{
 "@context": "https://openvex.dev/ns/v0.2.0",
 "@id": "https://fermihdi.io/vex/2e86b3d7e5974f3390c485bdd32e55f0",
 "author": "FermiHDI",
 "role": "Software vendor",
 "timestamp": "2026-09-29T01:07:29Z",
 "version": 1,
 "tooling": "Trivy findings triaged by package reachability",
 "statements": [
  {
   "vulnerability": {
    "name": "CVE-2024-56433"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/login.defs@4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&epoch=1"
      },
      {
       "@id": "pkg:deb/ubuntu/passwd@4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "login.defs is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker. passwd is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-13757"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/libp11-kit0@0.26.2-2?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libp11-kit0 is installed with the Ubuntu base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable and bundled library in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18374"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:generic/libc-bin@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc-gconv-modules-extra@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc6@2.43-2ubuntu2.4"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libc-bin, libc-gconv-modules-extra, libc6 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18477"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "tar is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18508"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "tar is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35341"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35344"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35345"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35348"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35350"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35351"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35352"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35354"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35357"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35359"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35360"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35363"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35364"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35367"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35368"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35370"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35371"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35373"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35374"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35377"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-40228"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/libsystemd0@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04"
      },
      {
       "@id": "pkg:deb/ubuntu/libudev1@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libsystemd0 is installed with the Ubuntu base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable and bundled library in the image). libudev1 is installed with the Ubuntu base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable and bundled library in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-85091"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:generic/zlib1g@1:1.3.dfsg+really1.3.1-1ubuntu3.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "zlib1g is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-89092"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:generic/libc-bin@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc-gconv-modules-extra@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc6@2.43-2ubuntu2.4"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libc-bin, libc-gconv-modules-extra, libc6 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-89161"
   },
   "products": [
    {
     "@id": "pkg:oci/hd_mcp@sha256:713e483b199f071b65c270abd14067a7111224253f6ae264425e36b2b0855b3f?repository_url=cr.fermihdi.io/hd/hd_mcp",
     "subcomponents": [
      {
       "@id": "pkg:generic/libpcre2-8-0@10.46-1build1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libpcre2-8-0 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  }
 ]
}