registry.rancher.com/rancher/harvester-csi-driver:v0.2.9

image scan · 118 findings

AFFECTED

present and loadable

ALREADY VEXED

somebody has answered

UNDETERMINED

needs a human

RULED OUT

not present or unreachable

AFFECTED(48) — vulnerable code is present and can be loaded

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS	Method
▸	HIGH	SUSE-SU-2026:22315-1	libopenssl-3-fips-provider	0:3.5.0-160000.7.1		no fix	88.7%	elf-needed-closure
advisory SUSE-SU-2026:22315-1 fixes CVE-2026-2673, CVE-2026-34180, CVE-2026-34182, CVE-2026-34183, CVE-2026-42764 (+10 more) from os severity HIGH CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H epss 88.7% 88.7% percentile (epss 0.03566) for CVE-2026-45447, highest of 15 purl pkg:rpm/sles/libopenssl-3-fips-provider@0:3.5.0-160000.7.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]/usr/lib64/ossl-modules/fips.so is OpenSSL provider, loaded by name [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	SUSE-SU-2026:22315-1	openssl-3	0:3.5.0-160000.7.1		3.5.0-160000.8.1	88.7%	elf-needed-closure
advisory SUSE-SU-2026:22315-1 fixes CVE-2026-2673, CVE-2026-34180, CVE-2026-34182, CVE-2026-34183, CVE-2026-42764 (+10 more) from os severity HIGH CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 3.5.0-160000.8.1 epss 88.7% 88.7% percentile (epss 0.03566) for CVE-2026-45447, highest of 15 purl pkg:rpm/sles/openssl-3@0:3.5.0-160000.7.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]openssl-3 installs 1 ELF object (/usr/bin/openssl) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	SUSE-SU-2026:22582-1	curl	0:8.14.1-160000.5.1		8.14.1-160000.8.1	62.8%	elf-needed-closure
advisory SUSE-SU-2026:22582-1 fixes CVE-2026-10536, CVE-2026-12064, CVE-2026-8286, CVE-2026-8458, CVE-2026-8924 (+5 more) from os severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N fixed in 8.14.1-160000.8.1 epss 62.8% 62.8% percentile (epss 0.01064) for CVE-2026-9079, highest of 10 purl pkg:rpm/sles/curl@0:8.14.1-160000.5.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]curl installs 1 ELF object (/usr/bin/curl) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	CVE-2026-33814	golang.org/x/net	v0.49.0	/usr/bin/harvester-csi-driver	0.53.0	54.0%
advisory CVE-2026-33814 (also GO-2026-4918) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.53.0 epss 54.0% 54.0% percentile (epss 0.00781) purl pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/net/http2 (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	SUSE-SU-2026:23303-1	libpython3_13-1_0	0:3.13.13-160000.1.1		no fix	53.0%	elf-needed-closure
advisory SUSE-SU-2026:23303-1 fixes CVE-2025-15366, CVE-2025-15367, CVE-2026-0864, CVE-2026-11940, CVE-2026-11972 (+3 more) from os severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N epss 53.0% 53.0% percentile (epss 0.00750) for CVE-2026-11940, highest of 8 purl pkg:rpm/sles/libpython3_13-1_0@0:3.13.13-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libpython3_13-1_0 installs 1 ELF object (/usr/lib64/libpython3.13.so.1.0) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	SUSE-SU-2026:22156-1	curl	0:8.14.1-160000.5.1		8.14.1-160000.6.1	51.9%	elf-needed-closure
advisory SUSE-SU-2026:22156-1 fixes CVE-2026-4873, CVE-2026-5545, CVE-2026-6253, CVE-2026-6276, CVE-2026-6429 from os severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N fixed in 8.14.1-160000.6.1 epss 51.9% 51.9% percentile (epss 0.00719) for CVE-2026-6253, highest of 5 purl pkg:rpm/sles/curl@0:8.14.1-160000.5.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]curl installs 1 ELF object (/usr/bin/curl) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	CVE-2026-39821	golang.org/x/net	v0.49.0	/usr/bin/harvester-csi-driver	0.55.0	50.9%
advisory CVE-2026-39821 (also GO-2026-5026) from golang severity HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N fixed in 0.55.0 epss 50.9% 50.9% percentile (epss 0.00692) purl pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/net/idna (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	CVE-2026-39821	stdlib	1.25.10	/usr/bin/container-suseconnect	1.25.13	50.9%
advisory CVE-2026-39821 (also GO-2026-5026) from golang severity HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 50.9% 50.9% percentile (epss 0.00692) purl pkg:golang/stdlib@1.25.10 binary /usr/bin/container-suseconnect (stripped) packages net/http, net/http/internal/http2 (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	CVE-2026-39821	stdlib	1.26.3	/usr/bin/harvester-csi-driver	1.26.6	50.9%
advisory CVE-2026-39821 (also GO-2026-5026) from golang severity HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N fixed in 1.26.6 (also fixed in 1.25.13, 1.27.0-rc.3) epss 50.9% 50.9% percentile (epss 0.00692) purl pkg:golang/stdlib@1.26.3 binary /usr/bin/harvester-csi-driver (stripped) packages net/http, net/http/internal/http2 (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	UNKNOWN	CVE-2024-31420	kubevirt.io/kubevirt	v1.7.0	/usr/bin/harvester-csi-driver	no fix	49.0%
advisory CVE-2024-31420 (also GO-2024-2688) from golang epss 49.0% 49.0% percentile (epss 0.00644) purl pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0 binary /usr/bin/harvester-csi-driver (stripped) packages kubevirt.io/kubevirt (module)
▸	LOW	CVE-2026-27145	stdlib	1.25.10	/usr/bin/container-suseconnect	1.25.11	46.4%
advisory CVE-2026-27145 (also GO-2026-5037) from golang severity LOW CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L fixed in 1.25.11 (also fixed in 1.26.4) epss 46.4% 46.4% percentile (epss 0.00591) purl pkg:golang/stdlib@1.25.10 binary /usr/bin/container-suseconnect (stripped) packages crypto/x509 (package) [prefer-vendor]SUSE Security Team rates this LOW, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	CVE-2026-33818	stdlib	1.25.10	/usr/bin/container-suseconnect	1.25.13	45.3%
advisory CVE-2026-33818 (also GO-2026-5972) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 45.3% 45.3% percentile (epss 0.00568) purl pkg:golang/stdlib@1.25.10 binary /usr/bin/container-suseconnect (stripped) packages encoding/asn1 (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	CVE-2026-33818	stdlib	1.26.3	/usr/bin/harvester-csi-driver	1.26.6	45.3%
advisory CVE-2026-33818 (also GO-2026-5972) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.26.6 (also fixed in 1.25.13, 1.27.0-rc.3) epss 45.3% 45.3% percentile (epss 0.00568) purl pkg:golang/stdlib@1.26.3 binary /usr/bin/harvester-csi-driver (stripped) packages encoding/asn1 (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	CVE-2026-56853	stdlib	1.25.10	/usr/bin/container-suseconnect	1.25.13	45.3%
advisory CVE-2026-56853 (also GO-2026-6089) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 45.3% 45.3% percentile (epss 0.00568) purl pkg:golang/stdlib@1.25.10 binary /usr/bin/container-suseconnect (stripped) packages net/http (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	CVE-2026-56859	stdlib	1.25.10	/usr/bin/container-suseconnect	1.25.13	45.3%
advisory CVE-2026-56859 (also GO-2026-6088) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 45.3% 45.3% percentile (epss 0.00568) purl pkg:golang/stdlib@1.25.10 binary /usr/bin/container-suseconnect (stripped) packages encoding/xml (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	CVE-2026-56862	stdlib	1.25.10	/usr/bin/container-suseconnect	1.25.13	45.3%
