Last scanned:
This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker could send crafted HTTP requests exploiting CVE-2019-20445 to bypass access checks on Druid endpoints, gaining unauthorized access to query and ingestion functions and disrupting the service. Note: CVE-2019-17571 only applies if the log4j 1.2 SocketServer is started and listening. The 253 exposed findings, including 16 rated 7.0 or higher, make this deployment's attack surface unacceptable for production.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2019-20445 | CRITICAL10 | io.netty:netty 3.10.5.Final fixed in 4.0.0 | 13.8% High Exploitation Risk | Directly ExposedContext importance: HIGH |
| CVE-2019-20445 | CRITICAL10 | io.netty:netty 3.10.6.Final fixed in 4.0.0 | 13.8% High Exploitation Risk | Directly ExposedContext importance: HIGH |
| CVE-2019-17571 | HIGH8 | log4j:log4j 1.2.17 No fix yet | 70.0% Actively Exploited | Directly ExposedContext importance: MEDIUM |
| CVE-2022-1471 | HIGH8 | org.yaml:snakeyaml 1.33 fixed in 2.0 | 99.5% Actively Exploited | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89407 | HIGH7.5 | com.fasterxml.jackson.core:jackson-core 2.18.6 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-89407 | HIGH7.5 | com.fasterxml.jackson.core:jackson-core 2.19.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-89407 | HIGH7.5 | com.fasterxml.jackson.core:jackson-core 2.22.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-56740 | HIGH7.5 | org.jline:jline-remote-telnet 3.9.0 fixed in 4.2.1, 4.0.16, 3.30.14 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-56741 | HIGH7.5 | org.jline:jline-remote-telnet 3.9.0 fixed in 4.2.1, 4.0.16, 3.30.14 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-111497 | HIGH7.45 | libbrotli1 1.0.9-2+b6 fixed in 1.0.9-2+deb12u1 | 36.0% High Exploitation Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2019-20444 | HIGH7.28 | io.netty:netty 3.10.5.Final fixed in 4.0.0 | 8.9% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2019-20444 | HIGH7.28 | io.netty:netty 3.10.6.Final fixed in 4.0.0 | 8.9% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-2332 | HIGH7.28 | org.eclipse.jetty:jetty-http 9.4.58.v20250814 fixed in 12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60 | 1.3% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-86805 | HIGH7 | libc6 2.36-9+deb12u13 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-95818 | HIGH7 | libc6 2.36-9+deb12u13 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-106451 | HIGH7 | at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-19499 | MEDIUM6.8 | libc6 2.36-9+deb12u13 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2021-21295 | MEDIUM6.79 | io.netty:netty 3.10.5.Final fixed in 4.0.0 | 18.9% High Exploitation Risk | Directly ExposedContext importance: HIGH |
| CVE-2021-21295 | MEDIUM6.79 | io.netty:netty 3.10.6.Final fixed in 4.0.0 | 18.9% High Exploitation Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-4437 | MEDIUM6.5 | libc6 2.36-9+deb12u13 fixed in 2.36-9+deb12u14 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-6238 | MEDIUM6.5 | libc6 2.36-9+deb12u13 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2021-43797 | MEDIUM6.5 | io.netty:netty 3.10.5.Final fixed in 4.0.0 | 2.9% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2021-43797 | MEDIUM6.5 | io.netty:netty 3.10.6.Final fixed in 4.0.0 | 2.9% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-46718 | MEDIUM6.5 | org.apache.calcite:calcite-core 1.37.0 fixed in 1.42.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54512 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.13.2.2 fixed in 2.18.8, 3.1.4, 2.21.4 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54513 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.13.2.2 fixed in 2.18.8, 2.21.4, 3.1.4 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54512 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.8, 3.1.4, 2.21.4 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54513 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.8, 2.21.4, 3.1.4 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54512 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.8, 3.1.4, 2.21.4 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54513 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.8, 2.21.4, 3.1.4 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2025-52999 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.13.2 fixed in 2.15.0 | 0.8% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2023-2976 | MEDIUM6.03 | com.google.guava:guava 14.0.1 fixed in 32.0.0-android | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2022-23305 | MEDIUM6 | log4j:log4j 1.2.17 No fix yet | 66.5% Actively Exploited | Directly Exposed |
| CVE-2021-44521 | MEDIUM6 | org.apache.cassandra:cassandra-all 1.0.8 fixed in 3.0.26, 3.11.12, 4.0.2 | 57.5% Actively Exploited | Directly Exposed |
