{
  "apiVersion": "v1",
  "resource": "security",
  "slug": "actions-runner",
  "image": "ghcr.io/quenchworks/images/actions-runner",
  "source": "QuenchWorks nightly Trivy scan (each published image digest)",
  "latest": {
    "version": "2.338.0",
    "tag": "ghcr.io/quenchworks/images/actions-runner:2.338.0",
    "critical": 3,
    "high": 38,
    "medium": 15,
    "low": 1,
    "unknown": 0,
    "total": 57,
    "fixable": 57,
    "grade": "F",
    "score": 0,
    "cves": [
      {
        "id": "CVE-2026-111497",
        "severity": "CRITICAL",
        "pkg": "libbrotlicommon1",
        "installed": "1.2.0-r5",
        "fixed": "1.2.0-r7",
        "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder",
        "url": "https://avd.aquasec.com/nvd/cve-2026-111497",
        "targets": [
          "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
        ]
      },
      {
        "id": "CVE-2026-111497",
        "severity": "CRITICAL",
        "pkg": "libbrotlidec1",
        "installed": "1.2.0-r5",
        "fixed": "1.2.0-r7",
        "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder",
        "url": "https://avd.aquasec.com/nvd/cve-2026-111497",
        "targets": [
          "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
        ]
      },
      {
        "id": "CVE-2026-111497",
        "severity": "CRITICAL",
        "pkg": "libbrotlienc1",
        "installed": "1.2.0-r5",
        "fixed": "1.2.0-r7",
        "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder",
        "url": "https://avd.aquasec.com/nvd/cve-2026-111497",
        "targets": [
          "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
        ]
      },
      {
        "id": "CVE-2026-105482",
        "severity": "HIGH",
        "pkg": "nodejs-24",
        "installed": "24.21.0-r4",
        "fixed": "24.22.1-r0",
        "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character",
        "url": "https://avd.aquasec.com/nvd/cve-2026-105482",
        "targets": [
          "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
        ]
      },
      {
        "id": "CVE-2026-105483",
        "severity": "HIGH",
        "pkg": "nodejs-24",
        "installed": "24.21.0-r4",
        "fixed": "24.22.1-r0",
        "title": "nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames",
        "url": "https://avd.aquasec.com/nvd/cve-2026-105483",
        "targets": [
          "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
        ]
      },
      {
        "id": "CVE-2026-106069",
        "severity": "HIGH",
        "pkg": "nodejs-24",
        "installed": "24.21.0-r4",
        "fixed": "24.22.1-r0",
        "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames",
        "url": "https://avd.aquasec.com/nvd/cve-2026-106069",
        "targets": [
          "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
        ]
      },
      {
        "id": "CVE-2026-111943",
        "severity": "HIGH",
        "pkg": "ca-certificates-bundle",
        "installed": "20260909-r2",
        "fixed": "20260909-r3",
        "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates",
        "url": "https://avd.aquasec.com/nvd/cve-2026-111943",
        "targets": [
          "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
        ]
      },
      {
        "id": "CVE-2026-58280",
        "severity": "HIGH",
        "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
        "installed": "8.0.31",
        "fixed": "9.0.21, 8.0.32, 10.0.13, 11.0.0-rc.2",
        "title": "dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability",
        "url": "https://avd.aquasec.com/nvd/cve-2026-58280",
        "targets": [
          "home/runner/bin/Runner.Listener.deps.json",
          "home/runner/bin/Runner.PluginHost.deps.json",
          "home/runner/bin/Runner.Plugins.deps.json",
          "home/runner/bin/Runner.Sdk.deps.json",
          "home/runner/bin/Runner.Worker.deps.json"
        ]
      },
      {
        "id": "CVE-2026-69651",
        "severity": "HIGH",
        "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
        "installed": "8.0.31",
        "fixed": "9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32",
        "title": "dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability",
        "url": "https://avd.aquasec.com/nvd/cve-2026-69651",
        "targets": [
          "home/runner/bin/Runner.Listener.deps.json",
          "home/runner/bin/Runner.PluginHost.deps.json",
          "home/runner/bin/Runner.Plugins.deps.json",
          "home/runner/bin/Runner.Sdk.deps.json",