advisory CVE-2026-56862 (also GO-2026-6090) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 45.3% 45.3% percentile (epss 0.00568) purl pkg:golang/stdlib@1.25.10 binary /usr/bin/container-suseconnect (stripped) packages crypto/tls (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	CVE-2026-56862	stdlib	1.26.3	/usr/bin/harvester-csi-driver	1.26.6	45.3%
advisory CVE-2026-56862 (also GO-2026-6090) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.26.6 (also fixed in 1.25.13, 1.27.0-rc.3) epss 45.3% 45.3% percentile (epss 0.00568) purl pkg:golang/stdlib@1.26.3 binary /usr/bin/harvester-csi-driver (stripped) packages crypto/tls (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2026-42504	stdlib	1.25.10	/usr/bin/container-suseconnect	1.25.11	44.9%
advisory CVE-2026-42504 (also GO-2026-5038) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H fixed in 1.25.11 (also fixed in 1.26.4) epss 44.9% 44.9% percentile (epss 0.00560) purl pkg:golang/stdlib@1.25.10 binary /usr/bin/container-suseconnect (stripped) packages mime (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2025-1767	k8s.io/kubernetes	v1.34.1	/usr/bin/harvester-csi-driver	no fix	44.5%
advisory CVE-2025-1767 (also GO-2025-3521) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N epss 44.5% 44.5% percentile (epss 0.00553) purl pkg:golang/k8s.io%2Fkubernetes@v1.34.1 binary /usr/bin/harvester-csi-driver (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2026-56860	stdlib	1.25.10	/usr/bin/container-suseconnect	1.25.13	42.5%
advisory CVE-2026-56860 (also GO-2026-6218) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 42.5% 42.5% percentile (epss 0.00518) purl pkg:golang/stdlib@1.25.10 binary /usr/bin/container-suseconnect (stripped) packages net/url (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2026-56860	stdlib	1.26.3	/usr/bin/harvester-csi-driver	1.26.6	42.5%
advisory CVE-2026-56860 (also GO-2026-6218) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L fixed in 1.26.6 (also fixed in 1.25.13, 1.27.0-rc.3) epss 42.5% 42.5% percentile (epss 0.00518) purl pkg:golang/stdlib@1.26.3 binary /usr/bin/harvester-csi-driver (stripped) packages net/url (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2026-56852	golang.org/x/text	v0.33.0	/usr/bin/harvester-csi-driver	0.39.0	39.7%
advisory CVE-2026-56852 (also GO-2026-5970) from golang severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.39.0 epss 39.7% 39.7% percentile (epss 0.00475) purl pkg:golang/golang.org%2Fx%2Ftext@v0.33.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/text/unicode/norm (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	CVE-2026-84304	google.golang.org/grpc	v1.79.3	/usr/bin/harvester-csi-driver	1.83.1	35.0%
advisory CVE-2026-84304 (also GHSA-vp52-pcj8-j9qc) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.83.1 epss 35.0% 35.0% percentile (epss 0.00415) purl pkg:golang/google.golang.org%2Fgrpc@v1.79.3 binary /usr/bin/harvester-csi-driver (stripped) packages google.golang.org/grpc (module) [prefer-vendor]SUSE Security Team rates this HIGH (preferred vendor score)
▸	MEDIUM	CVE-2026-42505	stdlib	1.25.10	/usr/bin/container-suseconnect	1.25.12	31.7%
advisory CVE-2026-42505 (also GO-2026-5856) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N fixed in 1.25.12 (also fixed in 1.26.5, 1.27.0-rc.2) epss 31.7% 31.7% percentile (epss 0.00382) purl pkg:golang/stdlib@1.25.10 binary /usr/bin/container-suseconnect (stripped) packages crypto/tls (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2026-42507	stdlib	1.25.10	/usr/bin/container-suseconnect	1.25.11	30.5%
advisory CVE-2026-42507 (also GO-2026-5039) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N fixed in 1.25.11 (also fixed in 1.26.4) epss 30.5% 30.5% percentile (epss 0.00370) purl pkg:golang/stdlib@1.25.10 binary /usr/bin/container-suseconnect (stripped) packages net/textproto (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2024-33394	kubevirt.io/kubevirt	v1.7.0	/usr/bin/harvester-csi-driver	no fix	25.6%
advisory CVE-2024-33394 (also GO-2024-2816) from golang severity MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N epss 25.6% 25.6% percentile (epss 0.00327) purl pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0 binary /usr/bin/harvester-csi-driver (stripped) packages kubevirt.io/kubevirt (module) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	LOW	CVE-2024-7598	k8s.io/kubernetes	v1.34.1	/usr/bin/harvester-csi-driver	no fix	24.2%
advisory CVE-2024-7598 (also GO-2025-3547) from golang severity LOW CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N epss 24.2% 24.2% percentile (epss 0.00314) purl pkg:golang/k8s.io%2Fkubernetes@v1.34.1 binary /usr/bin/harvester-csi-driver (stripped) packages k8s.io/kubernetes (module) [prefer-vendor]SUSE Security Team rates this LOW, used instead of UNKNOWN (preferred vendor score)
▸	CRITICAL	CVE-2026-84303	google.golang.org/grpc	v1.79.3	/usr/bin/harvester-csi-driver	1.83.1	23.7%
advisory CVE-2026-84303 (also GHSA-qc2q-p7wx-3px3) from golang severity CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N fixed in 1.83.1 epss 23.7% 23.7% percentile (epss 0.00311) purl pkg:golang/google.golang.org%2Fgrpc@v1.79.3 binary /usr/bin/harvester-csi-driver (stripped) packages google.golang.org/grpc (module) [prefer-vendor]SUSE Security Team rates this CRITICAL, used instead of MEDIUM (preferred vendor score)
▸	HIGH	CVE-2026-39822	stdlib	1.25.10	/usr/bin/container-suseconnect	1.25.12	14.2%
advisory CVE-2026-39822 (also GO-2026-4970) from golang severity HIGH CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H fixed in 1.25.12 (also fixed in 1.26.5, 1.27.0-rc.2) epss 14.2% 14.2% percentile (epss 0.00232) purl pkg:golang/stdlib@1.25.10 binary /usr/bin/container-suseconnect (stripped) packages os (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2026-41989	libgcrypt20	0:1.12.1-160000.1.1		no fix	8.0%	elf-needed-closure
advisory CVE-2026-41989 (also SUSE-SU-2026:22826-1) from os severity MEDIUM CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H epss 8.0% 8.0% percentile (epss 0.00182) purl pkg:rpm/sles/libgcrypt20@0:1.12.1-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libgcrypt20 installs 1 ELF object (/usr/lib64/libgcrypt.so.20.7.1) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	LOW	CVE-2026-41990	libgcrypt20	0:1.12.1-160000.1.1		no fix	7.3%	elf-needed-closure
advisory CVE-2026-41990 (also SUSE-SU-2026:22355-1) from os severity LOW CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L epss 7.3% 7.3% percentile (epss 0.00176) purl pkg:rpm/sles/libgcrypt20@0:1.12.1-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libgcrypt20 installs 1 ELF object (/usr/lib64/libgcrypt.so.20.7.1) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this LOW, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	SUSE-SU-2026:22166-1	libsqlite3-0	0:3.51.3-160000.1.1		no fix	7.2%	elf-needed-closure
advisory SUSE-SU-2026:22166-1 fixes CVE-2026-11822, CVE-2026-11824 from os severity HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H epss 7.2% 7.2% percentile (epss 0.00175) for CVE-2026-11822, highest of 2 purl pkg:rpm/sles/libsqlite3-0@0:3.51.3-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libsqlite3-0 installs 1 ELF object (/usr/lib64/libsqlite3.so.3.51.3) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score)
▸	LOW	CVE-2026-57062	gpg2	0:2.5.5-160000.5.1		2.5.5-160000.6.1	3.9%	elf-needed-closure
