
|
580
|
+
"package": "golang.org/x/image",
|
|
581
|
+
"version": "v0.22.0",
|
|
582
|
+
"advisory": "CVE-2026-42500",
|
|
583
|
+
"target": "ollama/ollama:0.34.4",
|
|
584
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
585
|
+
"expires": "2026-10-28"
|
|
586
|
+
},
|
|
587
|
+
{
|
|
588
|
+
"ecosystem": "gobinary",
|
|
589
|
+
"package": "golang.org/x/image",
|
|
590
|
+
"version": "v0.22.0",
|
|
591
|
+
"advisory": "CVE-2026-46599",
|
|
592
|
+
"target": "ollama/ollama:0.34.4",
|
|
593
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
594
|
+
"expires": "2026-10-28"
|
|
595
|
+
},
|
|
596
|
+
{
|
|
597
|
+
"ecosystem": "gobinary",
|
|
598
|
+
"package": "golang.org/x/image",
|
|
599
|
+
"version": "v0.22.0",
|
|
600
|
+
"advisory": "CVE-2026-46601",
|
|
601
|
+
"target": "ollama/ollama:0.34.4",
|
|
602
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
603
|
+
"expires": "2026-10-28"
|
|
604
|
+
},
|
|
605
|
+
{
|
|
606
|
+
"ecosystem": "gobinary",
|
|
607
|
+
"package": "golang.org/x/image",
|
|
608
|
+
"version": "v0.22.0",
|
|
609
|
+
"advisory": "CVE-2026-46604",
|
|
610
|
+
"target": "ollama/ollama:0.34.4",
|
|
611
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
612
|
+
"expires": "2026-10-28"
|
|
613
|
+
},
|
|
614
|
+
{
|
|
615
|
+
"ecosystem": "gobinary",
|
|
616
|
+
"package": "golang.org/x/mod",
|
|
617
|
+
"version": "v0.30.0",
|
|
618
|
+
"advisory": "CVE-2026-56864",
|
|
619
|
+
"target": "ollama/ollama:0.34.4",
|
|
620
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
621
|
+
"expires": "2026-10-28"
|
|
622
|
+
},
|
|
623
|
+
{
|
|
624
|
+
"ecosystem": "gobinary",
|
|
625
|
+
"package": "golang.org/x/mod",
|
|
626
|
+
"version": "v0.30.0",
|
|
627
|
+
"advisory": "CVE-2026-56865",
|
|
628
|
+
"target": "ollama/ollama:0.34.4",
|
|
629
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
630
|
+
"expires": "2026-10-28"
|
|
631
|
+
},
|
|
632
|
+
{
|
|
633
|
+
"ecosystem": "gobinary",
|
|
634
|
+
"package": "golang.org/x/net",
|
|
635
|
+
"version": "v0.46.0",
|
|
636
|
+
"advisory": "CVE-2026-25681",
|
|
637
|
+
"target": "ollama/ollama:0.34.4",
|
|
638
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
639
|
+
"expires": "2026-10-28"
|
|
640
|
+
},
|
|
641
|
+
{
|
|
642
|
+
"ecosystem": "gobinary",
|
|
643
|
+
"package": "golang.org/x/net",
|
|
644
|
+
"version": "v0.46.0",
|
|
645
|
+
"advisory": "CVE-2026-27136",
|
|
646
|
+
"target": "ollama/ollama:0.34.4",
|
|
647
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
648
|
+
"expires": "2026-10-28"
|
|
649
|
+
},
|
|
650
|
+
{
|
|
651
|
+
"ecosystem": "gobinary",
|
|
652
|
+
"package": "golang.org/x/net",
|
|
653
|
+
"version": "v0.46.0",
|
|
654
|
+
"advisory": "CVE-2026-33814",
|
|
655
|
+
"target": "ollama/ollama:0.34.4",
|
|
656
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
657
|
+
"expires": "2026-10-28"
|
|
658
|
+
},
|
|
659
|
+
{
|
|
660
|
+
"ecosystem": "gobinary",
|
|
661
|
+
"package": "golang.org/x/net",
|
|
662
|
+
"version": "v0.46.0",
|
|
663
|
+
"advisory": "CVE-2026-39821",
|
|
664
|
+
"target": "ollama/ollama:0.34.4",
|
|
665
