{
 "@context": "https://openvex.dev/ns/v0.2.0",
 "@id": "https://fermihdi.io/vex/1691444c8fe94a65b9087e6e6369f923",
 "author": "FermiHDI",
 "role": "Software vendor",
 "timestamp": "2026-10-19T07:16:38Z",
 "version": 1,
 "tooling": "Trivy findings triaged by package reachability; Docker Scout deleted-layer findings",
 "statements": [
  {
   "vulnerability": {
    "name": "CVE-2024-56433"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/login.defs@1:4.17.4-2ubuntu3"
      },
      {
       "@id": "pkg:generic/passwd@1:4.17.4-2ubuntu3"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "login.defs, passwd is part of the base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18477"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/tar@1.35+dfsg-4ubuntu0.4"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "tar is part of the base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18508"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/tar@1.35+dfsg-4ubuntu0.4"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "tar is part of the base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-56857"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/pebble@ubuntu-26.04-base"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_present",
   "impact_statement": "The finding is in /usr/bin/pebble from the ubuntu:26.04 base layer. This image deletes that file in a later layer, so it is not present in the image's filesystem and never runs. Scanners that read every layer, including deleted files, still report it.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-56866"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/pebble@ubuntu-26.04-base"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_present",
   "impact_statement": "The finding is in /usr/bin/pebble from the ubuntu:26.04 base layer. This image deletes that file in a later layer, so it is not present in the image's filesystem and never runs. Scanners that read every layer, including deleted files, still report it.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-78659"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/pebble@ubuntu-26.04-base"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_present",
   "impact_statement": "The finding is in /usr/bin/pebble from the ubuntu:26.04 base layer. This image deletes that file in a later layer, so it is not present in the image's filesystem and never runs. Scanners that read every layer, including deleted files, still report it.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-78660"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/pebble@ubuntu-26.04-base"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_present",
   "impact_statement": "The finding is in /usr/bin/pebble from the ubuntu:26.04 base layer. This image deletes that file in a later layer, so it is not present in the image's filesystem and never runs. Scanners that read every layer, including deleted files, still report it.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-78663"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/pebble@ubuntu-26.04-base"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_present",
   "impact_statement": "The finding is in /usr/bin/pebble from the ubuntu:26.04 base layer. This image deletes that file in a later layer, so it is not present in the image's filesystem and never runs. Scanners that read every layer, including deleted files, still report it.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-78667"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/pebble@ubuntu-26.04-base"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_present",
   "impact_statement": "The finding is in /usr/bin/pebble from the ubuntu:26.04 base layer. This image deletes that file in a later layer, so it is not present in the image's filesystem and never runs. Scanners that read every layer, including deleted files, still report it.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-78669"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/pebble@ubuntu-26.04-base"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_present",
   "impact_statement": "The finding is in /usr/bin/pebble from the ubuntu:26.04 base layer. This image deletes that file in a later layer, so it is not present in the image's filesystem and never runs. Scanners that read every layer, including deleted files, still report it.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-94439"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/pebble@ubuntu-26.04-base"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_present",
   "impact_statement": "The finding is in /usr/bin/pebble from the ubuntu:26.04 base layer. This image deletes that file in a later layer, so it is not present in the image's filesystem and never runs. Scanners that read every layer, including deleted files, still report it.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-94440"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/pebble@ubuntu-26.04-base"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_present",
   "impact_statement": "The finding is in /usr/bin/pebble from the ubuntu:26.04 base layer. This image deletes that file in a later layer, so it is not present in the image's filesystem and never runs. Scanners that read every layer, including deleted files, still report it.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-97031"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/pebble@ubuntu-26.04-base"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_present",
   "impact_statement": "The finding is in /usr/bin/pebble from the ubuntu:26.04 base layer. This image deletes that file in a later layer, so it is not present in the image's filesystem and never runs. Scanners that read every layer, including deleted files, still report it.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-97032"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-crash-vault@sha256:82a6194dfa7983ce333e3ad268e706081aeda5fe467a91aa97b7981976431280?repository_url=cr.fermihdi.io/hd/dms-crash-vault",
     "subcomponents": [
      {
       "@id": "pkg:generic/pebble@ubuntu-26.04-base"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_present",
   "impact_statement": "The finding is in /usr/bin/pebble from the ubuntu:26.04 base layer. This image deletes that file in a later layer, so it is not present in the image's filesystem and never runs. Scanners that read every layer, including deleted files, still report it.",
   "timestamp": "2026-10-19T07:16:38Z"
  }
 ]
}