          "home/runner/bin/Runner.Worker.deps.json"
        ]
      },
      {
        "id": "CVE-2026-84008",
        "severity": "HIGH",
        "pkg": "System.Security.Cryptography.Pkcs",
        "installed": "10.0.12",
        "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21",
        "title": "dotnet: .NET Denial of Service Vulnerability",
        "url": "https://avd.aquasec.com/nvd/cve-2026-84008",
        "targets": [
          "home/runner/bin/Runner.Common.deps.json",
          "home/runner/bin/Runner.Listener.deps.json",
          "home/runner/bin/Runner.PluginHost.deps.json",
          "home/runner/bin/Runner.Plugins.deps.json",
          "home/runner/bin/Runner.Sdk.deps.json",
          "home/runner/bin/Runner.Worker.deps.json",
          "home/runner/bin/Sdk.deps.json"
        ]
      },
      {
        "id": "CVE-2026-92392",
        "severity": "HIGH",
        "pkg": "curl",
        "installed": "8.22.0-r4",
        "fixed": "8.23.0-r0",
        "title": "curl: curl: HTTP/2 upload Use-After-Free",
        "url": "https://avd.aquasec.com/nvd/cve-2026-92392",
        "targets": [
          "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
        ]
      },
      {
        "id": "CVE-2026-92392",
        "severity": "HIGH",
        "pkg": "libcurl-openssl4",
        "installed": "8.22.0-r4",
        "fixed": "8.23.0-r0",
        "title": "curl: curl: HTTP/2 upload Use-After-Free",
        "url": "https://avd.aquasec.com/nvd/cve-2026-92392",
        "targets": [
          "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
        ]
      },
      {
        "id": "CVE-2026-96225",
        "severity": "HIGH",
        "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
        "installed": "8.0.31",
        "fixed": "8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21",
        "title": "dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability",
        "url": "https://avd.aquasec.com/nvd/cve-2026-96225",
        "targets": [
          "home/runner/bin/Runner.Listener.deps.json",
          "home/runner/bin/Runner.PluginHost.deps.json",
          "home/runner/bin/Runner.Plugins.deps.json",
          "home/runner/bin/Runner.Sdk.deps.json",
          "home/runner/bin/Runner.Worker.deps.json"
        ]
      },
      {
        "id": "CVE-2026-96231",
        "severity": "HIGH",
        "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
        "installed": "8.0.31",
        "fixed": "8.0.32, 10.0.13, 9.0.21, 11.0.0-rc.2",
        "title": "dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability",
        "url": "https://avd.aquasec.com/nvd/cve-2026-96231",
        "targets": [
          "home/runner/bin/Runner.Listener.deps.json",
          "home/runner/bin/Runner.PluginHost.deps.json",
          "home/runner/bin/Runner.Plugins.deps.json",
          "home/runner/bin/Runner.Sdk.deps.json",
          "home/runner/bin/Runner.Worker.deps.json"
        ]
      },
      {
        "id": "CVE-2026-96233",
        "severity": "HIGH",
        "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
        "installed": "8.0.31",
        "fixed": "10.0.13, 11.0.0-rc.2, 9.0.21, 8.0.32",
        "title": "dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability",
        "url": "https://avd.aquasec.com/nvd/cve-2026-96233",
        "targets": [
          "home/runner/bin/Runner.Listener.deps.json",
          "home/runner/bin/Runner.PluginHost.deps.json",
          "home/runner/bin/Runner.Plugins.deps.json",
          "home/runner/bin/Runner.Sdk.deps.json",
          "home/runner/bin/Runner.Worker.deps.json"
        ]
      },
      {
        "id": "CVE-2026-105481",
        "severity": "MEDIUM",
        "pkg": "nodejs-24",
        "installed": "24.21.0-r4",
        "fixed": "24.22.1-r0",
        "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse",
        "url": "https://avd.aquasec.com/nvd/cve-2026-105481",
        "targets": [
          "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
        ]
      },
      {
        "id": "CVE-2026-106072",
        "severity": "MEDIUM",
        "pkg": "nodejs-24",
        "installed": "24.21.0-r4",
        "fixed": "24.22.1-r0",
        "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification",
        "url": "https://avd.aquasec.com/nvd/cve-2026-106072",
        "targets": [
          "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
        ]
      },
      {
        "id": "CVE-2026-106074",
        "severity": "MEDIUM",
        "pkg": "nodejs-24",
        "installed": "24.21.0-r4",