advisory CVE-2026-57062 (also SUSE-SU-2026:22825-1) from os severity LOW CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N fixed in 2.5.5-160000.6.1 epss 3.9% 3.9% percentile (epss 0.00142) purl pkg:rpm/sles/gpg2@0:2.5.5-160000.5.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]gpg2 installs 25 ELF objects (/usr/bin/g13, /usr/bin/gpg, ...) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this LOW, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2026-5958	sed	0:4.9-160000.2.2		4.9-160000.3.1	3.8%	elf-needed-closure
advisory CVE-2026-5958 (also SUSE-SU-2026:22325-1) from os severity MEDIUM CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N fixed in 4.9-160000.3.1 epss 3.8% 3.8% percentile (epss 0.00142) purl pkg:rpm/sles/sed@0:4.9-160000.2.2?arch=x86_64 method elf-needed-closure [elf-needed-closure]sed installs 1 ELF object (/usr/bin/sed) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2026-27456	libblkid1	0:2.41.1-160000.3.1		no fix	1.9%	elf-needed-closure
advisory CVE-2026-27456 (also SUSE-SU-2026:22332-1) from os severity MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N epss 1.9% 1.9% percentile (epss 0.00118) purl pkg:rpm/sles/libblkid1@0:2.41.1-160000.3.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libblkid1 installs 1 ELF object (/usr/lib64/libblkid.so.1.1.0) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2026-27456	libfdisk1	0:2.41.1-160000.3.1		no fix	1.9%	elf-needed-closure
advisory CVE-2026-27456 (also SUSE-SU-2026:22332-1) from os severity MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N epss 1.9% 1.9% percentile (epss 0.00118) purl pkg:rpm/sles/libfdisk1@0:2.41.1-160000.3.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libfdisk1 installs 1 ELF object (/usr/lib64/libfdisk.so.1.1.0) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2026-27456	libmount1	0:2.41.1-160000.3.1		no fix	1.9%	elf-needed-closure
advisory CVE-2026-27456 (also SUSE-SU-2026:22332-1) from os severity MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N epss 1.9% 1.9% percentile (epss 0.00118) purl pkg:rpm/sles/libmount1@0:2.41.1-160000.3.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libmount1 installs 1 ELF object (/usr/lib64/libmount.so.1.1.0) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2026-27456	libsmartcols1	0:2.41.1-160000.3.1		no fix	1.9%	elf-needed-closure
advisory CVE-2026-27456 (also SUSE-SU-2026:22332-1) from os severity MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N epss 1.9% 1.9% percentile (epss 0.00118) purl pkg:rpm/sles/libsmartcols1@0:2.41.1-160000.3.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libsmartcols1 installs 1 ELF object (/usr/lib64/libsmartcols.so.1.1.0) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2026-27456	util-linux	0:2.41.1-160000.3.1		2.41.1-160000.4.1	1.9%	elf-needed-closure
advisory CVE-2026-27456 (also SUSE-SU-2026:22332-1) from os severity MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N fixed in 2.41.1-160000.4.1 epss 1.9% 1.9% percentile (epss 0.00118) purl pkg:rpm/sles/util-linux@0:2.41.1-160000.3.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]util-linux installs 114 ELF objects (/usr/bin/bits, /usr/bin/cal, ...) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	HIGH	CVE-2026-84445	google.golang.org/grpc	v1.79.3	/usr/bin/harvester-csi-driver	1.82.2	—
advisory CVE-2026-84445 (also GHSA-2v4p-qf9q-27wj) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.82.2 (also fixed in 1.83.2, 1.85.0-dev.0.20260825072537-93e31b48545e) epss not scored — CVE-2026-84445 is not in the feed yet purl pkg:golang/google.golang.org%2Fgrpc@v1.79.3 binary /usr/bin/harvester-csi-driver (stripped) packages google.golang.org/grpc (module) [prefer-vendor]SUSE Security Team rates this HIGH (preferred vendor score)
▸	HIGH	GO-2026-6061	google.golang.org/grpc	v1.79.3	/usr/bin/harvester-csi-driver	1.82.1	—
advisory GO-2026-6061 from golang severity HIGH fixed in 1.82.1 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/google.golang.org%2Fgrpc@v1.79.3 binary /usr/bin/harvester-csi-driver (stripped) packages google.golang.org/grpc/internal/transport, google.golang.org/grpc/internal/xds/rbac (package)
▸	UNKNOWN	SUSE-SU-2026:22947-1	libopenssl-3-fips-provider	0:3.5.0-160000.7.1		no fix	—	elf-needed-closure
advisory SUSE-SU-2026:22947-1 from os epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:rpm/sles/libopenssl-3-fips-provider@0:3.5.0-160000.7.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]/usr/lib64/ossl-modules/fips.so is OpenSSL provider, loaded by name [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime
▸	UNKNOWN	SUSE-SU-2026:22955-1	libopenssl-3-fips-provider	0:3.5.0-160000.7.1		no fix	—	elf-needed-closure
advisory SUSE-SU-2026:22955-1 from os epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:rpm/sles/libopenssl-3-fips-provider@0:3.5.0-160000.7.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]/usr/lib64/ossl-modules/fips.so is OpenSSL provider, loaded by name [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime
▸	UNKNOWN	SUSE-SU-2026:22947-1	libopenssl3	0:3.5.0-160000.7.1		no fix	—	elf-needed-closure
advisory SUSE-SU-2026:22947-1 from os epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:rpm/sles/libopenssl3@0:3.5.0-160000.7.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]/usr/lib64/engines-3/capi.so is OpenSSL engine, loaded by name [elf-needed-closure]/usr/lib64/engines-3/loader_attic.so is OpenSSL engine, loaded by name [elf-needed-closure]/usr/lib64/engines-3/padlock.so is OpenSSL engine, loaded by name [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime
▸	UNKNOWN	SUSE-SU-2026:22955-1	libopenssl3	0:3.5.0-160000.7.1		no fix	—	elf-needed-closure
advisory SUSE-SU-2026:22955-1 from os epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:rpm/sles/libopenssl3@0:3.5.0-160000.7.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]/usr/lib64/engines-3/capi.so is OpenSSL engine, loaded by name [elf-needed-closure]/usr/lib64/engines-3/loader_attic.so is OpenSSL engine, loaded by name [elf-needed-closure]/usr/lib64/engines-3/padlock.so is OpenSSL engine, loaded by name [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime
▸	UNKNOWN	SUSE-SU-2026:22947-1	openssl-3	0:3.5.0-160000.7.1		3.5.0-160000.9.1	—	elf-needed-closure
advisory SUSE-SU-2026:22947-1 from os fixed in 3.5.0-160000.9.1 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:rpm/sles/openssl-3@0:3.5.0-160000.7.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]openssl-3 installs 1 ELF object (/usr/bin/openssl) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime
▸	UNKNOWN	SUSE-SU-2026:22955-1	openssl-3	0:3.5.0-160000.7.1		3.5.0-160000.9.1	—	elf-needed-closure
advisory SUSE-SU-2026:22955-1 from os fixed in 3.5.0-160000.9.1 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:rpm/sles/openssl-3@0:3.5.0-160000.7.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]openssl-3 installs 1 ELF object (/usr/bin/openssl) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime
▸	UNKNOWN	SUSE-SU-2026:22331-1	rpcbind	0:1.2.7-160000.2.2		1.2.9-160000.1.1	—	elf-needed-closure
advisory SUSE-SU-2026:22331-1 from os fixed in 1.2.9-160000.1.1 epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:rpm/sles/rpcbind@0:1.2.7-160000.2.2?arch=x86_64 method elf-needed-closure [elf-needed-closure]rpcbind installs 2 ELF objects (/usr/bin/rpcinfo, /usr/sbin/rpcbind) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime

ALREADY VEXED(56) — a published statement answers these; vexscan's own verdict is unchanged

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS	Vendor	Reason
▸	HIGH	SUSE-SU-2026:22315-1	libopenssl3	0:3.5.0-160000.7.1		no fix	88.7%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22315-1 fixes CVE-2026-2673, CVE-2026-34180, CVE-2026-34182, CVE-2026-34183, CVE-2026-42764 (+10 more) from os severity HIGH CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H epss 88.7% 88.7% percentile (epss 0.03566) for CVE-2026-45447, highest of 15 purl pkg:rpm/sles/libopenssl3@0:3.5.0-160000.7.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]/usr/lib64/engines-3/capi.so is OpenSSL engine, loaded by name [elf-needed-closure]/usr/lib64/engines-3/loader_attic.so is OpenSSL engine, loaded by name [elf-needed-closure]/usr/lib64/engines-3/padlock.so is OpenSSL engine, loaded by name [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libopenssl3; component is pkg:rpm/sles/libopenssl3@0:3.5.0-160000.7.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Go CSI driver uses crypto/tls; libopenssl3 is not loaded at runtime product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-11T15:53:45Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libopenssl3; component is pkg:rpm/sles/libopenssl3@0:3.5.0-160000.7.1?arch=x86_64
▸	HIGH	SUSE-SU-2026:22582-1	libcurl4	0:8.14.1-160000.5.1		no fix	62.8%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22582-1 fixes CVE-2026-10536, CVE-2026-12064, CVE-2026-8286, CVE-2026-8458, CVE-2026-8924 (+5 more) from os severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N epss 62.8% 62.8% percentile (epss 0.01064) for CVE-2026-9079, highest of 10 purl pkg:rpm/sles/libcurl4@0:8.14.1-160000.5.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libcurl4 installs 1 ELF object (/usr/lib64/libcurl.so.4.8.0) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libcurl4; component is pkg:rpm/sles/libcurl4@0:8.14.1-160000.5.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Go CSI driver uses Go net/http; system libcurl4 not linked or loaded product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-29T04:40:43Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libcurl4; component is pkg:rpm/sles/libcurl4@0:8.14.1-160000.5.1?arch=x86_64
▸	HIGH	SUSE-SU-2026:22172-1	libsolv-tools-base	0:0.7.36-160000.1.1		no fix	55.2%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22172-1 fixes CVE-2026-25707, CVE-2026-44933, CVE-2026-44941, CVE-2026-44942, CVE-2026-48863 (+2 more) from os severity HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H epss 55.2% 55.2% percentile (epss 0.00820) for CVE-2026-48863, highest of 7 purl pkg:rpm/sles/libsolv-tools-base@0:0.7.36-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libsolv-tools-base installs 2 ELF objects (/usr/bin/repo2solv, /usr/bin/rpmdb2solv) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libsolv-tools-base; component is pkg:rpm/sles/libsolv-tools-base@0:0.7.36-160000.1.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) zypper/libsolv package manager not invoked at container runtime; incidental SLES dep product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-08-02T00:42:34Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libsolv-tools-base; component is pkg:rpm/sles/libsolv-tools-base@0:0.7.36-160000.1.1?arch=x86_64
▸	HIGH	SUSE-SU-2026:22172-1	libzypp	0:17.38.5-160000.1.1		17.38.13-160000.1.1	55.2%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22172-1 fixes CVE-2026-25707, CVE-2026-44933, CVE-2026-44941, CVE-2026-44942, CVE-2026-48863 (+2 more) from os severity HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H fixed in 17.38.13-160000.1.1 epss 55.2% 55.2% percentile (epss 0.00820) for CVE-2026-48863, highest of 7 purl pkg:rpm/sles/libzypp@0:17.38.5-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libzypp installs 3 ELF objects (/usr/bin/zypp-NameReqPrv, /usr/lib64/libzypp.so.1735.3.5, ...) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libzypp; component is pkg:rpm/sles/libzypp@0:17.38.5-160000.1.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Harvester CSI driver is a Go binary; libzypp package management library never invoked product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-06-26T00:55:16Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libzypp; component is pkg:rpm/sles/libzypp@0:17.38.5-160000.1.1?arch=x86_64
▸	HIGH	SUSE-SU-2026:22172-1	zypper	0:1.14.95-160000.1.1		1.14.98-160000.1.1	55.2%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22172-1 fixes CVE-2026-25707, CVE-2026-44933, CVE-2026-44941, CVE-2026-44942, CVE-2026-48863 (+2 more) from os severity HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H fixed in 1.14.98-160000.1.1 epss 55.2% 55.2% percentile (epss 0.00820) for CVE-2026-48863, highest of 7 purl pkg:rpm/sles/zypper@0:1.14.95-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]zypper installs 2 ELF objects (/usr/bin/zypper, /usr/sbin/zypp-refresh) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/zypper; component is pkg:rpm/sles/zypper@0:1.14.95-160000.1.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) CSI driver is a Go binary; zypper package manager is never invoked at container runtime product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-08-18T23:50:39Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/zypper; component is pkg:rpm/sles/zypper@0:1.14.95-160000.1.1?arch=x86_64
▸	HIGH	SUSE-SU-2026:23303-1	python313-base	0:3.13.13-160000.1.1		no fix	53.0%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:23303-1 fixes CVE-2025-15366, CVE-2025-15367, CVE-2026-0864, CVE-2026-11940, CVE-2026-11972 (+3 more) from os severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N epss 53.0% 53.0% percentile (epss 0.00750) for CVE-2026-11940, highest of 8 purl pkg:rpm/sles/python313-base@0:3.13.13-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]/usr/lib64/python3.13/lib-dynload/_asyncio.cpython-313-x86_64-linux-gnu.so is Python extension module, loaded by import [elf-needed-closure]/usr/lib64/python3.13/lib-dynload/_bisect.cpython-313-x86_64-linux-gnu.so is Python extension module, loaded by import [elf-needed-closure]/usr/lib64/python3.13/lib-dynload/_blake2.cpython-313-x86_64-linux-gnu.so is Python extension module, loaded by import [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/python313-base; component is pkg:rpm/sles/python313-base@0:3.13.13-160000.1.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Python is not used at runtime in this container; it is an incidental SLES base-image dependency product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-09-12T01:06:17Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/python313-base; component is pkg:rpm/sles/python313-base@0:3.13.13-160000.1.1?arch=x86_64
▸	CRITICAL	CVE-2026-7374	kubevirt.io/kubevirt	v1.7.0	/usr/bin/harvester-csi-driver	1.7.4	52.7%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-7374 (also GHSA-7jcp-v9w4-wjmg) from golang severity CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H fixed in 1.7.4 (also fixed in 1.8.3, 1.6.6) epss 52.7% 52.7% percentile (epss 0.00742) purl pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0 binary /usr/bin/harvester-csi-driver (stripped) packages kubevirt.io/kubevirt (module) [prefer-vendor]SUSE Security Team rates this CRITICAL (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/kubevirt.io/kubevirt@v1.4.0; component is pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) This vulnerability is found in the virt-handler component which Harvester components do not spin up nor interact directly with during runtime. The kubevirt.io/kubevirt package is a transitive dependency from the github.com/harvester/harvester package. Harvester components only depends on this package for a handful of Go util functions. product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-07-15T23:07:06Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/kubevirt.io/kubevirt@v1.4.0; component is pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0
▸	MEDIUM	SUSE-SU-2026:22156-1	libcurl4	0:8.14.1-160000.5.1		no fix	51.9%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22156-1 fixes CVE-2026-4873, CVE-2026-5545, CVE-2026-6253, CVE-2026-6276, CVE-2026-6429 from os severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N epss 51.9% 51.9% percentile (epss 0.00719) for CVE-2026-6253, highest of 5 purl pkg:rpm/sles/libcurl4@0:8.14.1-160000.5.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libcurl4 installs 1 ELF object (/usr/lib64/libcurl.so.4.8.0) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libcurl4; component is pkg:rpm/sles/libcurl4@0:8.14.1-160000.5.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Go CSI driver uses net/http stdlib for HTTP; C libcurl not linked at runtime product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-06-25T19:50:46Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libcurl4; component is pkg:rpm/sles/libcurl4@0:8.14.1-160000.5.1?arch=x86_64
▸	HIGH	SUSE-SU-2026:22636-1	libxml2-2	0:2.13.8-160000.4.1		no fix	48.4%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22636-1 fixes CVE-2026-11979, CVE-2026-6732 from os severity HIGH CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H epss 48.4% 48.4% percentile (epss 0.00632) for CVE-2026-6732, highest of 2 purl pkg:rpm/sles/libxml2-2@0:2.13.8-160000.4.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libxml2-2 installs 1 ELF object (/usr/lib64/libxml2.so.2.13.8) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libxml2-2; component is pkg:rpm/sles/libxml2-2@0:2.13.8-160000.4.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Go CSI driver binary does not parse XML via libxml2 at runtime product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-08-25T00:44:23Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libxml2-2; component is pkg:rpm/sles/libxml2-2@0:2.13.8-160000.4.1?arch=x86_64
▸	MEDIUM	CVE-2026-39830	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.52.0	47.9%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-39830 (also GO-2026-5017) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H fixed in 0.52.0 epss 47.9% 47.9% percentile (epss 0.00621) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of CRITICAL (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	MEDIUM	SUSE-SU-2026:22322-1	krb5	0:1.21.3-160000.2.2		1.21.3-160000.3.1	47.3%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22322-1 fixes CVE-2026-40355, CVE-2026-40356 from os severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.21.3-160000.3.1 epss 47.3% 47.3% percentile (epss 0.00611) for CVE-2026-40355, highest of 2 purl pkg:rpm/sles/krb5@0:1.21.3-160000.2.2?arch=x86_64 method elf-needed-closure [elf-needed-closure]krb5 installs 10 ELF objects (/usr/lib64/krb5/plugins/tls/k5tls.so, /usr/lib64/libgssapi_krb5.so.2.2, ...) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/krb5; component is pkg:rpm/sles/krb5@0:1.21.3-160000.2.2?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) CSI driver authenticates via K8s service accounts and TLS; Kerberos is not used product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-07T01:05:12Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/krb5; component is pkg:rpm/sles/krb5@0:1.21.3-160000.2.2?arch=x86_64
