Vulnerability Reportcheckmarx/kics:v2.1.20

checkmarx/kics:latestcheckmarx/kics:v2.1.20
DIGESTsha256:3e5a268eb8adda2e5a483c9359ddfc4cd520ab856a7076dc0b1d8784a37e2602

Executive Summary

Threat Score
50/100CAUTION
Reputation
RELIABLE

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could cause denial of service via crafted CMS messages (CVE-2026-28390) or read arbitrary files via malicious Git URLs (CVE-2026-4660). Disabling QUIC protocol would fully eliminate CVE-2026-34183. Many vulnerabilities require specific conditions (e.g., processing untrusted CMS data) and may not be exploitable in default configurations.

Vulnerabilities

Vulnerability Log

137 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-28390MEDIUM6.38
libcrypto3
3.6.1-r1
fixed in 3.6.2-r0
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-34183MEDIUM6.38
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-28389MEDIUM6.38
libssl3
3.6.1-r1
fixed in 3.6.2-r0
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-28390MEDIUM6.38
libssl3
3.6.1-r1
fixed in 3.6.2-r0
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-34183MEDIUM6.38
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-34986MEDIUM6.38
github.com/go-jose/go-jose/v4
v4.1.3
fixed in 4.1.4
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-4660MEDIUM6.38
github.com/hashicorp/go-getter
v1.8.1
fixed in 1.8.6
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-33748MEDIUM6.38
github.com/moby/buildkit
v0.26.3
fixed in 0.28.1
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-29181MEDIUM6.38
go.opentelemetry.io/otel
v1.40.0
fixed in 1.41.0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-39829MEDIUM6.38
golang.org/x/crypto
v0.45.0
fixed in 0.52.0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-39830MEDIUM6.38
golang.org/x/crypto
v0.45.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-33814MEDIUM6.38
golang.org/x/net
v0.47.0
fixed in 0.53.0
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-32280MEDIUM6.38
stdlib
v1.26.0
fixed in 1.25.9, 1.26.2
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-32281MEDIUM6.38
stdlib
v1.26.0
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-32283MEDIUM6.38
stdlib
v1.26.0
fixed in 1.25.9, 1.26.2
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-33811MEDIUM6.38
stdlib
v1.26.0
fixed in 1.25.10, 1.26.3
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-33814MEDIUM6.38
stdlib
v1.26.0
fixed in 1.25.10, 1.26.3
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-39820MEDIUM6.38
stdlib
v1.26.0
fixed in 1.25.10, 1.26.3
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-39836MEDIUM6.38
stdlib
v1.26.0
fixed in 1.25.10, 1.26.3
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-34182MEDIUM6.29
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-34182MEDIUM6.29
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42508MEDIUM6.29
golang.org/x/crypto
v0.45.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-46595MEDIUM6.03
golang.org/x/crypto
v0.45.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-39883MEDIUM5.95
go.opentelemetry.io/otel/sdk
v1.40.0
fixed in 1.43.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39821MEDIUM5.58
golang.org/x/net
v0.47.0
fixed in 0.55.0
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-33810MEDIUM5.58
stdlib
v1.26.0
fixed in 1.26.2
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-4437MEDIUM5.52
glibc
2.43-r1
fixed in 2.43-r4
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-4437MEDIUM5.52
glibc-locale-posix
2.43-r1
fixed in 2.43-r4
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-4437MEDIUM5.52
ld-linux
2.43-r1
fixed in 2.43-r4
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-4437MEDIUM5.52
libcrypt1
2.43-r1
fixed in 2.43-r4
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-2673MEDIUM5.52
libcrypto3
3.6.1-r1
fixed in 3.6.1-r3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-2673MEDIUM5.52
libssl3
3.6.1-r1
fixed in 3.6.1-r3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-35469MEDIUM5.52
github.com/moby/spdystream
v0.5.0
fixed in 0.5.1
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-32282MEDIUM5.44
stdlib
v1.26.0
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-34181MEDIUM5.35
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42768MEDIUM5.35
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-34181MEDIUM5.35
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42768MEDIUM5.35
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-32289MEDIUM5.18
stdlib
v1.26.0
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-32280MEDIUM5.1
git-lfs
3.7.1-r5
fixed in 3.7.1-r14
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-32281MEDIUM5.1