        "fixed": "24.22.1-r0",
        "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse",
        "url": "https://avd.aquasec.com/nvd/cve-2026-106074",
        "targets": [
          "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
        ]
      },
      {
        "id": "CVE-2026-66822",
        "severity": "MEDIUM",
        "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
        "installed": "8.0.31",
        "fixed": "9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32",
        "title": "dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability",
        "url": "https://avd.aquasec.com/nvd/cve-2026-66822",
        "targets": [
          "home/runner/bin/Runner.Listener.deps.json",
          "home/runner/bin/Runner.PluginHost.deps.json",
          "home/runner/bin/Runner.Plugins.deps.json",
          "home/runner/bin/Runner.Sdk.deps.json",
          "home/runner/bin/Runner.Worker.deps.json"
        ]
      },
      {
        "id": "CVE-2026-70162",
        "severity": "MEDIUM",
        "pkg": "System.Security.Cryptography.Pkcs",
        "installed": "10.0.12",
        "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21",
        "title": "dotnet: dotnet: Denial of Service via specially crafted web requests",
        "url": "https://avd.aquasec.com/nvd/cve-2026-70162",
        "targets": [
          "home/runner/bin/Runner.Common.deps.json",
          "home/runner/bin/Runner.Listener.deps.json",
          "home/runner/bin/Runner.PluginHost.deps.json",
          "home/runner/bin/Runner.Plugins.deps.json",
          "home/runner/bin/Runner.Sdk.deps.json",
          "home/runner/bin/Runner.Worker.deps.json",
          "home/runner/bin/Sdk.deps.json"
        ]
      },
      {
        "id": "CVE-2026-106073",
        "severity": "LOW",
        "pkg": "nodejs-24",
        "installed": "24.21.0-r4",
        "fixed": "24.22.1-r0",
        "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()",
        "url": "https://avd.aquasec.com/nvd/cve-2026-106073",
        "targets": [
          "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
        ]
      }
    ]
  },
  "versions": [
    {
      "version": "2.338.0",
      "tag": "ghcr.io/quenchworks/images/actions-runner:2.338.0",
      "critical": 3,
      "high": 38,
      "medium": 15,
      "low": 1,
      "unknown": 0,
      "total": 57,
      "fixable": 57,
      "grade": "F",
      "score": 0,
      "cves": [
        {
          "id": "CVE-2026-111497",
          "severity": "CRITICAL",
          "pkg": "libbrotlicommon1",
          "installed": "1.2.0-r5",
          "fixed": "1.2.0-r7",
          "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder",
          "url": "https://avd.aquasec.com/nvd/cve-2026-111497",
          "targets": [
            "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
          ]
        },
        {
          "id": "CVE-2026-111497",
          "severity": "CRITICAL",
          "pkg": "libbrotlidec1",
          "installed": "1.2.0-r5",
          "fixed": "1.2.0-r7",
          "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder",
          "url": "https://avd.aquasec.com/nvd/cve-2026-111497",
          "targets": [
            "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
          ]
        },
        {
          "id": "CVE-2026-111497",
          "severity": "CRITICAL",
          "pkg": "libbrotlienc1",
          "installed": "1.2.0-r5",
          "fixed": "1.2.0-r7",
          "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder",
          "url": "https://avd.aquasec.com/nvd/cve-2026-111497",
          "targets": [
            "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
          ]
        },
        {
          "id": "CVE-2026-105482",
          "severity": "HIGH",
          "pkg": "nodejs-24",
          "installed": "24.21.0-r4",
          "fixed": "24.22.1-r0",
          "title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character",
          "url": "https://avd.aquasec.com/nvd/cve-2026-105482",
          "targets": [
            "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
          ]
        },
        {
          "id": "CVE-2026-105483",
          "severity": "HIGH",
          "pkg": "nodejs-24",
          "installed": "24.21.0-r4",
          "fixed": "24.22.1-r0",
          "title": "nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames",
          "url": "https://avd.aquasec.com/nvd/cve-2026-105483",
          "targets": [
            "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
          ]
        },
