libffi8@3.4.8-2 (Expat, GPL, GPL-2.0-or-later, GPL-3.0-or-later, MPL-1.1, X11, public-domain)
libgraphite2-3@1.3.14-2+deb13u1 (Artistic, GPL-1.0-only, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, MPL-1.1, custom-sil-open-font-license, public-domain)
libunistring5@1.3-2 (FreeSoftware, GFDL-1.2-or-later, GFDL-1.3-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, Unicode-DFS-2016, X11, public-domain)
debian-archive-keyring@2025.1 (GPL-2.0-or-later)
libldap2@2.6.10+dfsg-1 (BSD-3-clause-California, BSD-3-clause-variant, BSD-4-clause-California, Beerware, Expat, Expat-ISC, Expat-UNM, F5, FSF-unlimited, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, JCG, MIT-XC, NeoSoft-permissive, OpenLDAP-2.8, UMich, public-domain)
libssh2-1t64@1.11.1-1+deb13u2 (BSD3)
libssl3t64@3.5.7-1~deb13u3 (Artistic, GPL-1.0-only, GPL-1.0-or-later)
libpcre2-8-0@10.46-1~deb13u3 (BSD-3-clause-Cambridge, X11, public-domain)
libharfbuzz0b@10.2.0-1+deb13u1 (CC0-1.0, Expat, FSFAP, FSFUL, FSFULLR, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, Monotype, OFL-1.1, UFL-1.0, Unicode)
libdav1d7@1.5.1-1 (public-domain)
libjpeg62-turbo@1:2.1.5-4 (BSD-BY-LC-NE, Expat, NTP, Zlib)
libdb5.3t64@5.3.28+dfsg2-9 (Artistic, BSD-3-clause-fjord, GPL, GPL-3.0-only, MIT-old, MS-PL, Sleepycat, TCL-like, X11, Zlib)
libde265-0@1.0.15-1+deb13u2 (BSD-4-Clause, GPL-3.0-only, GPL-3.0-or-later, LGPL-3.0-only, LGPL-3.0-or-later, other-1, public-domain-1)
libhogweed6t64@3.10.1-1 (Expat, GAP, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-3.0-or-later, public-domain)
libfribidi0@1.0.16-1 (LGPL-2.1-only, LGPL-2.1-or-later)
libdatrie1@0.2.13-3+b1 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later)
libpng16-16t64@1.6.48-1+deb13u6 (BSD-like-with-advertising-clause, GPL-2.0-only, GPL-2.0-or-later, expat, Libpng)
libatomic1@14.2.0-19 (BSD-4-Clause-UC, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
libgnutls30t64@3.8.9-3+deb13u4 (CC0-1.0, FSFAP, GPL-3.0-or-later, LGPL-2.1-or-later)
libnuma1@2.0.19-1 (GPL-2.0-or-later)
libthai0@0.1.29-2+b1 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later)
login.defs@1:4.17.4-2 (GPL-1.0-only, GPL-2.0-only, GPL-2.0-or-later)
fonts-dejavu-mono@2.37-8 (GPL-2.0-only, GPL-2.0-or-later, Bitstream-Vera)
libthai-data@0.1.29-2 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later)
libpsl5t64@0.21.2-1.1+b1 (Chromium, gnulib)
libpangoft2-1.0-0@1.56.3-1 (Bitstream-Vera, Chromium-BSD-style, Example, ICU, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, OFL-1.1, TCL, Unicode)
libcurl4t64@8.14.1-2+deb13u5 (BSD-4-Clause-UC, FSFULLR, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-or-later, OLDAP-2.8, X11, curl)
libx265-215@4.1-2 (Expat, GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later)
libtiff6@4.7.0-3+deb13u3 (Hylafax)
sqv@1.3.0-3+b2 (LGPL-2.0-only, LGPL-2.0-or-later)
libgomp1@14.2.0-19 (BSD-4-Clause-UC, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
libnghttp3-9@1.8.0-1 (FSFAP, FSFUL, FSFULLR, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later)
libglib2.0-0t64@2.84.4-3~deb13u5 (AFL-2.0, CC-BY-SA-3.0, CC0-1.0, Expat, FSFULLR, GPL-2.0-only, GPL-2.0-or-later, Iconv-PD, Janik-permissive, Kuchling-PD, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, MPL-1.1, Mingw-PD, Plumb-PD, Unicode-DFS-2016, bzip2-1.0.6, cmph, old-glib-tests)
libapt-pkg7.0@3.0.3 (Expat, GPL-2.0-only, GPL-2.0-or-later, curl)
libpangocairo-1.0-0@1.56.3-1 (Bitstream-Vera, Chromium-BSD-style, Example, ICU, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, OFL-1.1, TCL, Unicode)
libdebconfclient0@0.280 (GPL-2.0-only, GPL-2.0-or-later)
libicu76@76.1-4 (GPL-3.0-only)
liblastlog2-2@2.41.5-0+deb13u1 (BSD-4-Clause, BSLA, Expat, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
libpango-1.0-0@1.56.3-1 (Bitstream-Vera, Chromium-BSD-style, Example, ICU, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, OFL-1.1, TCL, Unicode)
libopenjp2-7@2.5.3-2.1~deb13u2 (BSD-2, BSD-3, Libpng, libtiff, LIBTIFF-GLARSON, LIBTIFF-PIXAR, Zlib)
libnettle8t64@3.10.1-1 (Expat, GAP, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-3.0-or-later, public-domain)
fontconfig@2.15.0-2.3 (HPND-sell-variant)
libarchive13t64@3.7.4-4+deb13u1 (BSD-1-clause-UCB, BSD-124-clause-UCB, BSD-3-clause-UCB, BSD-4-clause-UCB, CC0-1.0, Expat, OpenSSL+SSLeay, PD)
openssl-provider-legacy@3.5.7-1~deb13u3 (Artistic, GPL-1.0-only, GPL-1.0-or-later)
tini@0.19.0-3+b8 (Expat)
gcc-14-base@14.2.0-19 (BSD-4-Clause-UC, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
libaom3@3.12.1-1+deb13u1 (Expat, public-domain-md5)
xberg scan summary
Status: upstream (xberg-io), tracked only. Scan run 37577104450 (2026-10-07). 18 Critical, 104 High, 78 Medium, 16 Low, 2 Unknown, 114 Negligible (scanner rows); 47 license violations. Pin refreshed today (
latestdigest updated).ghcr.io/xberg-io/xberg:latest@sha256:1636608e4e52a5921d09c062202c5f46f930719b41d2034b50a9046cf535a7a8Remediation SLA and guidance
gh aw compile --force-refresh-container-pins; the resulting pin-refresh PR is the default remediation step.Critical
High
Medium
Low
Unknown
Negligible
Rejected or unknown licenses