git-lfs
3.7.1-r5
fixed in 3.7.1-r14
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-32283MEDIUM5.1
git-lfs
3.7.1-r5
fixed in 3.7.1-r14
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-33814MEDIUM5.1
git-lfs
3.7.1-r5
fixed in 3.7.1-r12
0.6%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-25679MEDIUM5.1
stdlib
v1.26.0
fixed in 1.25.8, 1.26.1
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-27137MEDIUM5.1
stdlib
v1.26.0
fixed in 1.26.1
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-31790MEDIUM5.02
libcrypto3
3.6.1-r1
fixed in 3.6.2-r0
1.0%
Theoretical Threat
Directly Exposed
CVE-2026-42764MEDIUM5.02
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-42769MEDIUM5.02
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42770MEDIUM5.02
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-9076MEDIUM5.02
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-31790MEDIUM5.02
libssl3
3.6.1-r1
fixed in 3.6.2-r0
1.0%
Theoretical Threat
Directly Exposed
CVE-2026-42764MEDIUM5.02
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-42769MEDIUM5.02
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42770MEDIUM5.02
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-9076MEDIUM5.02
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-7383MEDIUM4.67
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-7383MEDIUM4.67
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-32288MEDIUM4.67
stdlib
v1.26.0
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-27142MEDIUM4.59
stdlib
v1.26.0
fixed in 1.25.8, 1.26.1
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-39826MEDIUM4.59
stdlib
v1.26.0
fixed in 1.25.10, 1.26.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-4046MEDIUM4.5
glibc
2.43-r1
fixed in 2.43-r6
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-4046MEDIUM4.5
glibc-locale-posix
2.43-r1
fixed in 2.43-r6
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-4046MEDIUM4.5
ld-linux
2.43-r1
fixed in 2.43-r6
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-4046MEDIUM4.5
libcrypt1
2.43-r1
fixed in 2.43-r6
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-42766MEDIUM4.5
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-42767MEDIUM4.5
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42766MEDIUM4.5
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-42767MEDIUM4.5
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-46598MEDIUM4.5
golang.org/x/crypto
v0.45.0
fixed in 0.52.0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42507MEDIUM4.5
stdlib
v1.26.0
fixed in 1.25.11, 1.26.4
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-5450MEDIUM4.25
glibc
2.43-r1
fixed in 2.43-r7
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-5928MEDIUM4.25
glibc
2.43-r1
fixed in 2.43-r7
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-5450MEDIUM4.25
glibc-locale-posix
2.43-r1
fixed in 2.43-r7
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-5928MEDIUM4.25
glibc-locale-posix
2.43-r1
fixed in 2.43-r7
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-5450MEDIUM4.25
ld-linux
2.43-r1
fixed in 2.43-r7
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-5928MEDIUM4.25
ld-linux
2.43-r1
fixed in 2.43-r7
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-5450MEDIUM4.25
libcrypt1
2.43-r1
fixed in 2.43-r7
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-5928MEDIUM4.25
libcrypt1
2.43-r1
fixed in 2.43-r7
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-34180MEDIUM4.25
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-34180MEDIUM4.25
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.5%
Theoretical Threat
Directly Exposed
CVE-2023-39810LOW3.98
busybox
1.37.0-r54
fixed in 1.37.0-r58
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-35206LOW3.74
helm.sh/helm/v3
v3.19.4
fixed in 3.20.2
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-26157LOW3.57
busybox
1.37.0-r54
fixed in 1.37.0-r58
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-26158LOW3.57
busybox
1.37.0-r54
fixed in 1.37.0-r58
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-4438LOW3.4
glibc
2.43-r1
fixed in 2.43-r4
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-4438LOW3.4
glibc-locale-posix
2.43-r1
fixed in 2.43-r4
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-4438LOW3.4
ld-linux
2.43-r1
fixed in 2.43-r4
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-4438LOW3.4
libcrypt1
2.43-r1
fixed in 2.43-r4
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-45446LOW3.15
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-45446LOW3.15
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-27138LOW3.15
stdlib
v1.26.0