        {
          "id": "CVE-2026-106069",
          "severity": "HIGH",
          "pkg": "nodejs-24",
          "installed": "24.21.0-r4",
          "fixed": "24.22.1-r0",
          "title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames",
          "url": "https://avd.aquasec.com/nvd/cve-2026-106069",
          "targets": [
            "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
          ]
        },
        {
          "id": "CVE-2026-111943",
          "severity": "HIGH",
          "pkg": "ca-certificates-bundle",
          "installed": "20260909-r2",
          "fixed": "20260909-r3",
          "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates",
          "url": "https://avd.aquasec.com/nvd/cve-2026-111943",
          "targets": [
            "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
          ]
        },
        {
          "id": "CVE-2026-58280",
          "severity": "HIGH",
          "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
          "installed": "8.0.31",
          "fixed": "9.0.21, 8.0.32, 10.0.13, 11.0.0-rc.2",
          "title": "dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability",
          "url": "https://avd.aquasec.com/nvd/cve-2026-58280",
          "targets": [
            "home/runner/bin/Runner.Listener.deps.json",
            "home/runner/bin/Runner.PluginHost.deps.json",
            "home/runner/bin/Runner.Plugins.deps.json",
            "home/runner/bin/Runner.Sdk.deps.json",
            "home/runner/bin/Runner.Worker.deps.json"
          ]
        },
        {
          "id": "CVE-2026-69651",
          "severity": "HIGH",
          "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
          "installed": "8.0.31",
          "fixed": "9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32",
          "title": "dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69651",
          "targets": [
            "home/runner/bin/Runner.Listener.deps.json",
            "home/runner/bin/Runner.PluginHost.deps.json",
            "home/runner/bin/Runner.Plugins.deps.json",
            "home/runner/bin/Runner.Sdk.deps.json",
            "home/runner/bin/Runner.Worker.deps.json"
          ]
        },
        {
          "id": "CVE-2026-84008",
          "severity": "HIGH",
          "pkg": "System.Security.Cryptography.Pkcs",
          "installed": "10.0.12",
          "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21",
          "title": "dotnet: .NET Denial of Service Vulnerability",
          "url": "https://avd.aquasec.com/nvd/cve-2026-84008",
          "targets": [
            "home/runner/bin/Runner.Common.deps.json",
            "home/runner/bin/Runner.Listener.deps.json",
            "home/runner/bin/Runner.PluginHost.deps.json",
            "home/runner/bin/Runner.Plugins.deps.json",
            "home/runner/bin/Runner.Sdk.deps.json",
            "home/runner/bin/Runner.Worker.deps.json",
            "home/runner/bin/Sdk.deps.json"
          ]
        },
        {
          "id": "CVE-2026-92392",
          "severity": "HIGH",
          "pkg": "curl",
          "installed": "8.22.0-r4",
          "fixed": "8.23.0-r0",
          "title": "curl: curl: HTTP/2 upload Use-After-Free",
          "url": "https://avd.aquasec.com/nvd/cve-2026-92392",
          "targets": [
            "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
          ]
        },
        {
          "id": "CVE-2026-92392",
          "severity": "HIGH",
          "pkg": "libcurl-openssl4",
          "installed": "8.22.0-r4",
          "fixed": "8.23.0-r0",
          "title": "curl: curl: HTTP/2 upload Use-After-Free",
          "url": "https://avd.aquasec.com/nvd/cve-2026-92392",
          "targets": [
            "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
          ]
        },
        {
          "id": "CVE-2026-96225",
          "severity": "HIGH",
          "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
          "installed": "8.0.31",
          "fixed": "8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21",
          "title": "dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability",
          "url": "https://avd.aquasec.com/nvd/cve-2026-96225",
          "targets": [
            "home/runner/bin/Runner.Listener.deps.json",
            "home/runner/bin/Runner.PluginHost.deps.json",
            "home/runner/bin/Runner.Plugins.deps.json",
            "home/runner/bin/Runner.Sdk.deps.json",
            "home/runner/bin/Runner.Worker.deps.json"
          ]
        },
        {
          "id": "CVE-2026-96231",