▸	LOW	CVE-2026-27145	stdlib	1.26.3	/usr/bin/harvester-csi-driver	1.26.4	46.4%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-27145 (also GO-2026-5037) from golang severity LOW CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L fixed in 1.26.4 (also fixed in 1.25.11) epss 46.4% 46.4% percentile (epss 0.00591) purl pkg:golang/stdlib@1.26.3 binary /usr/bin/harvester-csi-driver (stripped) packages crypto/x509 (package) [prefer-vendor]SUSE Security Team rates this LOW, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Harvester CSI driver connects to K8s/storage APIs; cluster-managed cert SANs not adversary-controlled product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-07-01T05:02:13Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3
▸	HIGH	CVE-2026-56853	stdlib	1.26.3	/usr/bin/harvester-csi-driver	1.26.6	45.3%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-56853 (also GO-2026-6089) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.26.6 (also fixed in 1.25.13, 1.27.0-rc.3) epss 45.3% 45.3% percentile (epss 0.00568) purl pkg:golang/stdlib@1.26.3 binary /usr/bin/harvester-csi-driver (stripped) packages net/http (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-08-14T03:01:50Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3
▸	HIGH	CVE-2026-56859	stdlib	1.26.3	/usr/bin/harvester-csi-driver	1.26.6	45.3%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-56859 (also GO-2026-6088) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.26.6 (also fixed in 1.25.13, 1.27.0-rc.3) epss 45.3% 45.3% percentile (epss 0.00568) purl pkg:golang/stdlib@1.26.3 binary /usr/bin/harvester-csi-driver (stripped) packages encoding/xml (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-08-14T03:01:50Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3
▸	MEDIUM	SUSE-SU-2026:22948-1	libssh4	0:0.11.4-160000.1.1		no fix	45.3%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22948-1 fixes CVE-2026-15370, CVE-2026-59843, CVE-2026-59844, CVE-2026-59845, CVE-2026-59846 (+4 more) from os severity MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H epss 45.3% 45.3% percentile (epss 0.00567) for CVE-2026-59843, highest of 9 purl pkg:rpm/sles/libssh4@0:0.11.4-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libssh4 installs 1 ELF object (/usr/lib64/libssh.so.4.10.4) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libssh4; component is pkg:rpm/sles/libssh4@0:0.11.4-160000.1.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Go uses crypto/ssh; the system libssh C library is not called at runtime product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-30T03:00:01Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libssh4; component is pkg:rpm/sles/libssh4@0:0.11.4-160000.1.1?arch=x86_64
▸	MEDIUM	SUSE-SU-2026:22956-1	libssh4	0:0.11.4-160000.1.1		no fix	45.3%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22956-1 fixes CVE-2026-15370, CVE-2026-59843, CVE-2026-59844, CVE-2026-59845, CVE-2026-59846 (+4 more) from os severity MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H epss 45.3% 45.3% percentile (epss 0.00567) for CVE-2026-59843, highest of 9 purl pkg:rpm/sles/libssh4@0:0.11.4-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libssh4 installs 1 ELF object (/usr/lib64/libssh.so.4.10.4) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libssh4; component is pkg:rpm/sles/libssh4@0:0.11.4-160000.1.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Go uses crypto/ssh; the system libssh C library is not called at runtime product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-30T03:00:01Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libssh4; component is pkg:rpm/sles/libssh4@0:0.11.4-160000.1.1?arch=x86_64
▸	MEDIUM	CVE-2026-42504	stdlib	1.26.3	/usr/bin/harvester-csi-driver	1.26.4	44.9%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-42504 (also GO-2026-5038) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H fixed in 1.26.4 (also fixed in 1.25.11) epss 44.9% 44.9% percentile (epss 0.00560) purl pkg:golang/stdlib@1.26.3 binary /usr/bin/harvester-csi-driver (stripped) packages mime (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Harvester CSI driver uses gRPC for storage; no MIME encoded-word processing in execute path product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-07-01T00:22:11Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3
▸	MEDIUM	CVE-2026-46600	golang.org/x/net	v0.49.0	/usr/bin/harvester-csi-driver	0.56.0	44.3%	not_affected	vulnerable_code_not_present
advisory CVE-2026-46600 (also GO-2026-5942) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H fixed in 0.56.0 epss 44.3% 44.3% percentile (epss 0.00549) purl pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/net/dns/dnsmessage (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/net@v0.38.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-07-22T03:16:44Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/net@v0.38.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.49.0
▸	MEDIUM	CVE-2026-46600	stdlib	1.26.3	/usr/bin/harvester-csi-driver	1.26.6	44.3%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-46600 (also GO-2026-5942) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H fixed in 1.26.6 (also fixed in 1.27.0-rc.3) epss 44.3% 44.3% percentile (epss 0.00549) purl pkg:golang/stdlib@1.26.3 binary /usr/bin/harvester-csi-driver (stripped) packages net (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-08-14T03:01:50Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3
▸	HIGH	SUSE-SU-2026:22846-1	libglib-2_0-0	0:2.84.4-160000.2.1		no fix	44.1%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22846-1 fixes CVE-2026-58010, CVE-2026-58011, CVE-2026-58012, CVE-2026-58013, CVE-2026-58014 (+1 more) from os severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H epss 44.1% 44.1% percentile (epss 0.00545) for CVE-2026-58016, highest of 6 purl pkg:rpm/sles/libglib-2_0-0@0:2.84.4-160000.2.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libglib-2_0-0 installs 1 ELF object (/usr/lib64/libglib-2.0.so.0.8400.4) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libglib-2_0-0; component is pkg:rpm/sles/libglib-2_0-0@0:2.84.4-160000.2.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Go CSI driver binary does not link/use GLib at runtime product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-08-25T00:44:23Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libglib-2_0-0; component is pkg:rpm/sles/libglib-2_0-0@0:2.84.4-160000.2.1?arch=x86_64
▸	HIGH	CVE-2026-39834	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.52.0	42.9%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-39834 (also GO-2026-5020) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.52.0 epss 42.9% 42.9% percentile (epss 0.00525) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of CRITICAL (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	CRITICAL	CVE-2026-54680	github.com/kube-logging/logging-operator	v0.0.0-20250424202944-7e1f9aad6e21	/usr/bin/harvester-csi-driver	0.0.0-20260608145523-cf437d7f1e05	42.9%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-54680 (also GHSA-mjqf-28ph-426h) from golang severity CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H fixed in 0.0.0-20260608145523-cf437d7f1e05 epss 42.9% 42.9% percentile (epss 0.00525) purl pkg:golang/github.com%2Fkube-logging%2Flogging-operator@v0.0.0-20250424202944-7e1f9aad6e21 binary /usr/bin/harvester-csi-driver (stripped) packages github.com/kube-logging/logging-operator (module) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21; component is pkg:golang/github.com%2Fkube-logging%2Flogging-operator@v0.0.0-20250424202944-7e1f9aad6e21 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Harvester does not use use fluentd directly. This Go package is only used to import the SDK CRD type. product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-07-30T17:45:59Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21; component is pkg:golang/github.com%2Fkube-logging%2Flogging-operator@v0.0.0-20250424202944-7e1f9aad6e21
▸	HIGH	CVE-2026-9804	kubevirt.io/kubevirt	v1.7.0	/usr/bin/harvester-csi-driver	no fix	42.4%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-9804 (also GHSA-mpmf-3w4r-qfpf) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N epss 42.4% 42.4% percentile (epss 0.00516) purl pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0 binary /usr/bin/harvester-csi-driver (stripped) packages kubevirt.io/kubevirt (module) [prefer-vendor]SUSE Security Team rates this HIGH (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/kubevirt.io/kubevirt@v1.4.0; component is pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) This vulnerability is found in the virt-exportserver component which Harvester components do not spin up nor interact directly with during runtime. The kubevirt.io/kubevirt package is a transitive dependency from the github.com/harvester/harvester package. Harvester components only depends on this package for a handful of Go util functions. product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-07-15T23:07:06Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/kubevirt.io/kubevirt@v1.4.0; component is pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0
▸	HIGH	CVE-2026-39835	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.52.0	41.6%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-39835 (also GO-2026-5015) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.52.0 epss 41.6% 41.6% percentile (epss 0.00504) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of MEDIUM (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	HIGH	CVE-2026-46595	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.52.0	41.5%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-46595 (also GO-2026-5023) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N fixed in 0.52.0 epss 41.5% 41.5% percentile (epss 0.00503) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of CRITICAL (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	HIGH	CVE-2026-46597	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.52.0	39.5%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-46597 (also GO-2026-5013) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.52.0 epss 39.5% 39.5% percentile (epss 0.00473) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh (package) [prefer-vendor]SUSE Security Team rates this HIGH (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	HIGH	CVE-2026-39829	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.52.0	39.1%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-39829 (also GO-2026-5018) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.52.0 epss 39.1% 39.1% percentile (epss 0.00467) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh (package) [prefer-vendor]SUSE Security Team rates this HIGH (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	HIGH	SUSE-SU-2026:22377-1	tar	0:1.35-160000.3.1		1.35-160000.4.1	38.0%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22377-1 fixes CVE-2025-45582, CVE-2026-5704 from os severity HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H fixed in 1.35-160000.4.1 epss 38.0% 38.0% percentile (epss 0.00450) for CVE-2025-45582, highest of 2 purl pkg:rpm/sles/tar@0:1.35-160000.3.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]tar installs 1 ELF object (/usr/bin/tar) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/tar; component is pkg:rpm/sles/tar@0:1.35-160000.3.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) tar is not executed at runtime; it is an incidental SLES base-image dependency product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-05T00:42:58Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/tar; component is pkg:rpm/sles/tar@0:1.35-160000.3.1?arch=x86_64