| CVE-2022-23307 | MEDIUM6 | log4j:log4j 1.2.17 No fix yet | 54.4% Actively Exploited | Directly Exposed |
| CVE-2022-23302 | MEDIUM6 | log4j:log4j 1.2.17 No fix yet | 63.8% Actively Exploited | Directly Exposed |
| CVE-2026-68494 | MEDIUM6 | com.fasterxml.jackson.core:jackson-core 2.13.2 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89425 | MEDIUM6 | com.fasterxml.jackson.core:jackson-core 2.13.2 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-68494 | MEDIUM6 | com.fasterxml.jackson.core:jackson-core 2.18.6 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89425 | MEDIUM6 | com.fasterxml.jackson.core:jackson-core 2.18.6 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-68494 | MEDIUM6 | com.fasterxml.jackson.core:jackson-core 2.19.2 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89425 | MEDIUM6 | com.fasterxml.jackson.core:jackson-core 2.19.2 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89425 | MEDIUM6 | com.fasterxml.jackson.core:jackson-core 2.22.2 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2022-42003 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.13.2.2 fixed in 2.12.7.1, 2.13.4.2 | 3.4% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2022-42004 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.13.2.2 fixed in 2.12.7.1, 2.13.4 | 3.4% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91776 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.13.2.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91777 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.13.2.2 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-50193 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.13.2.2 fixed in 2.14.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-68497 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91776 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91777 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-68497 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91776 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91777 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91776 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.22.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91777 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.22.2 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-55163 | MEDIUM6 | io.grpc:grpc-netty-shaded 1.59.0 fixed in 1.75.0 | 1.1% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2019-16869 | MEDIUM6 | io.netty:netty 3.10.5.Final No fix yet | 8.6% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2021-37136 | MEDIUM6 | io.netty:netty 3.10.5.Final fixed in 4.0.0 | 5.9% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2021-37137 | MEDIUM6 | io.netty:netty 3.10.5.Final fixed in 4.0.0 | 6.6% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2019-16869 | MEDIUM6 | io.netty:netty 3.10.6.Final No fix yet | 8.6% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2021-37136 | MEDIUM6 | io.netty:netty 3.10.6.Final fixed in 4.0.0 | 5.9% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2021-37137 | MEDIUM6 | io.netty:netty 3.10.6.Final fixed in 4.0.0 | 6.6% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2023-26464 | MEDIUM6 | log4j:log4j 1.2.17 fixed in 2.0 | 1.9% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54399 | MEDIUM6 | org.apache.httpcomponents.core5:httpcore5 5.3.6 fixed in 5.4.3, 5.5-beta2 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54428 | MEDIUM6 | org.apache.httpcomponents.core5:httpcore5-h2 5.3.6 fixed in 5.4.3, 5.5-beta2 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-5435 | MEDIUM5.9 | libc6 2.36-9+deb12u13 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-6791 | MEDIUM5.9 | libc6 2.36-9+deb12u13 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-77117 | MEDIUM5.9 | libc6 2.36-9+deb12u13 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-80489 | MEDIUM5.9 | libc6 2.36-9+deb12u13 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-15281 | MEDIUM5.9 | libc6 2.36-9+deb12u13 fixed in 2.36-9+deb12u14 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2018-10237 | MEDIUM5.9 | com.google.guava:guava 14.0.1 fixed in 24.1.1-android | 5.1% Low-Moderate Risk | Directly Exposed |
| CVE-2021-21409 | MEDIUM5.9 | io.netty:netty 3.10.5.Final fixed in 4.0.0 | 4.9% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2021-21409 | MEDIUM5.9 | io.netty:netty 3.10.6.Final fixed in 4.0.0 | 4.9% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-49844 | MEDIUM5.9 | org.apache.logging.log4j:log4j-api 2.26.0 fixed in 2.25.5, 2.26.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2023-45853 | MEDIUM5.88 | zlib1g 1:1.2.13.dfsg-1 No fix yet | 3.4% Low-Moderate Risk | Directly Exposed |
| CVE-2021-4104 | MEDIUM5.85 | log4j:log4j 1.2.17 No fix yet | 80.6% Actively Exploited | Directly Exposed |
