Looks like the 8.24.2 release used

puppet-runtime 2025.12.05.1

. So, at least the following have been fixed since then (

libxml2

entries are false positives):

# Modifications are just addition of SBOM metadata
puppet-runtime$ git checkout 2025.12.05.1
M       configs/components/_base-ruby.rb
M       configs/components/_base-rubygem.rb
M       configs/components/curl.rb
M       configs/components/libedit.rb
M       configs/components/libxml2.rb
M       configs/components/libyaml.rb
M       configs/components/openssl-3.0.rb
M       configs/components/readline.rb
HEAD is now at e5159ec Merge pull request #86 from OpenVoxProject/release-2025.12.05.1

$ bundle exec vanagon sbom agent-runtime-main el-9-x86_64 >sbom.cdx.json
Finished generating bill of materials

$ grype sbom.cdx.json
 ✔ Scanned for vulnerabilities     [16 vulnerability matches]
   ├── by severity: 1 critical, 4 high, 9 medium, 2 low, 0 negligible
   └── by status:   14 fixed, 2 not-fixed, 0 ignored
NAME         INSTALLED  FIXED IN                                     TYPE            VULNERABILITY   SEVERITY  EPSS           RISK
openssl-3.0  3.0.18     3.0.19, 3.3.6, 3.4.4, 3.5.5, 3.6.1           UnknownPackage  CVE-2025-15467  Critical  0.8% (73rd)    0.7
libxml2      2.15.1                                                  UnknownPackage  CVE-2025-6021   High      0.6% (69th)    0.5
openssl-3.0  3.0.18     1.1.1ze, 3.0.19, 3.3.6, 3.4.4, 3.5.5, ...    UnknownPackage  CVE-2025-69420  High      < 0.1% (21st)  < 0.1
openssl-3.0  3.0.18     1.0.2zn, 1.1.1ze, 3.0.19, 3.3.6, 3.4.4, ...  UnknownPackage  CVE-2025-69421  High      < 0.1% (18th)  < 0.1
openssl-3.0  3.0.18     1.1.1ze, 3.0.19, 3.3.6, 3.4.4, 3.5.5, ...    UnknownPackage  CVE-2025-69419  High      < 0.1% (17th)  < 0.1
openssl-3.0  3.0.18     1.0.2zn, 1.1.1ze, 3.0.19, 3.3.6, 3.4.4, ...  UnknownPackage  CVE-2026-22796  Medium    < 0.1% (21st)  < 0.1
curl         8.17.0     8.18.0                                       UnknownPackage  CVE-2025-15224  Low       < 0.1% (21st)  < 0.1
curl         8.17.0     8.18.0                                       UnknownPackage  CVE-2025-14819  Medium    < 0.1% (11th)  < 0.1
curl         8.17.0     8.18.0                                       UnknownPackage  CVE-2025-14524  Medium    < 0.1% (8th)   < 0.1
curl         8.17.0     8.18.0                                       UnknownPackage  CVE-2025-15079  Medium    < 0.1% (8th)   < 0.1
openssl-3.0  3.0.18     1.1.1ze, 3.0.19, 3.3.6, 3.4.4, 3.5.5, ...    UnknownPackage  CVE-2026-22795  Medium    < 0.1% (3rd)   < 0.1
openssl-3.0  3.0.18     1.0.2zn, 1.1.1ze, 3.0.19, 3.3.6, 3.4.4, ...  UnknownPackage  CVE-2025-68160  Medium    < 0.1% (2nd)   < 0.1
libxml2      2.15.1                                                  UnknownPackage  CVE-2025-6170   Low       < 0.1% (5th)   < 0.1
curl         8.17.0     8.18.0                                       UnknownPackage  CVE-2025-13034  Medium    < 0.1% (0th)   < 0.1
curl         8.17.0     8.18.0                                       UnknownPackage  CVE-2025-14017  Medium    < 0.1% (0th)   < 0.1
openssl-3.0  3.0.18     1.1.1ze, 3.0.19, 3.3.6, 3.4.4, 3.5.5, ...    UnknownPackage  CVE-2025-69418  Medium    < 0.1% (0th)   < 0.1