▸	MEDIUM	CVE-2025-69720	libncurses6	0:6.5.20250531-160000.2.2		no fix	37.8%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2025-69720 (also SUSE-SU-2026:22294-1) from os severity MEDIUM CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L epss 37.8% 37.8% percentile (epss 0.00447) purl pkg:rpm/sles/libncurses6@0:6.5.20250531-160000.2.2?arch=x86_64 method elf-needed-closure [elf-needed-closure]libncurses6 installs 12 ELF objects (/usr/lib64/libform.so.6.5, /usr/lib64/libformw.so.6.5, ...) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libncurses6; component is pkg:rpm/sles/libncurses6@0:6.5.20250531-160000.2.2?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Container runs as a daemon without interactive terminal; ncurses is not in the execute path product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-05T00:42:58Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libncurses6; component is pkg:rpm/sles/libncurses6@0:6.5.20250531-160000.2.2?arch=x86_64
▸	MEDIUM	CVE-2025-69720	ncurses-utils	0:6.5.20250531-160000.2.2		no fix	37.8%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2025-69720 (also SUSE-SU-2026:22294-1) from os severity MEDIUM CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L epss 37.8% 37.8% percentile (epss 0.00447) purl pkg:rpm/sles/ncurses-utils@0:6.5.20250531-160000.2.2?arch=x86_64 method elf-needed-closure [elf-needed-closure]ncurses-utils installs 6 ELF objects (/usr/bin/clear, /usr/bin/infocmp, ...) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/ncurses-utils; component is pkg:rpm/sles/ncurses-utils@0:6.5.20250531-160000.2.2?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Container runs as a daemon without interactive terminal; ncurses is not in the execute path product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-05T00:42:58Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/ncurses-utils; component is pkg:rpm/sles/ncurses-utils@0:6.5.20250531-160000.2.2?arch=x86_64
▸	HIGH	SUSE-SU-2026:22847-1	perl	0:5.42.0-160000.2.2		5.42.0-160000.3.1	37.4%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22847-1 fixes CVE-2025-15649, CVE-2026-12087, CVE-2026-13221, CVE-2026-57432, CVE-2026-8376 from os severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N fixed in 5.42.0-160000.3.1 epss 37.4% 37.4% percentile (epss 0.00443) for CVE-2026-8376, highest of 5 purl pkg:rpm/sles/perl@0:5.42.0-160000.2.2?arch=x86_64 method elf-needed-closure [elf-needed-closure]perl installs 41 ELF objects (/usr/lib/perl5/5.42.0/x86_64-linux-thread-multi/CORE/libperl.so, /usr/lib/perl5/5.42.0/x86_64-linux-thread-multi/auto/B/B.so, ...) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/perl; component is pkg:rpm/sles/perl@0:5.42.0-160000.2.2?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Go CSI driver is the entrypoint; perl interpreter not invoked at runtime product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-29T04:40:43Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/perl; component is pkg:rpm/sles/perl@0:5.42.0-160000.2.2?arch=x86_64
▸	HIGH	SUSE-SU-2026:22847-1	perl-base	0:5.42.0-160000.2.2		no fix	37.4%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22847-1 fixes CVE-2025-15649, CVE-2026-12087, CVE-2026-13221, CVE-2026-57432, CVE-2026-8376 from os severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N epss 37.4% 37.4% percentile (epss 0.00443) for CVE-2026-8376, highest of 5 purl pkg:rpm/sles/perl-base@0:5.42.0-160000.2.2?arch=x86_64 method elf-needed-closure [elf-needed-closure]perl-base installs 13 ELF objects (/usr/bin/perl, /usr/bin/perl5.42.0, ...) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/perl-base; component is pkg:rpm/sles/perl-base@0:5.42.0-160000.2.2?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Perl is not used at runtime in this container; it is an incidental SLES base-image dependency product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-29T01:22:06Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/perl-base; component is pkg:rpm/sles/perl-base@0:5.42.0-160000.2.2?arch=x86_64
▸	HIGH	CVE-2026-39831	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.52.0	35.5%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-39831 (also GO-2026-5019) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N fixed in 0.52.0 epss 35.5% 35.5% percentile (epss 0.00420) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of CRITICAL (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	MEDIUM	CVE-2025-13281	k8s.io/kubernetes	v1.34.1	/usr/bin/harvester-csi-driver	1.34.2	32.4%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2025-13281 (also GHSA-r6j8-c6r2-37rr) from golang severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N fixed in 1.34.2 (also fixed in 1.32.10, 1.33.6) epss 32.4% 32.4% percentile (epss 0.00389) purl pkg:golang/k8s.io%2Fkubernetes@v1.34.1 binary /usr/bin/harvester-csi-driver (stripped) packages k8s.io/kubernetes (module) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/k8s.io/kubernetes@v1.31.6; component is pkg:golang/k8s.io%2Fkubernetes@v1.34.1 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Harvester has not direct dependency on the kube-controller-manager. The k8s.io/kubernetes Go package is a transitive dependency from the github.com/rancher/rancher package. product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-07-29T04:38:51Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/k8s.io/kubernetes@v1.31.6; component is pkg:golang/k8s.io%2Fkubernetes@v1.34.1
▸	MEDIUM	CVE-2026-42505	stdlib	1.26.3	/usr/bin/harvester-csi-driver	1.26.5	31.7%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-42505 (also GO-2026-5856) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N fixed in 1.26.5 (also fixed in 1.25.12, 1.27.0-rc.2) epss 31.7% 31.7% percentile (epss 0.00382) purl pkg:golang/stdlib@1.26.3 binary /usr/bin/harvester-csi-driver (stripped) packages crypto/tls (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Harvester CSI driver uses K8s client-go standard TLS; EncryptedClientHelloConfigList not configured product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-07-14T00:17:23Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3
▸	HIGH	CVE-2026-56855	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.56.0	31.3%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-56855 (also GO-2026-6355) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.56.0 epss 31.3% 31.3% percentile (epss 0.00378) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/crypto@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-09-03T02:17:13Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	MEDIUM	CVE-2026-42507	stdlib	1.26.3	/usr/bin/harvester-csi-driver	1.26.4	30.5%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-42507 (also GO-2026-5039) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N fixed in 1.26.4 (also fixed in 1.25.11) epss 30.5% 30.5% percentile (epss 0.00370) purl pkg:golang/stdlib@1.26.3 binary /usr/bin/harvester-csi-driver (stripped) packages net/textproto (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Harvester CSI driver uses gRPC; net/textproto error path not reachable from adversary input product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-07-01T00:22:11Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3
▸	HIGH	CVE-2026-39828	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.52.0	30.3%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-39828 (also GO-2026-5014) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N fixed in 0.52.0 epss 30.3% 30.3% percentile (epss 0.00369) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of MEDIUM (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	HIGH	CVE-2026-25680	golang.org/x/net	v0.49.0	/usr/bin/harvester-csi-driver	0.55.0	25.6%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-25680 (also GO-2026-5028) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.55.0 epss 25.6% 25.6% percentile (epss 0.00326) purl pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/net/html (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of MEDIUM (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/net@v0.38.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/net@v0.38.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.49.0
▸	HIGH	CVE-2026-56854	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.55.0	25.4%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-56854 (also GO-2026-6303) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N fixed in 0.55.0 epss 25.4% 25.4% percentile (epss 0.00325) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/crypto@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-08-29T02:14:41Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	MEDIUM	CVE-2026-54411	pam	0:1.7.1-160000.3.1		1.7.1-160000.5.1	24.9%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-54411 (also SUSE-SU-2026:22639-1) from os severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N fixed in 1.7.1-160000.5.1 epss 24.9% 24.9% percentile (epss 0.00320) purl pkg:rpm/sles/pam@0:1.7.1-160000.3.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]/usr/lib64/libpam.so.0.85.1 is loaded by /usr/lib64/security/pam_access.so, /usr/lib64/security/pam_canonicalize_user.so, /usr/lib64/security/pam_debug.so, /usr/lib64/security/pam_echo.so, /usr/lib64/security/pam_env.so, /usr/lib64/security/pam_exec.so, /usr/lib64/security/pam_faildelay.so, /usr/lib64/security/pam_faillock.so, /usr/lib64/security/pam_filter.so, /usr/lib64/security/pam_ftp.so, /usr/lib64/security/pam_group.so, /usr/lib64/security/pam_keyinit.so, /usr/lib64/security/pam_listfile.so, /usr/lib64/security/pam_localuser.so, /usr/lib64/security/pam_loginuid.so, /usr/lib64/security/pam_mail.so, /usr/lib64/security/pam_mkhomedir.so, /usr/lib64/security/pam_motd.so, /usr/lib64/security/pam_namespace.so, /usr/lib64/security/pam_nologin.so, /usr/lib64/security/pam_permit.so, /usr/lib64/security/pam_pwhistory.so, /usr/lib64/security/pam_rhosts.so, /usr/lib64/security/pam_rootok.so, /usr/lib64/security/pam_securetty.so, /usr/lib64/security/pam_selinux.so, /usr/lib64/security/pam_sepermit.so, /usr/lib64/security/pam_setquota.so, /usr/lib64/security/pam_shells.so, /usr/lib64/security/pam_stress.so, /usr/lib64/security/pam_succeed_if.so, /usr/lib64/security/pam_time.so, /usr/lib64/security/pam_tty_audit.so, /usr/lib64/security/pam_umask.so, /usr/lib64/security/pam_unix.so, /usr/lib64/security/pam_usertype.so, /usr/lib64/security/pam_warn.so, /usr/lib64/security/pam_wheel.so, /usr/lib64/security/pam_xauth.so [elf-needed-closure]/usr/lib64/security/pam_access.so is PAM module, loaded by name [elf-needed-closure]/usr/lib64/security/pam_canonicalize_user.so is PAM module, loaded by name [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/pam; component is pkg:rpm/sles/pam@0:1.7.1-160000.3.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Container authenticates via certificates/tokens/OIDC; the PAM library is not called at runtime product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-18T04:27:18Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/pam; component is pkg:rpm/sles/pam@0:1.7.1-160000.3.1?arch=x86_64
