Last scanned:
This image is safe for production use. The scan did record 43 exposed-surface findings and 10 post-exploit-only findings, so these are not absent, but none are rated high severity and none are known to be actively exploited. Their impact is low in this context, so they do not change the risk rating. Running as root is worth tightening over time to reduce the impact of any future flaw.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-97032 | MEDIUM5.9 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-111497 | MEDIUM5.59 | libbrotlicommon1 1.2.0-r5 fixed in 1.2.0-r7 | 36.0% High Exploitation Risk | Directly Exposed |
| CVE-2026-111497 | MEDIUM5.59 | libbrotlidec1 1.2.0-r5 fixed in 1.2.0-r7 | 36.0% High Exploitation Risk | Directly Exposed |
| CVE-2026-111943 | MEDIUM5.44 | ca-certificates-bundle 20260611-r1 fixed in 20260909-r3 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-111943 | MEDIUM5.44 | stdlib v1.27.1 fixed in 1.26.10, 1.27.3 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78663 | MEDIUM5.3 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-85091 | MEDIUM5 | zlib 1.3.2-r6 fixed in 1.3.2.1_rc20260601-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78669 | MEDIUM4.5 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78659 | MEDIUM4.5 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78667 | MEDIUM4.5 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78669 | MEDIUM4.5 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-97031 | MEDIUM4.5 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78659 | MEDIUM4.5 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-94440 | MEDIUM4.5 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-86805 | MEDIUM4.2 | glibc-2.44 2.44-r6 fixed in 2.44-r8 | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-95818 | MEDIUM4.2 | glibc-2.44 2.44-r6 fixed in 2.44-r8 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-86805 | MEDIUM4.2 | glibc-2.44-locale-posix 2.44-r6 fixed in 2.44-r8 | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-95818 | MEDIUM4.2 | glibc-2.44-locale-posix 2.44-r6 fixed in 2.44-r8 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-86805 | MEDIUM4.2 | ld-linux-2.44 2.44-r6 fixed in 2.44-r8 | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-95818 | MEDIUM4.2 | ld-linux-2.44 2.44-r6 fixed in 2.44-r8 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-86805 | MEDIUM4.2 | libcrypt1-2.44 2.44-r6 fixed in 2.44-r8 | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-95818 | MEDIUM4.2 | libcrypt1-2.44 2.44-r6 fixed in 2.44-r8 | 0.1% Theoretical Threat | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.56.0 No fix yet | — | Directly Exposed |
| CVE-2026-56866 | LOW3.9 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94439 | LOW3.9 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-94448 | LOW3.66 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-97030 | LOW3.66 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | LOW3.54 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/sdk v1.44.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56857 | LOW3.3 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | LOW3.18 | git-lfs 3.8.0-r1 fixed in 3.8.0-r3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-8674 | LOW3.18 | glibc-2.44 2.44-r6 fixed in 2.44-r8 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-8674 | LOW3.18 | glibc-2.44-locale-posix 2.44-r6 fixed in 2.44-r8 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-8674 | LOW3.18 | ld-linux-2.44 2.44-r6 fixed in 2.44-r8 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-8674 | LOW3.18 | libcrypt1-2.44 2.44-r6 fixed in 2.44-r8 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-53493 | LOW3.18 | github.com/containerd/containerd v1.7.35 fixed in 1.7.36 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | LOW3.18 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-92392 | LOW2.92 | libcurl-openssl4 8.22.0-r2 fixed in 8.23.0-r0 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-78669 | LOW2.7 | git-lfs 3.8.0-r1 fixed in 3.8.0-r3 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-97031 | LOW2.7 | git-lfs 3.8.0-r1 fixed in 3.8.0-r2 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-78659 | LOW2.7 | git-lfs 3.8.0-r1 fixed in 3.8.0-r3 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-78660 | LOW2.7 | git-lfs 3.8.0-r1 fixed in 3.8.0-r3 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-94440 | LOW2.7 | git-lfs 3.8.0-r1 fixed in 3.8.0-r2 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-89092 | LOW2.52 | glibc-2.44 2.44-r6 fixed in 2.44-r8 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | LOW2.52 | glibc-2.44-locale-posix 2.44-r6 fixed in 2.44-r8 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | LOW2.52 | ld-linux-2.44 2.44-r6 fixed in 2.44-r8 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | LOW2.52 | libcrypt1-2.44 2.44-r6 fixed in 2.44-r8 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-111943 | LOW2.45 | git-lfs 3.8.0-r1 fixed in 3.8.0-r4 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-56866 | LOW2.34 | git-lfs 3.8.0-r1 fixed in 3.8.0-r2 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-94439 | LOW2.34 | git-lfs 3.8.0-r1 fixed in 3.8.0-r2 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-97032 | LOW2.12 | git-lfs 3.8.0-r1 fixed in 3.8.0-r3 | 0.5% Theoretical Threat | Post-Exploit |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.