libhogweed6t64@3.10.1-1 (Expat, GAP, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-3.0-or-later, public-domain)
libpangoft2-1.0-0@1.56.3-1 (Bitstream-Vera, Chromium-BSD-style, Example, ICU, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, OFL-1.1, TCL, Unicode)
libfribidi0@1.0.16-1 (LGPL-2.1-only, LGPL-2.1-or-later)
libnettle8t64@3.10.1-1 (Expat, GAP, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-3.0-or-later, public-domain)
liblastlog2-2@2.41.5-0+deb13u1 (BSD-4-Clause, BSLA, Expat, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or
libffi8@3.4.8-2 (Expat, GPL, GPL-2.0-or-later, GPL-3.0-or-later, MPL-1.1, X11, public-domain)
libgraphite2-3@1.3.14-2+deb13u1 (Artistic, GPL-1.0-only, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, MPL-1.1, custom-sil-open-font-license, public-do
login.defs@1:4.17.4-2 (GPL-1.0-only, GPL-2.0-only, GPL-2.0-or-later)
libde265-0@1.0.15-1+deb13u2 (BSD-4-Clause, GPL-3.0-only, GPL-3.0-or-later, LGPL-3.0-only, LGPL-3.0-or-later, other-1, public-domain-1)
libpcre2-8-0@10.46-1~deb13u3 (BSD-3-clause-Cambridge, X11, public-domain)
fontconfig@2.15.0-2.3 (HPND-sell-variant)
libatomic1@14.2.0-19 (BSD-4-Clause-UC, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
libthai-data@0.1.29-2 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later)
libapt-pkg7.0@3.0.3 (Expat, GPL-2.0-only, GPL-2.0-or-later, curl)
libthai0@0.1.29-2+b1 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later)
libgnutls30t64@3.8.9-3+deb13u4 (CC0-1.0, FSFAP, GPL-3.0-or-later, LGPL-2.1-or-later)
openssl-provider-legacy@3.5.7-1~deb13u3 (Artistic, GPL-1.0-only, GPL-1.0-or-later)
libgomp1@14.2.0-19 (BSD-4-Clause-UC, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
libunistring5@1.3-2 (FreeSoftware, GFDL-1.2-or-later, GFDL-1.3-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGP
libldap2@2.6.10+dfsg-1 (BSD-3-clause-California, BSD-3-clause-variant, BSD-4-clause-California, Beerware, Expat, Expat-ISC, Expat-UNM, F5, FSF-unlimited, GPL-2.0-only, GPL-2.0-or-later, GPL
libglib2.0-0t64@2.84.4-3~deb13u5 (AFL-2.0, CC-BY-SA-3.0, CC0-1.0, Expat, FSFULLR, GPL-2.0-only, GPL-2.0-or-later, Iconv-PD, Janik-permissive, Kuchling-PD, LGPL-2.0-only, LGPL-2.0-or-later,
libopenjp2-7@2.5.3-2.1~deb13u2 (BSD-2, BSD-3, Libpng, libtiff, LIBTIFF-GLARSON, LIBTIFF-PIXAR, Zlib)
libssh2-1t64@1.11.1-1+deb13u2 (BSD3)
libpango-1.0-0@1.56.3-1 (Bitstream-Vera, Chromium-BSD-style, Example, ICU, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, OFL-1.1, TCL, Unicode)
libcurl4t64@8.14.1-2+deb13u5 (BSD-4-Clause-UC, FSFULLR, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-or-later, OLDAP-2.8, X11, curl)
libpsl5t64@0.21.2-1.1+b1 (Chromium, gnulib)
libarchive13t64@3.7.4-4+deb13u1 (BSD-1-clause-UCB, BSD-124-clause-UCB, BSD-3-clause-UCB, BSD-4-clause-UCB, CC0-1.0, Expat, OpenSSL+SSLeay, PD)
libx265-215@4.1-2 (Expat, GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later)
libdebconfclient0@0.280 (GPL-2.0-only, GPL-2.0-or-later)
libpng16-16t64@1.6.48-1+deb13u6 (BSD-like-with-advertising-clause, GPL-2.0-only, GPL-2.0-or-later, expat, Libpng)
gcc-14-base@14.2.0-19 (BSD-4-Clause-UC, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
libjpeg62-turbo@1:2.1.5-4 (BSD-BY-LC-NE, Expat, NTP, Zlib)
libdatrie1@0.2.13-3+b1 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later)
sqv@1.3.0-3+b2 (LGPL-2.0-only, LGPL-2.0-or-later)
libnghttp3-9@1.8.0-1 (FSFAP, FSFUL, FSFULLR, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later)
libpangocairo-1.0-0@1.56.3-1 (Bitstream-Vera, Chromium-BSD-style, Example, ICU, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, OFL-1.1, TCL, Unicode)
fonts-dejavu-mono@2.37-8 (GPL-2.0-only, GPL-2.0-or-later, Bitstream-Vera)
libtiff6@4.7.0-3+deb13u3 (Hylafax)
libdav1d7@1.5.1-1 (public-domain)
libnuma1@2.0.19-1 (GPL-2.0-or-later)
debian-archive-keyring@2025.1 (GPL-2.0-or-later)
libicu76@76.1-4 (GPL-3.0-only)
libdb5.3t64@5.3.28+dfsg2-9 (Artistic, BSD-3-clause-fjord, GPL, GPL-3.0-only, MIT-old, MS-PL, Sleepycat, TCL-like, X11, Zlib)
libharfbuzz0b@10.2.0-1+deb13u1 (CC0-1.0, Expat, FSFAP, FSFUL, FSFULLR, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, Monotype, OFL-1.1, U
tini@0.19.0-3+b8 (Expat)
libssl3t64@3.5.7-1~deb13u3 (Artistic, GPL-1.0-only, GPL-1.0-or-later)
libaom3@3.12.1-1+deb13u1 (Expat, public-domain-md5)
xberg-io/xberg scan summary
Status: Upstream — owned by
xberg-io/xberg. Findings: 18 Critical, 105 High, 78 Medium, 16 Low, 1 Unknown, 114 Negligible; 47 license violations (GPL/LGPL/other copyleft or multi-license packages, full list below).ghcr.io/xberg-io/xberg:1.3.6@sha256:f8dd1d18b97a883b235b70ca3765b9e526cf5436764a89b6401a5d32ab96ada9Critical: curl/libcurl4t64 (CVE-2026-19931, -11856, -8924, -10536, -9079, -18924, -8927, -8926), libtiff6 CVE-2026-52490, libxml2 CVE-2026-6653; none list a fixed version in the scan.
findings: xberg
Critical (18 unique rows)
High (105 unique rows)
Medium (78 unique rows)
Low (16 unique rows)
Unknown (1 unique rows)
Negligible (114 unique rows)
License violations
Remediation SLA and next actions
gh aw compile --force-refresh-container-pinsdaily; a pin-refresh PR is the default remediation step.