▸	HIGH	CVE-2026-78662	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.56.0	24.3%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-78662 (also GO-2026-6354) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N fixed in 0.56.0 epss 24.3% 24.3% percentile (epss 0.00315) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/crypto@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-09-03T02:17:13Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	MEDIUM	CVE-2026-56858	stdlib	1.26.3	/usr/bin/harvester-csi-driver	1.26.6	23.6%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-56858 (also GO-2026-6091) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N fixed in 1.26.6 (also fixed in 1.25.13, 1.27.0-rc.3) epss 23.6% 23.6% percentile (epss 0.00310) purl pkg:golang/stdlib@1.26.3 binary /usr/bin/harvester-csi-driver (stripped) packages html/template (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-08-14T03:01:50Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3
▸	MEDIUM	CVE-2026-39827	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.52.0	20.3%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-39827 (also GO-2026-5016) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H fixed in 0.52.0 epss 20.3% 20.3% percentile (epss 0.00279) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh (package) [prefer-vendor]SUSE Security Team rates this MEDIUM (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	MEDIUM	CVE-2025-14525	kubevirt.io/kubevirt	v1.7.0	/usr/bin/harvester-csi-driver	no fix	19.2%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2025-14525 (also GHSA-25mh-hp8x-cgrv) from golang severity MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H epss 19.2% 19.2% percentile (epss 0.00271) purl pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0 binary /usr/bin/harvester-csi-driver (stripped) packages kubevirt.io/kubevirt (module) [prefer-vendor]SUSE Security Team rates this MEDIUM (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/kubevirt.io/kubevirt@v1.4.0; component is pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) This vulnerability is a runtime exploit on live virtual machines with active guest agent running. The kubevirt.io/kubevirt package is a transitive dependency from the github.com/harvester/harvester package, which Harvester components uses only for a handful of Go util functions. product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-07-16T16:54:48Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/kubevirt.io/kubevirt@v1.4.0; component is pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0
▸	MEDIUM	CVE-2026-58055	libnghttp2-14	0:1.64.0-160000.3.1		no fix	16.8%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-58055 (also SUSE-SU-2026:22630-1) from os severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N epss 16.8% 16.8% percentile (epss 0.00253) purl pkg:rpm/sles/libnghttp2-14@0:1.64.0-160000.3.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]libnghttp2-14 installs 1 ELF object (/usr/lib64/libnghttp2.so.14.28.3) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libnghttp2-14; component is pkg:rpm/sles/libnghttp2-14@0:1.64.0-160000.3.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Go CSI driver uses net/http (HTTP/2 in stdlib), not system libnghttp2 product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-08-25T00:44:23Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libnghttp2-14; component is pkg:rpm/sles/libnghttp2-14@0:1.64.0-160000.3.1?arch=x86_64
▸	MEDIUM	CVE-2026-42506	golang.org/x/net	v0.49.0	/usr/bin/harvester-csi-driver	0.55.0	14.6%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-42506 (also GO-2026-5025) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N fixed in 0.55.0 epss 14.6% 14.6% percentile (epss 0.00235) purl pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/net/html (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/net@v0.38.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/net@v0.38.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.49.0
▸	HIGH	CVE-2026-39822	stdlib	1.26.3	/usr/bin/harvester-csi-driver	1.26.5	14.2%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-39822 (also GO-2026-4970) from golang severity HIGH CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H fixed in 1.26.5 (also fixed in 1.25.12, 1.27.0-rc.2) epss 14.2% 14.2% percentile (epss 0.00232) purl pkg:golang/stdlib@1.26.3 binary /usr/bin/harvester-csi-driver (stripped) packages os (package) [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-08-05T05:18:13Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/stdlib@v1.26.3; component is pkg:golang/stdlib@1.26.3
▸	MEDIUM	CVE-2026-27136	golang.org/x/net	v0.49.0	/usr/bin/harvester-csi-driver	0.55.0	13.0%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-27136 (also GO-2026-5030) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N fixed in 0.55.0 epss 13.0% 13.0% percentile (epss 0.00223) purl pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/net/html (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/net@v0.38.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/net@v0.38.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.49.0
▸	MEDIUM	CVE-2026-42502	golang.org/x/net	v0.49.0	/usr/bin/harvester-csi-driver	0.55.0	13.0%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-42502 (also GO-2026-5027) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N fixed in 0.55.0 epss 13.0% 13.0% percentile (epss 0.00223) purl pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/net/html (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/net@v0.38.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/net@v0.38.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.49.0
▸	MEDIUM	CVE-2026-25681	golang.org/x/net	v0.49.0	/usr/bin/harvester-csi-driver	0.55.0	13.0%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-25681 (also GO-2026-5029) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N fixed in 0.55.0 epss 13.0% 13.0% percentile (epss 0.00223) purl pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/net/html (package) [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/golang.org/x/net@v0.38.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.49.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/net@v0.38.0; component is pkg:golang/golang.org%2Fx%2Fnet@v0.49.0
▸	HIGH	SUSE-SU-2026:22821-1	vim	0:9.2.0530-160000.1.1		9.2.0780-160000.1.1	12.1%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22821-1 fixes CVE-2026-59856, CVE-2026-59857, CVE-2026-59858 from os severity HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H fixed in 9.2.0780-160000.1.1 epss 12.1% 12.1% percentile (epss 0.00216) for CVE-2026-59856, highest of 3 purl pkg:rpm/sles/vim@0:9.2.0530-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]vim installs 3 ELF objects (/usr/bin/alts, /usr/bin/vim-nox11, ...) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/vim; component is pkg:rpm/sles/vim@0:9.2.0530-160000.1.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) vim/vi is not executed at runtime; it is an incidental SLES base-image dependency product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-29T01:22:06Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/vim; component is pkg:rpm/sles/vim@0:9.2.0530-160000.1.1?arch=x86_64
▸	HIGH	SUSE-SU-2026:22821-1	xxd	0:9.2.0530-160000.1.1		no fix	12.1%	not_affected	vulnerable_code_not_in_execute_path
advisory SUSE-SU-2026:22821-1 fixes CVE-2026-59856, CVE-2026-59857, CVE-2026-59858 from os severity HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H epss 12.1% 12.1% percentile (epss 0.00216) for CVE-2026-59856, highest of 3 purl pkg:rpm/sles/xxd@0:9.2.0530-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]xxd installs 1 ELF object (/usr/bin/xxd) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/xxd; component is pkg:rpm/sles/xxd@0:9.2.0530-160000.1.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) xxd hex utility is not invoked by the Go-based Harvester CSI driver product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-29T01:22:06Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/xxd; component is pkg:rpm/sles/xxd@0:9.2.0530-160000.1.1?arch=x86_64
▸	HIGH	CVE-2026-41991	gzip	0:1.13-160000.2.2		1.13-160000.3.1	8.4%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-41991 (also SUSE-SU-2026:22818-1) from os severity HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H fixed in 1.13-160000.3.1 epss 8.4% 8.4% percentile (epss 0.00186) purl pkg:rpm/sles/gzip@0:1.13-160000.2.2?arch=x86_64 method elf-needed-closure [elf-needed-closure]gzip installs 1 ELF object (/usr/bin/gzip) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/gzip; component is pkg:rpm/sles/gzip@0:1.13-160000.2.2?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Go CSI driver; gzip CLI binary not invoked at runtime product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-29T04:40:43Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/gzip; component is pkg:rpm/sles/gzip@0:1.13-160000.2.2?arch=x86_64
▸	MEDIUM	CVE-2026-6383	kubevirt.io/kubevirt	v1.7.0	/usr/bin/harvester-csi-driver	no fix	4.5%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-6383 (also GHSA-j6cv-3w8p-vrg8) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N epss 4.5% 4.5% percentile (epss 0.00150) purl pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0 binary /usr/bin/harvester-csi-driver (stripped) packages kubevirt.io/kubevirt (module) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:golang/kubevirt.io/kubevirt@v1.4.0; component is pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Harvester components have no dependency on the virt-api component for RBAC authorization enforcement. The kubevirt.io/kubevirt package is a transitive dependency from the github.com/harvester/harvester package, which Harvester components uses for a handful of Go util functions. product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-07-16T16:54:48Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/kubevirt.io/kubevirt@v1.4.0; component is pkg:golang/kubevirt.io%2Fkubevirt@v1.7.0
▸	MEDIUM	CVE-2026-27456	libuuid1	0:2.41.1-160000.3.1		no fix	1.9%	not_affected	vulnerable_code_not_in_execute_path
advisory CVE-2026-27456 (also SUSE-SU-2026:22332-1) from os severity MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N epss 1.9% 1.9% percentile (epss 0.00118) purl pkg:rpm/sles/libuuid1@0:2.41.1-160000.3.1?arch=x86_64 method elf-needed-closure [elf-needed-closure]/usr/lib64/libuuid.so.1.3.0 is loaded by /usr/lib64/python3.13/lib-dynload/_uuid.cpython-313-x86_64-linux-gnu.so [elf-needed-closure]blocking/usr/bin/harvester-csi-driver is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure]blocking/usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure]blocking/usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libuuid1; component is pkg:rpm/sles/libuuid1@0:2.41.1-160000.3.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Go CSI driver uses pure-Go uuid generation, libuuid C library never invoked product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-08-27T05:12:25Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libuuid1; component is pkg:rpm/sles/libuuid1@0:2.41.1-160000.3.1?arch=x86_64