| CVE-2026-6368 | MEDIUM5.5 | libc6 2.36-9+deb12u13 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-95512 | MEDIUM5.5 | libfreetype6 2.12.1+dfsg-5+deb12u4 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2021-21290 | MEDIUM5.5 | io.netty:netty 3.10.5.Final fixed in 4.0.0 | 1.8% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2021-21290 | MEDIUM5.5 | io.netty:netty 3.10.6.Final fixed in 4.0.0 | 1.8% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-77420 | MEDIUM5.5 | org.jline:jline-reader 3.9.0 fixed in 4.3.1, 3.30.15 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-8763 | MEDIUM5.46 | org.bouncycastle:bcprov-jdk18on 1.84 fixed in 1.85 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-0915 | MEDIUM5.3 | libc6 2.36-9+deb12u13 fixed in 2.36-9+deb12u14 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-4046 | MEDIUM5.3 | libc6 2.36-9+deb12u13 fixed in 2.36-9+deb12u14 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-8674 | MEDIUM5.3 | libc6 2.36-9+deb12u13 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-106450 | MEDIUM5.3 | at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-18401 | MEDIUM5.3 | com.fasterxml.jackson.core:jackson-core 2.19.2 fixed in 2.21.1, 2.18.6 | 0.4% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-6860 | MEDIUM5.3 | io.vertx:vertx-core 4.5.24 fixed in 4.5.27, 5.0.12 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-45205 | MEDIUM5.3 | org.apache.commons:commons-configuration2 2.10.1 fixed in 2.15.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-45205 | MEDIUM5.3 | org.apache.commons:commons-configuration2 2.13.0 fixed in 2.15.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-64607 | MEDIUM5.3 | org.apache.httpcomponents.client5:httpclient5 5.5.1 fixed in 5.6.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2020-13956 | MEDIUM5.3 | org.apache.httpcomponents:httpclient 4.5.2 fixed in 4.5.13, 5.0.3 | 9.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63337 | MEDIUM5.28 | com.rabbitmq:amqp-client 5.20.0 fixed in 5.33.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-23015 | MEDIUM5.28 | org.apache.cassandra:cassandra-all 1.0.8 fixed in 5.0.3, 4.1.8, 4.0.16, 3.11.18, 3.0.31 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-69220 | MEDIUM5.22 | com.rabbitmq:amqp-client 5.20.0 fixed in 5.33.1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-59889 | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.13.2.2 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59888 | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.8, 2.21.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59889 | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| GHSA-mhm7-754m-9p8w | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.9, 2.21.5 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59888 | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.8, 2.21.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59889 | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-22227 | MEDIUM5.18 | io.projectreactor.netty:reactor-netty-http 1.0.48 fixed in 1.3.0-M5, 1.2.8 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2021-33813 | MEDIUM5.17 | org.jdom:jdom2 2.0.6 fixed in 2.0.6.1 | 19.4% High Exploitation Risk | Directly Exposed |
| CVE-2026-5450 | MEDIUM5 | libc6 2.36-9+deb12u13 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-5928 | MEDIUM5 | libc6 2.36-9+deb12u13 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-53864 | MEDIUM4.93 | com.nimbusds:nimbus-jose-jwt 10.0.1 fixed in 10.0.2, 9.37.4 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2025-53864 | MEDIUM4.93 | com.nimbusds:nimbus-jose-jwt 9.37.3 fixed in 10.0.2, 9.37.4 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2025-53864 | MEDIUM4.93 | com.nimbusds:nimbus-jose-jwt 9.40 fixed in 10.0.2, 9.37.4 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-77214 | MEDIUM4.92 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.36-9+deb12u13 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-0861 | MEDIUM4.86 | libc6 2.36-9+deb12u13 fixed in 2.36-9+deb12u14 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-53615 | MEDIUM4.8 | libuuid1 2.38.1-5+deb12u3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-78408 | MEDIUM4.74 | libuuid1 2.38.1-5+deb12u3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-25210 | MEDIUM4.68 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u4 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-76957 | MEDIUM4.68 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-76642 | MEDIUM4.68 | libuuid1 2.38.1-5+deb12u3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-78410 | MEDIUM4.68 | libuuid1 2.38.1-5+deb12u3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95619 | MEDIUM4.62 | gcc-12-base 12.2.0-14+deb12u1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-95619 | MEDIUM4.62 | libgcc-s1 12.2.0-14+deb12u1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-95619 | MEDIUM4.62 | libstdc++6 12.2.0-14+deb12u1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-33636 | MEDIUM4.56 | libpng16-16 1.6.39-2+deb12u3 fixed in 1.6.39-2+deb12u4 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2024-28757 | MEDIUM4.5 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u4 | 2.