Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who submits a crafted image through an affected feature could crash the worker, leak process memory back to the uploader, or in some builds run code within this pgAdmin container. Note: CVE-2026-112393 only applies if the application re-saves untrusted images through Pillow, and CVE-2026-96639 only applies if it opens untrusted multi-frame images. Those features are not stated in the image configuration, so their relevance must be confirmed in your deployment before this image is relied upon.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-112393 | HIGH7.84 | pillow 12.3.0 fixed in 13.0.0 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-96639 | HIGH7.84 | pillow 12.3.0 fixed in 13.0.0 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112403 | HIGH7.36 | pillow 12.3.0 fixed in 13.0.0 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| GHSA-6q48-6c7w-9gw2 | HIGH7.28 | certifi 2026.6.17 fixed in 2026.10.18 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-6q48-6c7w-9gw2 | HIGH7.28 | certifi 2026.7.22 fixed in 2026.10.18 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112902 | HIGH7.04 | pillow 12.3.0 fixed in 13.0.0 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-102275 | MEDIUM6.56 | PyJWT 2.14.0 fixed in 2.15.0 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112404 | MEDIUM6.56 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112395 | MEDIUM6.56 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-96778 | MEDIUM6.48 | pillow 12.3.0 fixed in 13.0.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| GHSA-78g4-xqwv-q3g8 | MEDIUM6.48 | pillow 12.3.0 fixed in 13.0.0 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-6v7p-g79w-8964 | MEDIUM6 | msgpack 1.1.2 fixed in 1.2.1 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112399 | MEDIUM6 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112405 | MEDIUM6 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112406 | MEDIUM6 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112892 | MEDIUM6 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112893 | MEDIUM6 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112894 | MEDIUM6 | pillow 12.3.0 fixed in 13.0.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112895 | MEDIUM6 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112897 | MEDIUM6 | pillow 12.3.0 fixed in 13.0.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-96640 | MEDIUM6 | pillow 12.3.0 fixed in 13.0.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-96643 | MEDIUM6 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112391 | MEDIUM6 | pillow 12.3.0 fixed in 13.0.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112396 | MEDIUM6 | pillow 12.3.0 fixed in 13.0.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-96644 | MEDIUM5.68 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-111497 | MEDIUM5.59 | brotli-libs 1.2.0-r1 fixed in 1.2.1-r0 | 36.0% High Exploitation Risk | Directly Exposed |
| GHSA-9v8h-qqgm-4m35 | MEDIUM5.52 | brotli 1.2.0 fixed in 1.2.1 | — | Directly Exposed |
| CVE-2026-112398 | MEDIUM5.52 | pillow 12.3.0 fixed in 13.0.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-112900 | MEDIUM5.52 | pillow 12.3.0 fixed in 13.0.0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-112899 | MEDIUM5.52 | pillow 12.3.0 fixed in 13.0.0 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-96637 | MEDIUM5.2 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-96642 | MEDIUM5.2 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-96636 | MEDIUM5.2 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-96638 | MEDIUM5.2 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-96641 | MEDIUM5.2 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-85091 | MEDIUM5 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-112896 | MEDIUM4.92 | pillow 12.3.0 fixed in 13.0.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-112394 | MEDIUM4.92 | pillow 12.3.0 fixed in 13.0.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-97687 | MEDIUM4.86 | urllib3 2.7.0 fixed in 2.8.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-101918 | MEDIUM4.5 | PyJWT 2.14.0 fixed in 2.15.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-112390 | MEDIUM4.5 | pillow 12.3.0 fixed in 13.0.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-112392 | MEDIUM4.5 | pillow 12.3.0 fixed in 13.0.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-112397 | MEDIUM4.5 | pillow 12.3.0 fixed in 13.0.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-112400 | MEDIUM4.5 | pillow 12.3.0 fixed in 13.0.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-112402 | MEDIUM4.5 | pillow 12.3.0 fixed in 13.0.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-97689 | MEDIUM4.5 | urllib3 2.7.0 fixed in 2.8.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-112401 | MEDIUM4.24 | pillow 12.3.0 fixed in 13.0.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112891 | MEDIUM4.24 | pillow 12.3.0 fixed in 13.0.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112898 | MEDIUM4.24 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-112901 | MEDIUM4.24 | pillow 12.3.0 fixed in 13.0.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-49265 | MEDIUM4.08 | oauthlib 3.3.1 fixed in 4.0.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.6-r2 fixed in 1.2.6-r3 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.6-r2 fixed in 1.2.6-r3 | — | Directly Exposed |
| CVE-2026-102991 | LOW3.9 | Mako 1.4.1 fixed in 1.4.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-49264 | LOW3.66 | oauthlib 3.3.1 fixed in 4.0.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-44405 | LOW3.4 | paramiko 3.5.1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-58055 | LOW3.24 | nghttp2-libs 1.69.0-r0 fixed in 1.70.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102598 | LOW3.18 | Werkzeug 3.1.8 fixed in 3.1.9 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-114603 | LOW3.18 | opentelemetry-api 1.44.0 fixed in 1.45.1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-97688 | LOW3.18 | urllib3 2.7.0 fixed in 2.8.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-47273 | LOW3.17 | setuptools 70.3.0 fixed in 78.1.1 | 1.6% Low-Moderate Risk | Post-Exploit |
| CVE-2026-114501 | LOW2.96 | pillow 12.3.0 fixed in 13.0.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-92392 | LOW2.92 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-107928 | LOW2.88 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-96512 | LOW2.81 | sudo 1.9.17_p2-r1 fixed in 1.9.17_p2-r2 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-92386 | LOW2.58 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86410 | LOW2.45 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-107929 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86415 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87861 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87862 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-87863 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87864 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87865 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-87866 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92387 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-92389 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-92391 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-59890 | LOW2.2 | setuptools 70.3.0 fixed in 83.0.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-86411 | LOW2.12 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86409 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86412 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86413 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-94265 | LOW1.86 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| GHSA-xmj3-9gf7-h52w | LOW0.36 | setuptools 70.3.0 fixed in 84.1.0 | — | Post-Exploit |
| GHSA-xmj3-9gf7-h52w | LOW0.36 | setuptools 84.0.0 fixed in 84.1.0 | — | Post-Exploit |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.