Last scanned:
This image is safe for production use. It does contain 31 exposed-surface findings and 18 post-exploit-only findings, so the vulnerabilities are real and should be tracked. However, none are known to be actively exploited, the highest exposed severity is 5.59, and the post-exploit findings are low severity, so none of them drive the verdict. Keeping the image updated as part of routine maintenance is good practice.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111497 | MEDIUM5.59 | brotli-libs 1.2.0-r1 fixed in 1.2.1-r0 | 36.0% High Exploitation Risk | Directly Exposed |
| CVE-2026-92392 | LOW2.92 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-107928 | LOW2.88 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-107928 | LOW2.88 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92386 | LOW2.58 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92386 | LOW2.58 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86410 | LOW2.45 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86410 | LOW2.45 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-107929 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86415 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87861 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87862 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-87863 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87864 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87865 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87866 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92387 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-92389 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92391 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-107929 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86415 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87861 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87862 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-87863 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87864 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87865 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87866 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92387 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-92389 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92391 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86411 | LOW2.12 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-86411 | LOW2.12 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-94266 | LOW1.98 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86409 | LOW1.91 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86412 | LOW1.91 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86413 | LOW1.91 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86412 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86413 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-94265 | LOW1.86 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-94265 | LOW1.86 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.