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-45186 | MEDIUM4.5 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-66046 | MEDIUM4.5 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u4 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-93990 | MEDIUM4.5 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-33416 | MEDIUM4.5 | libpng16-16 1.6.39-2+deb12u3 fixed in 1.6.39-2+deb12u4 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-69219 | MEDIUM4.5 | com.rabbitmq:amqp-client 5.20.0 fixed in 5.33.1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-75516 | MEDIUM4.5 | com.rabbitmq:amqp-client 5.20.0 fixed in 5.34.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-106121 | MEDIUM4.5 | com.rabbitmq:amqp-client 5.20.0 fixed in 5.36.1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-106122 | MEDIUM4.5 | com.rabbitmq:amqp-client 5.20.0 fixed in 5.36.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-61634 | MEDIUM4.5 | com.rabbitmq:amqp-client 5.20.0 fixed in 5.33.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2024-47554 | MEDIUM4.5 | commons-io:commons-io 2.4 fixed in 2.14.0 | 1.3% Low-Moderate Risk | Directly Exposed |
| CVE-2020-13949 | MEDIUM4.5 | org.apache.thrift:libthrift 0.13.0 fixed in 0.14.0 | 6.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-43871 | MEDIUM4.5 | org.apache.thrift:libthrift 0.13.0 fixed in 0.24.0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2018-1320 | MEDIUM4.5 | org.apache.thrift:libthrift 0.6.1 fixed in 0.9.3-1, 0.12.0 | 8.2% Low-Moderate Risk | Directly Exposed |
| CVE-2019-0205 | MEDIUM4.5 | org.apache.thrift:libthrift 0.6.1 fixed in 0.13.0 | 9.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-43871 | MEDIUM4.5 | org.apache.thrift:libthrift 0.6.1 fixed in 0.24.0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2018-1320 | MEDIUM4.5 | org.apache.thrift:libthrift 0.9.3 fixed in 0.9.3-1, 0.12.0 | 8.2% Low-Moderate Risk | Directly Exposed |
| CVE-2019-0205 | MEDIUM4.5 | org.apache.thrift:libthrift 0.9.3 fixed in 0.13.0 | 9.2% Low-Moderate Risk | Directly Exposed |
| CVE-2020-13949 | MEDIUM4.5 | org.apache.thrift:libthrift 0.9.3 fixed in 0.14.0 | 6.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-43871 | MEDIUM4.5 | org.apache.thrift:libthrift 0.9.3 fixed in 0.24.0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-107227 | MEDIUM4.5 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.14 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-107231 | MEDIUM4.5 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.13, 2.16.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-85721 | MEDIUM4.5 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.12, 2.16.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-13506 | MEDIUM4.5 | org.bouncycastle:bcprov-jdk18on 1.84 fixed in 1.85 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2022-40150 | MEDIUM4.5 | org.codehaus.jettison:jettison 1.1 fixed in 1.5.2 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2022-45685 | MEDIUM4.5 | org.codehaus.jettison:jettison 1.1 fixed in 1.5.2 | 1.5% Low-Moderate Risk | Directly Exposed |
| CVE-2022-45693 | MEDIUM4.5 | org.codehaus.jettison:jettison 1.1 fixed in 1.5.2 | 1.5% Low-Moderate Risk | Directly Exposed |
| CVE-2023-1436 | MEDIUM4.5 | org.codehaus.jettison:jettison 1.1 fixed in 1.5.4 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2022-40149 | MEDIUM4.5 | org.codehaus.jettison:jettison 1.1 fixed in 1.5.1 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2022-40150 | MEDIUM4.5 | org.codehaus.jettison:jettison 1.3.1 fixed in 1.5.2 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2022-45685 | MEDIUM4.5 | org.codehaus.jettison:jettison 1.3.1 fixed in 1.5.2 | 1.5% Low-Moderate Risk | Directly Exposed |
| CVE-2022-45693 | MEDIUM4.5 | org.codehaus.jettison:jettison 1.3.1 fixed in 1.5.2 | 1.5% Low-Moderate Risk | Directly Exposed |
| CVE-2023-1436 | MEDIUM4.5 | org.codehaus.jettison:jettison 1.3.1 fixed in 1.5.4 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2022-40149 | MEDIUM4.5 | org.codehaus.jettison:jettison 1.3.1 fixed in 1.5.1 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2022-41404 | MEDIUM4.5 | org.ini4j:ini4j 0.5.4 No fix yet | 1.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-77422 | MEDIUM4.5 | org.jline:jline-builtins 3.9.0 fixed in 4.3.1, 3.30.15 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.48 | com.fasterxml.jackson.core:jackson-databind 2.13.2.2 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-83557 | MEDIUM4.48 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-83557 | MEDIUM4.48 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-107230 | MEDIUM4.44 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.14 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-45300 | MEDIUM4.44 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.10, 2.15.