Last scanned:
This image is safe for production use. While the image contains some low-severity vulnerabilities (max exposed severity 5.3), none are exploitable in the default configuration. The sole post-exploit finding, CVE-2025-15467, only matters if the application parses attacker-controlled CMS/PKCS#7 messages, which is not the case for the fixed Deno eval script that simply prints a welcome message. Therefore, the practical risk is minimal for typical production usage.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2019-1010025 | MEDIUM5.3 | libc6 2.36-9+deb12u13 No fix yet | 2.3% Low-Moderate Risk | Directly Exposed |
| CVE-2026-5435 | MEDIUM5.02 | libc6 2.36-9+deb12u13 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-15281 | MEDIUM5.02 | libc6 2.36-9+deb12u13 fixed in 2.36-9+deb12u14 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-69420 | MEDIUM5.02 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.18-1~deb12u2 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-22796 | MEDIUM5.02 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.18-1~deb12u2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.02 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.20-1~deb12u2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.02 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.20-1~deb12u2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-34180 | MEDIUM5 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.20-1~deb12u2 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2022-27943 | MEDIUM4.67 | libgcc-s1 12.2.0-14+deb12u1 No fix yet | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | MEDIUM4.67 | libgomp1 12.2.0-14+deb12u1 No fix yet | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-22795 | MEDIUM4.67 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.18-1~deb12u2 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-7383 | MEDIUM4.67 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.20-1~deb12u2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | MEDIUM4.67 | libstdc++6 12.2.0-14+deb12u1 No fix yet | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-0915 | MEDIUM4.5 | libc6 2.36-9+deb12u13 fixed in 2.36-9+deb12u14 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-4046 | MEDIUM4.5 | libc6 2.36-9+deb12u13 fixed in 2.36-9+deb12u14 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | MEDIUM4.5 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.20-1~deb12u2 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-42767 | MEDIUM4.5 | libssl3 3.0.18-1~deb12u1 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-5450 | MEDIUM4.25 | libc6 2.36-9+deb12u13 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-5928 | MEDIUM4.25 | libc6 2.36-9+deb12u13 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-15467 | MEDIUM4.06 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.18-1~deb12u2 | 47.6% High Exploitation Risk | Post-Exploit |
| CVE-2025-68160 | MEDIUM4 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.18-1~deb12u2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2010-4756 | MEDIUM4 | libc6 2.36-9+deb12u13 No fix yet | 2.6% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010022 | LOW3.53 | libc6 2.36-9+deb12u13 No fix yet | 3.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-4438 | LOW3.4 | libc6 2.36-9+deb12u13 fixed in 2.36-9+deb12u14 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-69418 | LOW3.4 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.18-1~deb12u2 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2019-1010023 | LOW3.17 | libc6 2.36-9+deb12u13 No fix yet | 3.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-45446 | LOW3.15 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.20-1~deb12u2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-31789 | LOW3 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.19-1~deb12u2 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-45447 | LOW2.92 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.20-1~deb12u2 | 5.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-45445 | LOW2.78 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.20-1~deb12u2 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2018-20796 | LOW2.7 | libc6 2.36-9+deb12u13 No fix yet | 5.8% Low-Moderate Risk | Post-Exploit |
| CVE-2019-9192 | LOW2.7 | libc6 2.36-9+deb12u13 No fix yet | 2.4% Low-Moderate Risk | Post-Exploit |
| CVE-2026-28388 | LOW2.7 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.19-1~deb12u2 | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-28389 | LOW2.7 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.19-1~deb12u2 | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2026-28390 | LOW2.7 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.19-1~deb12u2 | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2026-0861 | LOW2.48 | libc6 2.36-9+deb12u13 fixed in 2.36-9+deb12u14 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-28387 | LOW2.48 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.19-1~deb12u2 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2025-69421 | LOW2.29 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.18-1~deb12u2 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2025-69419 | LOW2.26 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.18-1~deb12u2 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-34182 | LOW2.26 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.20-1~deb12u2 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-31790 | LOW2.12 | libssl3 3.0.18-1~deb12u1 fixed in 3.0.19-1~deb12u2 | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-4437 | LOW1.99 | libc6 2.36-9+deb12u13 fixed in 2.36-9+deb12u14 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-6238 | LOW1.99 | libc6 2.36-9+deb12u13 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2019-1010024 | LOW1.91 | libc6 2.36-9+deb12u13 No fix yet | 3.2% Low-Moderate Risk | Post-Exploit |
| CVE-2022-27943 | NONE0 | gcc-12-base 12.2.0-14+deb12u1 No fix yet | 0.9% Theoretical Threat | Not Applicable |
| CVE-2025-27587 | NONE0 | libssl3 3.0.18-1~deb12u1 No fix yet | 0.4% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.