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
666
|
+
"expires": "2026-10-28"
|
|
667
|
+
},
|
|
668
|
+
{
|
|
669
|
+
"ecosystem": "gobinary",
|
|
670
|
+
"package": "golang.org/x/net",
|
|
671
|
+
"version": "v0.46.0",
|
|
672
|
+
"advisory": "CVE-2026-46600",
|
|
673
|
+
"target": "ollama/ollama:0.34.4",
|
|
674
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
675
|
+
"expires": "2026-10-28"
|
|
676
|
+
},
|
|
677
|
+
{
|
|
678
|
+
"ecosystem": "gobinary",
|
|
679
|
+
"package": "golang.org/x/net",
|
|
680
|
+
"version": "v0.46.0",
|
|
681
|
+
"advisory": "CVE-2026-25680",
|
|
682
|
+
"target": "ollama/ollama:0.34.4",
|
|
683
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
684
|
+
"expires": "2026-10-28"
|
|
685
|
+
},
|
|
686
|
+
{
|
|
687
|
+
"ecosystem": "gobinary",
|
|
688
|
+
"package": "golang.org/x/net",
|
|
689
|
+
"version": "v0.46.0",
|
|
690
|
+
"advisory": "CVE-2026-42502",
|
|
691
|
+
"target": "ollama/ollama:0.34.4",
|
|
692
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
693
|
+
"expires": "2026-10-28"
|
|
694
|
+
},
|
|
695
|
+
{
|
|
696
|
+
"ecosystem": "gobinary",
|
|
697
|
+
"package": "golang.org/x/net",
|
|
698
|
+
"version": "v0.46.0",
|
|
699
|
+
"advisory": "CVE-2026-42506",
|
|
700
|
+
"target": "ollama/ollama:0.34.4",
|
|
701
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
702
|
+
"expires": "2026-10-28"
|
|
703
|
+
},
|
|
704
|
+
{
|
|
705
|
+
"ecosystem": "gobinary",
|
|
706
|
+
"package": "golang.org/x/sys",
|
|
707
|
+
"version": "v0.37.0",
|
|
708
|
+
"advisory": "CVE-2026-39824",
|
|
709
|
+
"target": "ollama/ollama:0.34.4",
|
|
710
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
711
|
+
"expires": "2026-10-28"
|
|
712
|
+
},
|
|
713
|
+
{
|
|
714
|
+
"ecosystem": "gobinary",
|
|
715
|
+
"package": "golang.org/x/text",
|
|
716
|
+
"version": "v0.30.0",
|
|
717
|
+
"advisory": "CVE-2026-56852",
|
|
718
|
+
"target": "ollama/ollama:0.34.4",
|
|
719
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
720
|
+
"expires": "2026-10-28"
|
|
721
|
+
},
|
|
722
|
+
{
|
|
723
|
+
"ecosystem": "gobinary",
|
|
724
|
+
"package": "stdlib",
|
|
725
|
+
"version": "v1.26.0",
|
|
726
|
+
"advisory": "CVE-2026-25679",
|
|
727
|
+
"target": "ollama/ollama:0.34.4",
|
|
728
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
729
|
+
"expires": "2026-10-28"
|
|
730
|
+
},
|
|
731
|
+
{
|
|
732
|
+
"ecosystem": "gobinary",
|
|
733
|
+
"package": "stdlib",
|
|
734
|
+
"version": "v1.26.0",
|
|
735
|
+
"advisory": "CVE-2026-27137",
|
|
736
|
+
"target": "ollama/ollama:0.34.4",
|
|
737
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
738
|
+
"expires": "2026-10-28"
|
|
739
|
+
},
|
|
740
|
+
{
|
|
741
|
+
"ecosystem": "gobinary",
|
|
742
|
+
"package": "stdlib",
|
|
743
|
+
"version": "v1.26.0",
|
|
744
|
+
"advisory": "CVE-2026-27145",
|
|
745
|
+
"target": "ollama/ollama:0.34.4",
|
|
746
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
747
|
+
"expires": "2026-10-28"
|
|
748
|
+
},
|
|
749
|
+
{
|
|
750
|
+
"ecosystem": "gobinary",
|
|
751
|
+
"package": "stdlib",
|
|
752
|
+
"version": "v1.26.0",
|
|
753
|
+
