{
 "@context": "https://openvex.dev/ns/v0.2.0",
 "@id": "https://fermihdi.io/vex/86e6f4319e514520873d221cdb50db3a",
 "author": "FermiHDI",
 "role": "Software vendor",
 "timestamp": "2026-10-19T07:16:38Z",
 "version": 1,
 "tooling": "Trivy findings triaged by package reachability; Docker Scout deleted-layer findings",
 "statements": [
  {
   "vulnerability": {
    "name": "CVE-2024-56433"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/login.defs@1:4.17.4-2ubuntu3"
      },
      {
       "@id": "pkg:generic/passwd@1:4.17.4-2ubuntu3"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "login.defs, passwd is part of the base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-102473"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/dash@0.5.12-12ubuntu3"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "dash is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-102474"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/dash@0.5.12-12ubuntu3"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "dash is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-103111"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libpcre2-8-0@10.46-1build1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libpcre2-8-0 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-107161"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libsasl2-2@2.1.28+dfsg1-9ubuntu3"
      },
      {
       "@id": "pkg:generic/libsasl2-modules-db@2.1.28+dfsg1-9ubuntu3"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libsasl2-2, libsasl2-modules-db is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-13757"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libp11-kit0@0.26.2-2"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libp11-kit0 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18374"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libc-bin@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc-gconv-modules-extra@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc6@2.43-2ubuntu2.4"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libc-bin, libc-gconv-modules-extra, libc6 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18477"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/tar@1.35+dfsg-4ubuntu0.4"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "tar is part of the base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18508"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/tar@1.35+dfsg-4ubuntu0.4"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "tar is part of the base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35341"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35344"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35345"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35348"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35350"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35351"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35352"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35354"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35357"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35359"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35360"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35363"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35364"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35367"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35368"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35370"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35371"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35373"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35374"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35377"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/rust-coreutils@0.10.0-1ubuntu2~26.04.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "rust-coreutils is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-40228"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libsystemd0@259.5-0ubuntu3.4"
      },
      {
       "@id": "pkg:generic/libudev1@259.5-0ubuntu3.4"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libsystemd0, libudev1 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-56857"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/stdlib@v1.27.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "The finding is in the Go standard library compiled into /usr/bin/pebble, the Rock's service manager, supplied by rockcraft. Pebble's HTTP API listens only on a unix socket inside the container; it opens no network listener, so the HTTP/1, HTTP/2, TLS and multipart parsing at issue never receives network-supplied or user-supplied input. The HD service binaries in the image are built separately and do not carry these findings.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-56866"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/stdlib@v1.27.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "The finding is in the Go standard library compiled into /usr/bin/pebble, the Rock's service manager, supplied by rockcraft. Pebble's HTTP API listens only on a unix socket inside the container; it opens no network listener, so the HTTP/1, HTTP/2, TLS and multipart parsing at issue never receives network-supplied or user-supplied input. The HD service binaries in the image are built separately and do not carry these findings.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-67693"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libgnutls30t64@3.8.12-2ubuntu1.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libgnutls30t64 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-78659"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/stdlib@v1.27.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "The finding is in the Go standard library compiled into /usr/bin/pebble, the Rock's service manager, supplied by rockcraft. Pebble's HTTP API listens only on a unix socket inside the container; it opens no network listener, so the HTTP/1, HTTP/2, TLS and multipart parsing at issue never receives network-supplied or user-supplied input. The HD service binaries in the image are built separately and do not carry these findings.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-78660"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/stdlib@v1.27.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "The finding is in the Go standard library compiled into /usr/bin/pebble, the Rock's service manager, supplied by rockcraft. Pebble's HTTP API listens only on a unix socket inside the container; it opens no network listener, so the HTTP/1, HTTP/2, TLS and multipart parsing at issue never receives network-supplied or user-supplied input. The HD service binaries in the image are built separately and do not carry these findings.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-78663"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/stdlib@v1.27.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "The finding is in the Go standard library compiled into /usr/bin/pebble, the Rock's service manager, supplied by rockcraft. Pebble's HTTP API listens only on a unix socket inside the container; it opens no network listener, so the HTTP/1, HTTP/2, TLS and multipart parsing at issue never receives network-supplied or user-supplied input. The HD service binaries in the image are built separately and do not carry these findings.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-78667"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/stdlib@v1.27.