Last scanned:
This image is safe for production use. The provided stats show 24 exposed findings and 1 post-exploit finding, but none reach the severity thresholds that would raise concern; the maximum exposed severity is 4.24 and the maximum post-exploit severity is 1.65. The image is an official Docker Hub image pinned by digest, and the pre-calculated threat score is 0. No top exposed-surface or post-exploit findings or CVE IDs were supplied, so there are no specific CVEs to cite or mitigate from the provided inputs. For this Drupal/PHP-FPM container, the supplied data does not indicate practical exploitable risk under the given scoring model.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2024-45440 | MEDIUM4.24 | drupal/core 9.8.0 fixed in 10.3.6, 11.0.5, 10.2.9 | 9.3% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2024-45440 | MEDIUM4.24 | drupal/core-recommended 9.8.0 fixed in 10.3.6, 11.0.5, 10.2.9 | 9.3% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-58055 | LOW1.65 | nghttp2-libs 1.69.0-r0 fixed in 1.70.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-9082 | NONE0 | drupal/core 9.8.0 fixed in 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10 | 15.7% High Exploitation Risk | Not Applicable |
| CVE-2024-55637 | NONE0 | drupal/core 9.8.0 fixed in 10.2.11, 10.3.9, 11.0.8 | 0.8% Theoretical Threat | Not Applicable |
| CVE-2024-55638 | NONE0 | drupal/core 9.8.0 fixed in 10.2.11, 10.3.9, 7.102 | 1.0% Theoretical Threat | Not Applicable |
| CVE-2024-12393 | NONE0 | drupal/core 9.8.0 fixed in 10.2.11, 10.3.9, 11.0.8 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2024-55634 | NONE0 | drupal/core 9.8.0 fixed in 10.2.11, 10.3.9, 11.0.8 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2025-13081 | NONE0 | drupal/core 9.8.0 fixed in 10.4.9, 10.5.6, 11.1.9, 11.2.8 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2025-3057 | NONE0 | drupal/core 9.8.0 fixed in 10.3.13, 10.4.3, 11.0.12, 11.1.3 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2025-31673 | NONE0 | drupal/core 9.8.0 fixed in 10.3.13, 10.4.3, 11.0.12, 11.1.3 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2025-31674 | NONE0 | drupal/core 9.8.0 fixed in 10.3.13, 10.4.3, 11.0.12, 11.1.3 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-6365 | NONE0 | drupal/core 9.8.0 fixed in 10.5.9, 10.6.7, 11.2.11, 11.3.7 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-6366 | NONE0 | drupal/core 9.8.0 fixed in 10.5.9, 10.6.7, 11.2.11, 11.3.7 | 0.4% Theoretical Threat | Not Applicable |
| GHSA-6ccv-8fgf-cjpw | NONE0 | drupal/core 9.8.0 fixed in 10.1.8, 10.2.2 | — | Not Applicable |
| CVE-2024-55636 | NONE0 | drupal/core 9.8.0 fixed in 10.2.11, 10.3.9, 11.0.8 | 0.9% Theoretical Threat | Not Applicable |
| CVE-2025-13080 | NONE0 | drupal/core 9.8.0 fixed in 10.4.9, 10.5.6, 11.1.9, 11.2.8 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2025-13082 | NONE0 | drupal/core 9.8.0 fixed in 10.4.9, 10.5.6, 11.1.9, 11.2.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2025-13083 | NONE0 | drupal/core 9.8.0 fixed in 10.4.9, 10.5.6, 11.1.9, 11.2.8, 7.103 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2025-31675 | NONE0 | drupal/core 9.8.0 fixed in 10.3.14, 10.4.5, 11.0.13, 11.1.5 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2024-55637 | NONE0 | drupal/core-recommended 9.8.0 fixed in 10.2.11, 10.3.9, 11.0.8 | 0.8% Theoretical Threat | Not Applicable |
| CVE-2024-55638 | NONE0 | drupal/core-recommended 9.8.0 fixed in 10.2.11, 10.3.9, 7.102 | 1.0% Theoretical Threat | Not Applicable |
| CVE-2024-12393 | NONE0 | drupal/core-recommended 9.8.0 fixed in 10.2.11, 10.3.9, 11.0.8 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2024-55634 | NONE0 | drupal/core-recommended 9.8.0 fixed in 10.2.11, 10.3.9, 11.0.8 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2024-55636 | NONE0 | drupal/core-recommended 9.8.0 fixed in 10.2.11, 10.3.9, 11.0.8 | 0.9% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.