fixed in 1.26.1
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-31789LOW3
libcrypto3
3.6.1-r1
fixed in 3.6.2-r0
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-31789LOW3
libssl3
3.6.1-r1
fixed in 3.6.2-r0
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-33747LOW3
github.com/moby/buildkit
v0.26.3
fixed in 0.28.1
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-45447LOW2.92
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
2.3%
Low-Moderate Risk
Post-Exploit
CVE-2026-45447LOW2.92
libssl3
3.6.1-r1
fixed in 3.6.3-r0
2.3%
Low-Moderate Risk
Post-Exploit
CVE-2026-45445LOW2.78
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-45445LOW2.78
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-33186LOW2.78
google.golang.org/grpc
v1.77.0
fixed in 1.79.3
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-27140LOW2.69
git-lfs
3.7.1-r5
fixed in 3.7.1-r14
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-39828LOW2.69
golang.org/x/crypto
v0.45.0
fixed in 0.52.0
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-28387LOW2.48
libcrypto3
3.6.1-r1
fixed in 3.6.2-r0
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-28387LOW2.48
libssl3
3.6.1-r1
fixed in 3.6.2-r0
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-28386LOW2.29
libcrypto3
3.6.1-r1
fixed in 3.6.2-r0
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-28388LOW2.29
libcrypto3
3.6.1-r1
fixed in 3.6.2-r0
0.9%
Theoretical Threat
Post-Exploit
CVE-2026-28389LOW2.29
libcrypto3
3.6.1-r1
fixed in 3.6.2-r0
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-28386LOW2.29
libssl3
3.6.1-r1
fixed in 3.6.2-r0
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-28388LOW2.29
libssl3
3.6.1-r1
fixed in 3.6.2-r0
0.9%
Theoretical Threat
Post-Exploit
CVE-2026-27139LOW2.12
stdlib
v1.26.0
fixed in 1.25.8, 1.26.1
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-32631NONE0
git
2.53.0-r0
fixed in 2.54.0-r0
0.3%
Theoretical Threat
Not Applicable
CVE-2026-35188NONE0
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.2%
Theoretical Threat
Not Applicable
CVE-2026-42765NONE0
libcrypto3
3.6.1-r1
fixed in 3.6.3-r0
0.4%
Theoretical Threat
Not Applicable
CVE-2026-35188NONE0
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.2%
Theoretical Threat
Not Applicable
CVE-2026-42765NONE0
libssl3
3.6.1-r1
fixed in 3.6.3-r0
0.4%
Theoretical Threat
Not Applicable
GHSA-xmrv-pmrh-hhx2NONE0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
v1.7.0
fixed in 1.7.8
Not Applicable
GHSA-xmrv-pmrh-hhx2NONE0
github.com/aws/aws-sdk-go-v2/service/s3
v1.87.1
fixed in 1.97.3
Not Applicable
CVE-2026-46680NONE0
github.com/containerd/containerd
v1.7.30
fixed in 1.7.32
Not Applicable
CVE-2026-53488NONE0
github.com/containerd/containerd
v1.7.30
fixed in 1.7.33
Not Applicable
CVE-2026-47262NONE0
github.com/containerd/containerd
v1.7.30
fixed in 1.7.33
Not Applicable
CVE-2026-39827NONE0
golang.org/x/crypto
v0.45.0
fixed in 0.52.0
0.2%
Theoretical Threat
Not Applicable
CVE-2026-39835NONE0
golang.org/x/crypto
v0.45.0
fixed in 0.52.0
0.2%
Theoretical Threat
Not Applicable
CVE-2026-46597NONE0
golang.org/x/crypto
v0.45.0
fixed in 0.52.0
0.4%
Theoretical Threat
Not Applicable
CVE-2026-39831NONE0
golang.org/x/crypto
v0.45.0
fixed in 0.52.0
0.4%
Theoretical Threat
Not Applicable
CVE-2026-39832NONE0
golang.org/x/crypto
v0.45.0
fixed in 0.52.0
0.4%
Theoretical Threat
Not Applicable
CVE-2026-39833NONE0
golang.org/x/crypto
v0.45.0
fixed in 0.52.0
0.4%
Theoretical Threat
Not Applicable
CVE-2026-39834NONE0
golang.org/x/crypto
v0.45.0
fixed in 0.52.0
0.5%
Theoretical Threat
Not Applicable
CVE-2026-25680NONE0
golang.org/x/net
v0.47.0
fixed in 0.55.0
0.2%
Theoretical Threat
Not Applicable
CVE-2026-25681NONE0
golang.org/x/net
v0.47.0
fixed in 0.55.0
0.2%
Theoretical Threat
Not Applicable
CVE-2026-27136NONE0
golang.org/x/net
v0.47.0
fixed in 0.55.0
0.2%
Theoretical Threat
Not Applicable
CVE-2026-42502NONE0
golang.org/x/net
v0.47.0
fixed in 0.55.0
0.2%
Theoretical Threat
Not Applicable
CVE-2026-42506NONE0
golang.org/x/net
v0.47.0
fixed in 0.55.0
0.2%
Theoretical Threat
Not Applicable
CVE-2026-39824NONE0
golang.org/x/sys
v0.40.0
fixed in 0.44.0
0.1%
Theoretical Threat
Not Applicable
CVE-2026-27145NONE0
stdlib
v1.26.0
fixed in 1.25.11, 1.26.4
0.6%
Theoretical Threat
Not Applicable
CVE-2026-39823NONE0
stdlib
v1.26.0
fixed in 1.25.10, 1.26.3
0.3%
Theoretical Threat
Not Applicable
CVE-2026-39825NONE0
stdlib
v1.26.0
fixed in 1.25.10, 1.26.3
0.4%
Theoretical Threat
Not Applicable
CVE-2026-42499NONE0
stdlib
v1.26.0
fixed in 1.25.10, 1.26.3
0.6%
Theoretical Threat
Not Applicable
CVE-2026-42504NONE0
stdlib
v1.26.0
fixed in 1.25.11, 1.26.4
0.6%
Theoretical Threat
Not Applicable