"advisory": "CVE-2026-32280",
|
|
754
|
+
"target": "ollama/ollama:0.34.4",
|
|
755
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
756
|
+
"expires": "2026-10-28"
|
|
757
|
+
},
|
|
758
|
+
{
|
|
759
|
+
"ecosystem": "gobinary",
|
|
760
|
+
"package": "stdlib",
|
|
761
|
+
"version": "v1.26.0",
|
|
762
|
+
"advisory": "CVE-2026-32281",
|
|
763
|
+
"target": "ollama/ollama:0.34.4",
|
|
764
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
765
|
+
"expires": "2026-10-28"
|
|
766
|
+
},
|
|
767
|
+
{
|
|
768
|
+
"ecosystem": "gobinary",
|
|
769
|
+
"package": "stdlib",
|
|
770
|
+
"version": "v1.26.0",
|
|
771
|
+
"advisory": "CVE-2026-32283",
|
|
772
|
+
"target": "ollama/ollama:0.34.4",
|
|
773
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
774
|
+
"expires": "2026-10-28"
|
|
775
|
+
},
|
|
776
|
+
{
|
|
777
|
+
"ecosystem": "gobinary",
|
|
778
|
+
"package": "stdlib",
|
|
779
|
+
"version": "v1.26.0",
|
|
780
|
+
"advisory": "CVE-2026-33810",
|
|
781
|
+
"target": "ollama/ollama:0.34.4",
|
|
782
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
783
|
+
"expires": "2026-10-28"
|
|
784
|
+
},
|
|
785
|
+
{
|
|
786
|
+
"ecosystem": "gobinary",
|
|
787
|
+
"package": "stdlib",
|
|
788
|
+
"version": "v1.26.0",
|
|
789
|
+
"advisory": "CVE-2026-33811",
|
|
790
|
+
"target": "ollama/ollama:0.34.4",
|
|
791
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
792
|
+
"expires": "2026-10-28"
|
|
793
|
+
},
|
|
794
|
+
{
|
|
795
|
+
"ecosystem": "gobinary",
|
|
796
|
+
"package": "stdlib",
|
|
797
|
+
"version": "v1.26.0",
|
|
798
|
+
"advisory": "CVE-2026-33814",
|
|
799
|
+
"target": "ollama/ollama:0.34.4",
|
|
800
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
801
|
+
"expires": "2026-10-28"
|
|
802
|
+
},
|
|
803
|
+
{
|
|
804
|
+
"ecosystem": "gobinary",
|
|
805
|
+
"package": "stdlib",
|
|
806
|
+
"version": "v1.26.0",
|
|
807
|
+
"advisory": "CVE-2026-33818",
|
|
808
|
+
"target": "ollama/ollama:0.34.4",
|
|
809
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
810
|
+
"expires": "2026-10-28"
|
|
811
|
+
},
|
|
812
|
+
{
|
|
813
|
+
"ecosystem": "gobinary",
|
|
814
|
+
"package": "stdlib",
|
|
815
|
+
"version": "v1.26.0",
|
|
816
|
+
"advisory": "CVE-2026-39820",
|
|
817
|
+
"target": "ollama/ollama:0.34.4",
|
|
818
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
819
|
+
"expires": "2026-10-28"
|
|
820
|
+
},
|
|
821
|
+
{
|
|
822
|
+
"ecosystem": "gobinary",
|
|
823
|
+
"package": "stdlib",
|
|
824
|
+
"version": "v1.26.0",
|
|
825
|
+
"advisory": "CVE-2026-39821",
|
|
826
|
+
"target": "ollama/ollama:0.34.4",
|
|
827
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
828
|
+
"expires": "2026-10-28"
|
|
829
|
+
},
|
|
830
|
+
{
|
|
831
|
+
"ecosystem": "gobinary",
|
|
832
|
+
"package": "stdlib",
|
|
833
|
+
"version": "v1.26.0",
|
|
834
|
+
"advisory": "CVE-2026-39822",
|
|
835
|
+
"target": "ollama/ollama:0.34.4",
|
|
836
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
837
|
+
"expires": "2026-10-28"
|
|
838
|
+
},
|
|
839
|
+
{
|
|
840
|
+
"ecosystem": "gobinary",
|
|
841
|
+
"package": "stdlib",
|
|
842
|
+