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-43869 | MEDIUM4.38 | org.apache.thrift:libthrift 0.13.0 fixed in 0.23.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-43869 | MEDIUM4.38 | org.apache.thrift:libthrift 0.6.1 fixed in 0.23.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-43869 | MEDIUM4.38 | org.apache.thrift:libthrift 0.9.3 fixed in 0.23.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.13.2.2 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54514 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.13.2.2 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54515 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.13.2.2 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-77310 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.13.2.2 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-19032 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54514 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54515 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-77310 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-19032 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54514 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54515 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-77310 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-102010 | MEDIUM4.2 | gcc-12-base 12.2.0-14+deb12u1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102010 | MEDIUM4.2 | libgcc-s1 12.2.0-14+deb12u1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102010 | MEDIUM4.2 | libstdc++6 12.2.0-14+deb12u1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-53613 | MEDIUM4.2 | libuuid1 2.38.1-5+deb12u3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-78409 | MEDIUM4.2 | libuuid1 2.38.1-5+deb12u3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-19542 | MEDIUM4.2 | libc6 2.36-9+deb12u13 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.36-9+deb12u13 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56132 | MEDIUM4.14 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u5 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56403 | MEDIUM4.14 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56404 | MEDIUM4.14 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56405 | MEDIUM4.14 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56406 | MEDIUM4.14 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56407 | MEDIUM4.14 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56408 | MEDIUM4.14 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56410 | MEDIUM4.14 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56411 | MEDIUM4.14 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107280 | MEDIUM4.14 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.13, 2.16.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-107226 | MEDIUM4.08 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.14 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-107228 | MEDIUM4.08 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.14 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-40490 | MEDIUM4.08 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.9, 2.14.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-4438 | MEDIUM4 | libc6 2.36-9+deb12u13 fixed in 2.36-9+deb12u14 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56409 | LOW3.9 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2018-11798 | LOW3.9 | org.apache.thrift:libthrift 0.9.3 fixed in 0.12.0 | 4.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-107282 | LOW3.9 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.13, 2.16.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-77421 | LOW3.9 | org.jline:jline-builtins 3.9.0 fixed in 4.3.1, 3.30.15 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2010-4756 | LOW3.9 | libc6 2.36-9+deb12u13 No fix yet | 2.6% Low-Moderate Risk | Directly Exposed |
| CVE-2018-20796 | LOW3.9 | libc6 2.36-9+deb12u13 No fix yet | 5.8% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010022 | LOW3.9 | libc6 2.36-9+deb12u13 No fix yet | 3.2% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010023 | LOW3.9 | libc6 2.36-9+deb12u13 No fix yet | 3.1% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010024 | LOW3.9 | libc6 2.36-9+deb12u13 No fix yet | 3.2% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010025 | LOW3.9 | libc6 2.36-9+deb12u13 No fix yet | 2.5% Low-Moderate Risk | Directly Exposed |
