| Severity | CVE | Package | Installed | Fixed | Deadline |
|---|---|---|---|---|---|
| CRITICAL | CVE-2024-45491 | libexpat | 2.6.2-r0 | 2.6.3-r0 | within 7 days |
| CRITICAL | CVE-2024-45492 | libexpat | 2.6.2-r0 | 2.6.3-r0 | within 7 days |
| HIGH | CVE-2024-6197 | curl | 8.5.0-r0 | 8.9.0-r0 | within 30 days |
| HIGH | CVE-2024-6119 | libcrypto3 | 3.0.12-r4 | 3.0.15-r0 | within 30 days |
| HIGH | CVE-2025-15467 | libcrypto3 | 3.0.12-r4 | 3.0.19-r0 | within 30 days |
| HIGH | CVE-2025-69421 | libcrypto3 | 3.0.12-r4 | 3.0.19-r0 | within 30 days |
| HIGH | CVE-2024-6197 | libcurl | 8.5.0-r0 | 8.9.0-r0 | within 30 days |
| HIGH | CVE-2024-45490 | libexpat | 2.6.2-r0 | 2.6.3-r0 | within 30 days |
| HIGH | CVE-2024-6119 | libssl3 | 3.0.12-r4 | 3.0.15-r0 | within 30 days |
| HIGH | CVE-2025-15467 | libssl3 | 3.0.12-r4 | 3.0.19-r0 | within 30 days |
| HIGH | CVE-2025-69421 | libssl3 | 3.0.12-r4 | 3.0.19-r0 | within 30 days |
| HIGH | CVE-2025-26519 | musl | 1.2.3-r5 | 1.2.3-r6 | within 30 days |
| HIGH | CVE-2025-26519 | musl-utils | 1.2.3-r5 | 1.2.3-r6 | within 30 days |
| MEDIUM | CVE-2023-42363 | busybox | 1.35.0-r29 | 1.35.0-r31 | Per policy |
| MEDIUM | CVE-2023-42364 | busybox | 1.35.0-r29 | 1.35.0-r31 | Per policy |
| MEDIUM | CVE-2023-42365 | busybox | 1.35.0-r29 | 1.35.0-r31 | Per policy |
| MEDIUM | CVE-2023-42366 | busybox | 1.35.0-r29 | 1.35.0-r30 | Per policy |
| MEDIUM | CVE-2023-42363 | busybox-binsh | 1.35.0-r29 | 1.35.0-r31 | Per policy |
| MEDIUM | CVE-2023-42364 | busybox-binsh | 1.35.0-r29 | 1.35.0-r31 | Per policy |
| MEDIUM | CVE-2023-42365 | busybox-binsh | 1.35.0-r29 | 1.35.0-r31 | Per policy |
| MEDIUM | CVE-2023-42366 | busybox-binsh | 1.35.0-r29 | 1.35.0-r30 | Per policy |
| MEDIUM | CVE-2024-0853 | curl | 8.5.0-r0 | 8.6.0-r0 | Per policy |
| MEDIUM | CVE-2024-2398 | curl | 8.5.0-r0 | 8.7.1-r0 | Per policy |
| MEDIUM | CVE-2024-2466 | curl | 8.5.0-r0 | 8.7.1-r0 | Per policy |
| MEDIUM | CVE-2024-6874 | curl | 8.5.0-r0 | 8.9.0-r0 | Per policy |
| MEDIUM | CVE-2025-69419 | libcrypto3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| MEDIUM | CVE-2025-9230 | libcrypto3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| MEDIUM | CVE-2024-0853 | libcurl | 8.5.0-r0 | 8.6.0-r0 | Per policy |
| MEDIUM | CVE-2024-2398 | libcurl | 8.5.0-r0 | 8.7.1-r0 | Per policy |
| MEDIUM | CVE-2024-2466 | libcurl | 8.5.0-r0 | 8.7.1-r0 | Per policy |
| MEDIUM | CVE-2024-6874 | libcurl | 8.5.0-r0 | 8.9.0-r0 | Per policy |
| MEDIUM | CVE-2024-50602 | libexpat | 2.6.2-r0 | 2.6.4-r0 | Per policy |
| MEDIUM | CVE-2025-69419 | libssl3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| MEDIUM | CVE-2025-9230 | libssl3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| MEDIUM | CVE-2023-42363 | ssl_client | 1.35.0-r29 | 1.35.0-r31 | Per policy |
| MEDIUM | CVE-2023-42364 | ssl_client | 1.35.0-r29 | 1.35.0-r31 | Per policy |
| MEDIUM | CVE-2023-42365 | ssl_client | 1.35.0-r29 | 1.35.0-r31 | Per policy |
| MEDIUM | CVE-2023-42366 | ssl_client | 1.35.0-r29 | 1.35.0-r30 | Per policy |
| LOW | CVE-2024-2004 | curl | 8.5.0-r0 | 8.7.1-r0 | Per policy |
| LOW | CVE-2024-2379 | curl | 8.5.0-r0 | 8.7.1-r0 | Per policy |
| LOW | CVE-2024-13176 | libcrypto3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| LOW | CVE-2024-2511 | libcrypto3 | 3.0.12-r4 | 3.0.12-r5 | Per policy |
| LOW | CVE-2024-4603 | libcrypto3 | 3.0.12-r4 | 3.0.13-r0 | Per policy |
| LOW | CVE-2024-4741 | libcrypto3 | 3.0.12-r4 | 3.0.14-r0 | Per policy |
| LOW | CVE-2024-5535 | libcrypto3 | 3.0.12-r4 | 3.0.14-r0 | Per policy |
| LOW | CVE-2024-9143 | libcrypto3 | 3.0.12-r4 | 3.0.15-r1 | Per policy |
| LOW | CVE-2025-68160 | libcrypto3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| LOW | CVE-2025-69418 | libcrypto3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| LOW | CVE-2025-69420 | libcrypto3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| LOW | CVE-2025-9232 | libcrypto3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| LOW | CVE-2026-22795 | libcrypto3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| LOW | CVE-2026-22796 | libcrypto3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| LOW | CVE-2024-2004 | libcurl | 8.5.0-r0 | 8.7.1-r0 | Per policy |
| LOW | CVE-2024-2379 | libcurl | 8.5.0-r0 | 8.7.1-r0 | Per policy |
| LOW | CVE-2024-13176 | libssl3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| LOW | CVE-2024-2511 | libssl3 | 3.0.12-r4 | 3.0.12-r5 | Per policy |
| LOW | CVE-2024-4603 | libssl3 | 3.0.12-r4 | 3.0.13-r0 | Per policy |
| LOW | CVE-2024-4741 | libssl3 | 3.0.12-r4 | 3.0.14-r0 | Per policy |
| LOW | CVE-2024-5535 | libssl3 | 3.0.12-r4 | 3.0.14-r0 | Per policy |
| LOW | CVE-2024-9143 | libssl3 | 3.0.12-r4 | 3.0.15-r1 | Per policy |
| LOW | CVE-2025-68160 | libssl3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| LOW | CVE-2025-69418 | libssl3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| LOW | CVE-2025-69420 | libssl3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| LOW | CVE-2025-9232 | libssl3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| LOW | CVE-2026-22795 | libssl3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
| LOW | CVE-2026-22796 | libssl3 | 3.0.12-r4 | 3.0.19-r0 | Per policy |
Distinct licenses identified: 30 (see the NOTICE artifact for details).
Each component is also recorded in the SBOM with a bomlens:licenseClass property. An unrecognized license is left uncategorized rather than assumed permissive.
Components that create copyleft exposure (network/strong, up to 10):
bomlens:licenseClass property for all)