"version": "v1.26.0",
|
|
843
|
+
"advisory": "CVE-2026-39836",
|
|
844
|
+
"target": "ollama/ollama:0.34.4",
|
|
845
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
846
|
+
"expires": "2026-10-28"
|
|
847
|
+
},
|
|
848
|
+
{
|
|
849
|
+
"ecosystem": "gobinary",
|
|
850
|
+
"package": "stdlib",
|
|
851
|
+
"version": "v1.26.0",
|
|
852
|
+
"advisory": "CVE-2026-42499",
|
|
853
|
+
"target": "ollama/ollama:0.34.4",
|
|
854
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
855
|
+
"expires": "2026-10-28"
|
|
856
|
+
},
|
|
857
|
+
{
|
|
858
|
+
"ecosystem": "gobinary",
|
|
859
|
+
"package": "stdlib",
|
|
860
|
+
"version": "v1.26.0",
|
|
861
|
+
"advisory": "CVE-2026-42504",
|
|
862
|
+
"target": "ollama/ollama:0.34.4",
|
|
863
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
864
|
+
"expires": "2026-10-28"
|
|
865
|
+
},
|
|
866
|
+
{
|
|
867
|
+
"ecosystem": "gobinary",
|
|
868
|
+
"package": "stdlib",
|
|
869
|
+
"version": "v1.26.0",
|
|
870
|
+
"advisory": "CVE-2026-46600",
|
|
871
|
+
"target": "ollama/ollama:0.34.4",
|
|
872
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
873
|
+
"expires": "2026-10-28"
|
|
874
|
+
},
|
|
875
|
+
{
|
|
876
|
+
"ecosystem": "gobinary",
|
|
877
|
+
"package": "stdlib",
|
|
878
|
+
"version": "v1.26.0",
|
|
879
|
+
"advisory": "CVE-2026-56853",
|
|
880
|
+
"target": "ollama/ollama:0.34.4",
|
|
881
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
882
|
+
"expires": "2026-10-28"
|
|
883
|
+
},
|
|
884
|
+
{
|
|
885
|
+
"ecosystem": "gobinary",
|
|
886
|
+
"package": "stdlib",
|
|
887
|
+
"version": "v1.26.0",
|
|
888
|
+
"advisory": "CVE-2026-56858",
|
|
889
|
+
"target": "ollama/ollama:0.34.4",
|
|
890
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
891
|
+
"expires": "2026-10-28"
|
|
892
|
+
},
|
|
893
|
+
{
|
|
894
|
+
"ecosystem": "gobinary",
|
|
895
|
+
"package": "stdlib",
|
|
896
|
+
"version": "v1.26.0",
|
|
897
|
+
"advisory": "CVE-2026-56859",
|
|
898
|
+
"target": "ollama/ollama:0.34.4",
|
|
899
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
900
|
+
"expires": "2026-10-28"
|
|
901
|
+
},
|
|
902
|
+
{
|
|
903
|
+
"ecosystem": "gobinary",
|
|
904
|
+
"package": "stdlib",
|
|
905
|
+
"version": "v1.26.0",
|
|
906
|
+
"advisory": "CVE-2026-56860",
|
|
907
|
+
"target": "ollama/ollama:0.34.4",
|
|
908
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
909
|
+
"expires": "2026-10-28"
|
|
910
|
+
},
|
|
911
|
+
{
|
|
912
|
+
"ecosystem": "gobinary",
|
|
913
|
+
"package": "stdlib",
|
|
914
|
+
"version": "v1.26.0",
|
|
915
|
+
"advisory": "CVE-2026-56862",
|
|
916
|
+
"target": "ollama/ollama:0.34.4",
|
|
917
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
918
|
+
"expires": "2026-10-28"
|
|
919
|
+
},
|
|
920
|
+
{
|
|
921
|
+
"ecosystem": "gobinary",
|
|
922
|
+
"package": "stdlib",
|
|
923
|
+
"version": "v1.26.0",
|
|
924
|
+
"advisory": "CVE-2026-27142",
|
|
925
|
+
"target": "ollama/ollama:0.34.4",
|
|
926
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
927
|
+
"expires": "2026-10-28"
|
|
928
|
+
},
|
|
929
|
+
{
|
|
930
|
+
"ecosystem": "gobinary",
|
|
931
|
+
"package": "stdlib",