| CVE-2019-9192 | LOW3.9 | libc6 2.36-9+deb12u13 No fix yet | 2.4% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63335 | LOW3.78 | com.rabbitmq:amqp-client 5.20.0 fixed in 5.31.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-72522 | LOW3.72 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-97399 | LOW3.7 | libc6 2.36-9+deb12u13 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-106449 | LOW3.7 | at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2024-6763 | LOW3.6 | org.eclipse.jetty:jetty-http 9.4.58.v20250814 fixed in 12.0.12 | 1.0% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-102633 | LOW3.54 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-113351 | LOW3.54 | libexpat1 2.5.0-1+deb12u2 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-50219 | LOW3.54 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56412 | LOW3.54 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-46675 | LOW3.54 | libpng16-16 1.6.39-2+deb12u3 fixed in 1.6.39-2+deb12u6 | — | Directly Exposed |
| CVE-2026-107285 | LOW3.54 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.12, 2.16.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-85720 | LOW3.54 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.12, 2.16.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2021-29425 | LOW3.31 | commons-io:commons-io 2.4 fixed in 2.7 | 10.5% High Exploitation Risk | Directly Exposed |
| CVE-2025-66382 | LOW3.3 | libexpat1 2.5.0-1+deb12u2 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-32776 | LOW3.3 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u4 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-32777 | LOW3.3 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u4 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-32778 | LOW3.3 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u4 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-27171 | LOW3.3 | zlib1g 1:1.2.13.dfsg-1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-106123 | LOW3.3 | com.rabbitmq:amqp-client 5.20.0 fixed in 5.35.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-59375 | LOW3.18 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u5 | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2026-13595 | LOW3.18 | libuuid1 2.38.1-5+deb12u3 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-3184 | LOW3.18 | libuuid1 2.38.1-5+deb12u3 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-63336 | LOW3.06 | com.rabbitmq:amqp-client 5.20.0 fixed in 5.33.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-85091 | LOW3 | zlib1g 1:1.2.13.dfsg-1 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-27456 | LOW2.82 | libuuid1 2.38.1-5+deb12u3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2020-8908 | LOW2.8 | com.google.guava:guava 14.0.1 fixed in 32.0.0-android | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-41254 | LOW2.7 | liblcms2-2 2.14-2 fixed in 2.14-2+deb12u1 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-56131 | LOW2.7 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-34757 | LOW2.64 | libpng16-16 1.6.39-2+deb12u3 fixed in 1.6.39-2+deb12u5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-115506 | LOW2.4 | libexpat1 2.5.0-1+deb12u2 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-55688 | LOW2.4 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.11, 2.16.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-28162 | LOW2.34 | libpng16-16 1.6.39-2+deb12u3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-28164 | LOW2.34 | libpng16-16 1.6.39-2+deb12u3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-3713 | LOW2.34 | libpng16-16 1.6.39-2+deb12u3 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-14104 | LOW2.34 | libuuid1 2.38.1-5+deb12u3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-41080 | LOW2.22 | libexpat1 2.5.0-1+deb12u2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-107283 | LOW2.22 | org.asynchttpclient:async-http-client 3.0.2 fixed in 3.0.12, 2.16.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW1.99 | gcc-12-base 12.2.0-14+deb12u1 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2023-52426 | LOW1.99 | libexpat1 2.5.0-1+deb12u2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW1.99 | libgcc-s1 12.2.0-14+deb12u1 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2021-4214 | LOW1.99 | libpng16-16 1.6.39-2+deb12u3 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW1.99 | libstdc++6 12.2.0-14+deb12u1 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2022-0563 | LOW1.99 | libuuid1 2.38.1-5+deb12u3 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-24515 | LOW1.5 | libexpat1 2.5.0-1+deb12u2 fixed in 2.5.0-1+deb12u4 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-29070 | LOW0.76 | liblcms2-2 2.14-2 No fix yet | 1.0% Theoretical Threat | Post-Exploit |
| CVE-2025-48924 | NONE0 | commons-lang:commons-lang 2.5 No fix yet | 2.6% Low-Moderate Risk | Not Applicable |
| CVE-2025-48924 | NONE0 | commons-lang:commons-lang 2.6 No fix yet | 2.6% Low-Moderate Risk | Not Applicable |
| DLA-4792-1 | NONE0 | tzdata 2025b-0+deb12u2 fixed in 2026c-0+deb12u1 | — | Not Applicable |
| DLA-4854-1 | NONE0 | tzdata 2025b-0+deb12u2 fixed in 2026e-0+deb12u1 | — | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.