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "The finding is in the Go standard library compiled into /usr/bin/pebble, the Rock's service manager, supplied by rockcraft. Pebble's HTTP API listens only on a unix socket inside the container; it opens no network listener, so the HTTP/1, HTTP/2, TLS and multipart parsing at issue never receives network-supplied or user-supplied input. The HD service binaries in the image are built separately and do not carry these findings.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-78669"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/stdlib@v1.27.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "The finding is in the Go standard library compiled into /usr/bin/pebble, the Rock's service manager, supplied by rockcraft. Pebble's HTTP API listens only on a unix socket inside the container; it opens no network listener, so the HTTP/1, HTTP/2, TLS and multipart parsing at issue never receives network-supplied or user-supplied input. The HD service binaries in the image are built separately and do not carry these findings.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-85091"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/zlib1g@1:1.3.dfsg+really1.3.1-1ubuntu3.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "zlib1g is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-86145"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libpcre2-8-0@10.46-1build1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libpcre2-8-0 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-88647"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libgnutls30t64@3.8.12-2ubuntu1.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libgnutls30t64 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-89092"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libc-bin@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc-gconv-modules-extra@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc6@2.43-2ubuntu2.4"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libc-bin, libc-gconv-modules-extra, libc6 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-89156"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libpcre2-8-0@10.46-1build1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libpcre2-8-0 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-89157"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libpcre2-8-0@10.46-1build1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libpcre2-8-0 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-89158"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libpcre2-8-0@10.46-1build1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libpcre2-8-0 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-89160"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libpcre2-8-0@10.46-1build1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libpcre2-8-0 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-89161"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libpcre2-8-0@10.46-1build1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libpcre2-8-0 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-89162"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libpcre2-8-0@10.46-1build1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libpcre2-8-0 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-94439"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/stdlib@v1.27.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "The finding is in the Go standard library compiled into /usr/bin/pebble, the Rock's service manager, supplied by rockcraft. Pebble's HTTP API listens only on a unix socket inside the container; it opens no network listener, so the HTTP/1, HTTP/2, TLS and multipart parsing at issue never receives network-supplied or user-supplied input. The HD service binaries in the image are built separately and do not carry these findings.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-94440"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/stdlib@v1.27.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "The finding is in the Go standard library compiled into /usr/bin/pebble, the Rock's service manager, supplied by rockcraft. Pebble's HTTP API listens only on a unix socket inside the container; it opens no network listener, so the HTTP/1, HTTP/2, TLS and multipart parsing at issue never receives network-supplied or user-supplied input. The HD service binaries in the image are built separately and do not carry these findings.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-94448"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/stdlib@v1.27.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "The finding is in the Go standard library compiled into /usr/bin/pebble, the Rock's service manager, supplied by rockcraft. Pebble's HTTP API listens only on a unix socket inside the container; it opens no network listener, so the HTTP/1, HTTP/2, TLS and multipart parsing at issue never receives network-supplied or user-supplied input. The HD service binaries in the image are built separately and do not carry these findings.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-95184"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libgnutls30t64@3.8.12-2ubuntu1.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libgnutls30t64 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-95209"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libgnutls30t64@3.8.12-2ubuntu1.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libgnutls30t64 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-95210"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/libgnutls30t64@3.8.12-2ubuntu1.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libgnutls30t64 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-97030"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/stdlib@v1.27.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "The finding is in the Go standard library compiled into /usr/bin/pebble, the Rock's service manager, supplied by rockcraft. Pebble's HTTP API listens only on a unix socket inside the container; it opens no network listener, so the HTTP/1, HTTP/2, TLS and multipart parsing at issue never receives network-supplied or user-supplied input. The HD service binaries in the image are built separately and do not carry these findings.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-97031"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/stdlib@v1.27.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "The finding is in the Go standard library compiled into /usr/bin/pebble, the Rock's service manager, supplied by rockcraft. Pebble's HTTP API listens only on a unix socket inside the container; it opens no network listener, so the HTTP/1, HTTP/2, TLS and multipart parsing at issue never receives network-supplied or user-supplied input. The HD service binaries in the image are built separately and do not carry these findings.",
   "timestamp": "2026-10-19T07:16:38Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-97032"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-opa-adapter@sha256:ff5e925577bde49a64460ae7fc598fdca63eb047faa97c78238f8c8267d63d3e?repository_url=cr.fermihdi.io/hd/dms-opa-adapter",
     "subcomponents": [
      {
       "@id": "pkg:generic/stdlib@v1.27.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "The finding is in the Go standard library compiled into /usr/bin/pebble, the Rock's service manager, supplied by rockcraft. Pebble's HTTP API listens only on a unix socket inside the container; it opens no network listener, so the HTTP/1, HTTP/2, TLS and multipart parsing at issue never receives network-supplied or user-supplied input. The HD service binaries in the image are built separately and do not carry these findings.",
   "timestamp": "2026-10-19T07:16:38Z"
  }
 ]
}