          "severity": "HIGH",
          "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
          "installed": "8.0.31",
          "fixed": "8.0.32, 10.0.13, 9.0.21, 11.0.0-rc.2",
          "title": "dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability",
          "url": "https://avd.aquasec.com/nvd/cve-2026-96231",
          "targets": [
            "home/runner/bin/Runner.Listener.deps.json",
            "home/runner/bin/Runner.PluginHost.deps.json",
            "home/runner/bin/Runner.Plugins.deps.json",
            "home/runner/bin/Runner.Sdk.deps.json",
            "home/runner/bin/Runner.Worker.deps.json"
          ]
        },
        {
          "id": "CVE-2026-96233",
          "severity": "HIGH",
          "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
          "installed": "8.0.31",
          "fixed": "10.0.13, 11.0.0-rc.2, 9.0.21, 8.0.32",
          "title": "dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability",
          "url": "https://avd.aquasec.com/nvd/cve-2026-96233",
          "targets": [
            "home/runner/bin/Runner.Listener.deps.json",
            "home/runner/bin/Runner.PluginHost.deps.json",
            "home/runner/bin/Runner.Plugins.deps.json",
            "home/runner/bin/Runner.Sdk.deps.json",
            "home/runner/bin/Runner.Worker.deps.json"
          ]
        },
        {
          "id": "CVE-2026-105481",
          "severity": "MEDIUM",
          "pkg": "nodejs-24",
          "installed": "24.21.0-r4",
          "fixed": "24.22.1-r0",
          "title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse",
          "url": "https://avd.aquasec.com/nvd/cve-2026-105481",
          "targets": [
            "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
          ]
        },
        {
          "id": "CVE-2026-106072",
          "severity": "MEDIUM",
          "pkg": "nodejs-24",
          "installed": "24.21.0-r4",
          "fixed": "24.22.1-r0",
          "title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-106072",
          "targets": [
            "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
          ]
        },
        {
          "id": "CVE-2026-106074",
          "severity": "MEDIUM",
          "pkg": "nodejs-24",
          "installed": "24.21.0-r4",
          "fixed": "24.22.1-r0",
          "title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse",
          "url": "https://avd.aquasec.com/nvd/cve-2026-106074",
          "targets": [
            "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
          ]
        },
        {
          "id": "CVE-2026-66822",
          "severity": "MEDIUM",
          "pkg": "Microsoft.NETCore.App.Runtime.linux-x64",
          "installed": "8.0.31",
          "fixed": "9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32",
          "title": "dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66822",
          "targets": [
            "home/runner/bin/Runner.Listener.deps.json",
            "home/runner/bin/Runner.PluginHost.deps.json",
            "home/runner/bin/Runner.Plugins.deps.json",
            "home/runner/bin/Runner.Sdk.deps.json",
            "home/runner/bin/Runner.Worker.deps.json"
          ]
        },
        {
          "id": "CVE-2026-70162",
          "severity": "MEDIUM",
          "pkg": "System.Security.Cryptography.Pkcs",
          "installed": "10.0.12",
          "fixed": "10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21",
          "title": "dotnet: dotnet: Denial of Service via specially crafted web requests",
          "url": "https://avd.aquasec.com/nvd/cve-2026-70162",
          "targets": [
            "home/runner/bin/Runner.Common.deps.json",
            "home/runner/bin/Runner.Listener.deps.json",
            "home/runner/bin/Runner.PluginHost.deps.json",
            "home/runner/bin/Runner.Plugins.deps.json",
            "home/runner/bin/Runner.Sdk.deps.json",
            "home/runner/bin/Runner.Worker.deps.json",
            "home/runner/bin/Sdk.deps.json"
          ]
        },
        {
          "id": "CVE-2026-106073",
          "severity": "LOW",
          "pkg": "nodejs-24",
          "installed": "24.21.0-r4",
          "fixed": "24.22.1-r0",
          "title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()",
          "url": "https://avd.aquasec.com/nvd/cve-2026-106073",
          "targets": [
            "ghcr.io/quenchworks/images/actions-runner@sha256:2a5ae2830fe80c10a5bc31453c63e7568c847bb9b6c887af259b8308a9b5e6e1 (wolfi 20230201)"
          ]
        }
      ]
    }
  ]
}