|
|
932
|
+
"version": "v1.26.0",
|
|
933
|
+
"advisory": "CVE-2026-32282",
|
|
934
|
+
"target": "ollama/ollama:0.34.4",
|
|
935
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
936
|
+
"expires": "2026-10-28"
|
|
937
|
+
},
|
|
938
|
+
{
|
|
939
|
+
"ecosystem": "gobinary",
|
|
940
|
+
"package": "stdlib",
|
|
941
|
+
"version": "v1.26.0",
|
|
942
|
+
"advisory": "CVE-2026-32288",
|
|
943
|
+
"target": "ollama/ollama:0.34.4",
|
|
944
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
945
|
+
"expires": "2026-10-28"
|
|
946
|
+
},
|
|
947
|
+
{
|
|
948
|
+
"ecosystem": "gobinary",
|
|
949
|
+
"package": "stdlib",
|
|
950
|
+
"version": "v1.26.0",
|
|
951
|
+
"advisory": "CVE-2026-32289",
|
|
952
|
+
"target": "ollama/ollama:0.34.4",
|
|
953
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
954
|
+
"expires": "2026-10-28"
|
|
955
|
+
},
|
|
956
|
+
{
|
|
957
|
+
"ecosystem": "gobinary",
|
|
958
|
+
"package": "stdlib",
|
|
959
|
+
"version": "v1.26.0",
|
|
960
|
+
"advisory": "CVE-2026-39823",
|
|
961
|
+
"target": "ollama/ollama:0.34.4",
|
|
962
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
963
|
+
"expires": "2026-10-28"
|
|
964
|
+
},
|
|
965
|
+
{
|
|
966
|
+
"ecosystem": "gobinary",
|
|
967
|
+
"package": "stdlib",
|
|
968
|
+
"version": "v1.26.0",
|
|
969
|
+
"advisory": "CVE-2026-39825",
|
|
970
|
+
"target": "ollama/ollama:0.34.4",
|
|
971
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
972
|
+
"expires": "2026-10-28"
|
|
973
|
+
},
|
|
974
|
+
{
|
|
975
|
+
"ecosystem": "gobinary",
|
|
976
|
+
"package": "stdlib",
|
|
977
|
+
"version": "v1.26.0",
|
|
978
|
+
"advisory": "CVE-2026-39826",
|
|
979
|
+
"target": "ollama/ollama:0.34.4",
|
|
980
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
981
|
+
"expires": "2026-10-28"
|
|
982
|
+
},
|
|
983
|
+
{
|
|
984
|
+
"ecosystem": "gobinary",
|
|
985
|
+
"package": "stdlib",
|
|
986
|
+
"version": "v1.26.0",
|
|
987
|
+
"advisory": "CVE-2026-42505",
|
|
988
|
+
"target": "ollama/ollama:0.34.4",
|
|
989
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
990
|
+
"expires": "2026-10-28"
|
|
991
|
+
},
|
|
992
|
+
{
|
|
993
|
+
"ecosystem": "gobinary",
|
|
994
|
+
"package": "stdlib",
|
|
995
|
+
"version": "v1.26.0",
|
|
996
|
+
"advisory": "CVE-2026-42507",
|
|
997
|
+
"target": "ollama/ollama:0.34.4",
|
|
998
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
999
|
+
"expires": "2026-10-28"
|
|
1000
|
+
},
|
|
1001
|
+
{
|
|
1002
|
+
"ecosystem": "gobinary",
|
|
1003
|
+
"package": "stdlib",
|
|
1004
|
+
"version": "v1.26.0",
|
|
1005
|
+
"advisory": "CVE-2026-27138",
|
|
1006
|
+
"target": "ollama/ollama:0.34.4",
|
|
1007
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
1008
|
+
"expires": "2026-10-28"
|
|
1009
|
+
},
|
|
1010
|
+
{
|
|
1011
|
+
"ecosystem": "gobinary",
|
|
1012
|
+
"package": "stdlib",
|
|
1013
|
+
"version": "v1.26.0",
|
|
1014
|
+
"advisory": "CVE-2026-27139",
|
|
1015
|
+
"target": "ollama/ollama:0.34.4",
|
|
1016
|
+
"rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
|
|
1017
|
+
"expires": "2026-10-28"
|
|
1018
|
+
}
|
|
1019
|
+
]
|