RULED OUT(14) — the vulnerable code is not present or cannot run

	Severity	Advisory	Package	Version	Location	Fixed in	EPSS	Method
▸	HIGH	CVE-2026-42508	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.52.0	94.0%	pclntab
advisory CVE-2026-42508 (also GO-2026-5021) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N fixed in 0.52.0 epss 94.0% 94.0% percentile (epss 0.07314) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh/knownhosts (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of CRITICAL (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-08-15T02:25:54Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.47.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	HIGH	CVE-2026-39832	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.52.0	46.9%	pclntab
advisory CVE-2026-39832 (also GO-2026-5006) from golang severity HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N fixed in 0.52.0 epss 46.9% 46.9% percentile (epss 0.00600) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh/agent (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of CRITICAL (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-08-12T03:01:44Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	MEDIUM	SUSE-SU-2026:22948-1	libssh-config	0:0.11.4-160000.1.1		no fix	45.3%	pkgdb-no-code
advisory SUSE-SU-2026:22948-1 fixes CVE-2026-15370, CVE-2026-59843, CVE-2026-59844, CVE-2026-59845, CVE-2026-59846 (+4 more) from os severity MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H epss 45.3% 45.3% percentile (epss 0.00567) for CVE-2026-59843, highest of 9 purl pkg:rpm/sles/libssh-config@0:0.11.4-160000.1.1?arch=noarch vex vulnerable_code_not_present [pkgdb-no-code] [pkgdb-no-code]libssh-config installs 3 files and none of them is an ELF object [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libssh-config; component is pkg:rpm/sles/libssh-config@0:0.11.4-160000.1.1?arch=noarch Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Go uses crypto/ssh; the system libssh C library is not called at runtime product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-30T03:00:01Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libssh-config; component is pkg:rpm/sles/libssh-config@0:0.11.4-160000.1.1?arch=noarch
▸	MEDIUM	SUSE-SU-2026:22956-1	libssh-config	0:0.11.4-160000.1.1		no fix	45.3%	pkgdb-no-code
advisory SUSE-SU-2026:22956-1 fixes CVE-2026-15370, CVE-2026-59843, CVE-2026-59844, CVE-2026-59845, CVE-2026-59846 (+4 more) from os severity MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H epss 45.3% 45.3% percentile (epss 0.00567) for CVE-2026-59843, highest of 9 purl pkg:rpm/sles/libssh-config@0:0.11.4-160000.1.1?arch=noarch vex vulnerable_code_not_present [pkgdb-no-code] [pkgdb-no-code]libssh-config installs 3 files and none of them is an ELF object [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/libssh-config; component is pkg:rpm/sles/libssh-config@0:0.11.4-160000.1.1?arch=noarch Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Go uses crypto/ssh; the system libssh C library is not called at runtime product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-30T03:00:01Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/libssh-config; component is pkg:rpm/sles/libssh-config@0:0.11.4-160000.1.1?arch=noarch
▸	MEDIUM	CVE-2025-69720	terminfo-base	0:6.5.20250531-160000.2.2		no fix	37.8%	pkgdb-no-code
advisory CVE-2025-69720 (also SUSE-SU-2026:22294-1) from os severity MEDIUM CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L epss 37.8% 37.8% percentile (epss 0.00447) purl pkg:rpm/sles/terminfo-base@0:6.5.20250531-160000.2.2?arch=x86_64 vex vulnerable_code_not_present [pkgdb-no-code] [pkgdb-no-code]terminfo-base installs 104 files and none of them is an ELF object [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/terminfo-base; component is pkg:rpm/sles/terminfo-base@0:6.5.20250531-160000.2.2?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) Container runs as a daemon without interactive terminal; ncurses is not in the execute path product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-05T00:42:58Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/terminfo-base; component is pkg:rpm/sles/terminfo-base@0:6.5.20250531-160000.2.2?arch=x86_64
▸	HIGH	CVE-2026-46598	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.52.0	34.7%	pclntab
advisory CVE-2026-46598 (also GO-2026-5033) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 0.52.0 epss 34.7% 34.7% percentile (epss 0.00412) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh/agent (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of MEDIUM (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	HIGH	CVE-2026-39833	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	0.52.0	34.7%	pclntab
advisory CVE-2026-39833 (also GO-2026-5005) from golang severity HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N fixed in 0.52.0 epss 34.7% 34.7% percentile (epss 0.00412) purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/ssh/agent (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of CRITICAL (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-08-12T03:01:44Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/crypto@v0.36.0; component is pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0
▸	MEDIUM	CVE-2026-41178	go.opentelemetry.io/otel	v1.41.0	/usr/bin/harvester-csi-driver	1.42.0	26.6%	pclntab
advisory CVE-2026-41178 (also GO-2026-5158) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L fixed in 1.42.0 (also fixed in 1.44.0) epss 26.6% 26.6% percentile (epss 0.00336) purl pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0 binary /usr/bin/harvester-csi-driver (stripped) packages go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_present); statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-07-25T03:22:08Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/go.opentelemetry.io/otel@v1.41.0; component is pkg:golang/go.opentelemetry.io%2Fotel@v1.41.0
▸	MEDIUM	CVE-2026-56858	stdlib	1.25.10	/usr/bin/container-suseconnect	1.25.13	23.6%	pclntab
advisory CVE-2026-56858 (also GO-2026-6091) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 23.6% 23.6% percentile (epss 0.00310) purl pkg:golang/stdlib@1.25.10 binary /usr/bin/container-suseconnect (stripped) packages html/template (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
▸	MEDIUM	CVE-2026-56864	golang.org/x/mod	v0.32.0	/usr/bin/harvester-csi-driver	0.40.0	22.3%	pclntab
advisory CVE-2026-56864 (also GO-2026-6180) from golang severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N fixed in 0.40.0 epss 22.3% 22.3% percentile (epss 0.00298) purl pkg:golang/golang.org%2Fx%2Fmod@v0.32.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/mod/sumdb (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/mod@v0.32.0; component is pkg:golang/golang.org%2Fx%2Fmod@v0.32.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-08-14T02:59:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/mod@v0.32.0; component is pkg:golang/golang.org%2Fx%2Fmod@v0.32.0
▸	HIGH	SUSE-SU-2026:22821-1	vim-data-common	0:9.2.0530-160000.1.1		no fix	12.1%	pkgdb-no-code
advisory SUSE-SU-2026:22821-1 fixes CVE-2026-59856, CVE-2026-59857, CVE-2026-59858 from os severity HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H epss 12.1% 12.1% percentile (epss 0.00216) for CVE-2026-59856, highest of 3 purl pkg:rpm/sles/vim-data-common@0:9.2.0530-160000.1.1?arch=noarch vex vulnerable_code_not_present [pkgdb-no-code] [pkgdb-no-code]vim-data-common installs 35 files and none of them is an ELF object [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/vim-data-common; component is pkg:rpm/sles/vim-data-common@0:9.2.0530-160000.1.1?arch=noarch Rancher Security team says not_affected (vulnerable_code_not_in_execute_path) vim/vi is not executed at runtime; it is an incidental SLES base-image dependency product `pkg:oci/harvester-csi-driver?repository_url=registry.rancher.com/rancher/harvester-csi-driver` · published 2026-07-29T01:22:06Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:rpm/suse/vim-data-common; component is pkg:rpm/sles/vim-data-common@0:9.2.0530-160000.1.1?arch=noarch
▸	UNKNOWN	CVE-2026-39824	golang.org/x/sys	v0.40.0	/usr/bin/harvester-csi-driver	0.44.0	1.7%	pclntab
advisory CVE-2026-39824 (also GO-2026-5024) from golang fixed in 0.44.0 epss 1.7% 1.7% percentile (epss 0.00114) purl pkg:golang/golang.org%2Fx%2Fsys@v0.40.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/sys/windows (package) vex vulnerable_code_not_present [pclntab] [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/sys@v0.31.0; component is pkg:golang/golang.org%2Fx%2Fsys@v0.40.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-06-19T00:00:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/sys@v0.31.0; component is pkg:golang/golang.org%2Fx%2Fsys@v0.40.0
▸	HIGH	CVE-2026-56865	golang.org/x/mod	v0.32.0	/usr/bin/harvester-csi-driver	0.40.0	1.3%	pclntab
advisory CVE-2026-56865 (also GO-2026-6179) from golang severity HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H fixed in 0.40.0 epss 1.3% 1.3% percentile (epss 0.00107) purl pkg:golang/golang.org%2Fx%2Fmod@v0.32.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/mod/sumdb/tlog (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor]SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex]Rancher Security team published not_affected for pkg:golang/github.com/harvester/harvester-csi-driver (vulnerable_code_not_present); statement names pkg:golang/golang.org/x/mod@v0.32.0; component is pkg:golang/golang.org%2Fx%2Fmod@v0.32.0 Rancher Security team says not_affected (vulnerable_code_not_present) Govulncheck determined that the vulnerable code isn't called product `pkg:golang/github.com/harvester/harvester-csi-driver` · published 2026-08-14T02:59:00Z · from https://github.com/rancher/vexhub matched loosely: statement names pkg:golang/golang.org/x/mod@v0.32.0; component is pkg:golang/golang.org%2Fx%2Fmod@v0.32.0
▸	UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.47.0	/usr/bin/harvester-csi-driver	no fix	—	pclntab
advisory GO-2026-5932 from golang epss not scored — this advisory has no CVE id, and both feeds are keyed by CVE purl pkg:golang/golang.org%2Fx%2Fcrypto@v0.47.0 binary /usr/bin/harvester-csi-driver (stripped) packages golang.org/x/crypto/openpgp, golang.org/x/crypto/openpgp/armor, golang.org/x/crypto/openpgp/clearsign, golang.org/x/crypto/openpgp/elgamal, golang.org/x/crypto/openpgp/errors, golang.org/x/crypto/openpgp/packet, golang.org/x/crypto/openpgp/s2k (package) vex vulnerable_code_not_present [pclntab]

Scan coverage#

Ecosystem	Components	Affected	Vexed	Ruled out	Status
`golang`	145	26	33	10	ok
`os`	162	22	23	4	ok
`pypi`	0	0	0	0	ok

VEX hubs#

Hub	Author	Indexes	Matched	Status
https://github.com/rancher/vexhub	Rancher Security team	1168	68	ok

Triage: scored 108, 0 known exploited, 1 not in the EPSS feed, 9 with no CVE id to look up. Feeds as of EPSS 2026-09-14; KEV 2026.09.14.