What the free CVE snapshot looks like

Run on TactiQ OS v2.1.0-rc14, an open Yocto-based image for the Rock 5A board. Your snapshot has the same three parts. Every number below can be rechecked from public files.

What we analysed

The full list of 81 is in the appendix. All three release files match the checksums in the release's SHA256SUMS. Scope: packages actually installed in the image (295 packages from 82 recipes), not everything the build system touched.

Known CVEs in the image

Exploited in the wild

None of the open vulnerabilities in this image appears in the KEV catalog of 10 November 2026. KEV is the closest public signal for what EU CRA Article 14 makes reportable within 24 hours. On this image, that signal is clear today. It has to be rechecked every time the catalog changes, which is what monitoring does.

Five to fix first

Ordered by exposure on this device, not by score alone: what an attacker can reach over the network comes before local issues. Where the CVE record gives a fixed version, we name it.

1. curl 8.19.0: ten high, three at 9.8

   All network-reachable, among them an HTTP/2 use-after-free (CVE-2026-10536) and Digest authentication state leaking across origins (CVE-2026-11856). Fixed in 8.20.1. This device is meant to run offline and nothing on it needs an HTTP client, so the better fix is to take curl out of the image.

   remove from image, or update to 8.20.1

2. libssh 0.11.5: four high, one authentication bypass

   CVE-2026-59851 (8.8, network) is an authentication bypass through a missing GSSAPI principal check. The CVE records give no fixed version for this release yet. The production image has no SSH service, so the library is unused weight.

   remove from image

3. Linux kernel 6.18.52: thirteen network-reachable high

   The top one is CVE-2026-72493 (9.9) in the network receive path, fixed in 6.18.57. Moving to 6.18.61 closes five of the six network issues that have a known fix; the sixth, CVE-2026-64160, is fixed only in 7.1. Seven more network issues carry no version data and need a review each.

   update to 6.18.61, review the seven by hand

4. glibc 2.43: CVE-2026-5450 at 9.8

   A heap overflow in scanf with %mc. The CVE record lists every version from 2.7 on as affected and names no fixed release. Four more network issues sit in the same library, one in DNS response handling (CVE-2026-4437).

   backport the upstream fix, track the release

5. expat 2.8.3: four high, three network-reachable

   Expat parses XML that can come from outside. 2.8.4 closes two of the four (CVE-2026-76956, CVE-2026-76957). The other two have no fixed release yet.

   update to 2.8.4, track the other two

What this snapshot does not cover

• Userspace was checked against the CVE databases pinned by the build, dated 11 September 2026. Issues published later are not in these numbers.
• Dependencies of the two Rust components were not checked.
• 22 of the 81 have no version ranges in their records. They are counted as open until someone reviews each one.
• CVE-2016-7545 appears in four SELinux packages and is counted four times.

The snapshot changed the image

The first two fixes were not patches. The report showed network clients in an image meant to run offline: curl and libssh had come in through default build options of other packages. Both were removed in the public repository (PR #261, PR #265), Together they account for fourteen of the 81 high issues. The snapshot of the next release will show whether the count drops by that much.

All 81 high vulnerabilities

Every row links to its CVE record. "Version in range" means the shipped version falls inside the affected range. "No version data" means the record gives no range, so the issue stays open until reviewed. Also as CSV.