Last scanned:
This image is safe for production use. Eight lower-severity findings exist on the exposed surface, with the highest scoring 5.59, and none are known to be actively exploited. Because they fall below the severity and exploitation thresholds that drive this verdict, they do not block deployment. Routine patching and rescanning as new advisories are published is still good practice.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111497 | MEDIUM5.59 | brotli-libs 1.2.0-r1 fixed in 1.2.1-r0 | 36.0% High Exploitation Risk | Directly Exposed |
| CVE-2026-106450 | MEDIUM5.3 | at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4 | 0.5% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-77214 | MEDIUM4.92 | libexpat 2.8.5-r0 fixed in 2.9.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-106451 | MEDIUM4.2 | at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.6-r2 fixed in 1.2.6-r3 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.6-r2 fixed in 1.2.6-r3 | — | Directly Exposed |
| CVE-2026-106449 | LOW3.7 | at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-102633 | LOW3.54 | libexpat 2.8.5-r0 fixed in 2.9.0-r0 | 0.4% Theoretical Threat | Directly Exposed |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.