Last scanned:
This image is safe for production use. The scan did find vulnerabilities, including 34 that are reachable from the network in normal operation, but their highest severity is 5.5 and none are known to be actively exploited, so they do not change the verdict. The 14 issues that only matter after an attacker has already gained access have a highest severity of 3.3 and add little practical risk. Remediating the lower-severity findings over time is still good hygiene, and running the container as a non-root user would reduce the impact of any future compromise.
Already in good shape · 2 hardening steps left
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2025-66382 | MEDIUM5.5 | libexpat1 2.4.7-1ubuntu0.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc-bin 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-34478 | MEDIUM4.5 | org.apache.logging.log4j:log4j-core 2.24.3 fixed in 2.25.4 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-34479 | MEDIUM4.5 | org.apache.logging.log4j:log4j-core 2.24.3 fixed in 2.25.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-34480 | MEDIUM4.5 | org.apache.logging.log4j:log4j-core 2.24.3 fixed in 2.25.4 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34481 | MEDIUM4.5 | org.apache.logging.log4j:log4j-layout-template-json 2.24.3 fixed in 2.25.4 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc-bin 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88647 | MEDIUM4.14 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88648 | MEDIUM4.14 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-2 2.1.27+dfsg2-3ubuntu1.2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-modules-db 2.1.27+dfsg2-3ubuntu1.2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89158 | LOW3.9 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2022-4899 | LOW3.9 | libzstd1 1.4.8+dfsg-3build1 No fix yet | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-67693 | LOW3.54 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-49844 | LOW3.54 | org.apache.logging.log4j:log4j-api 2.24.3 fixed in 2.25.5, 2.26.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-34477 | LOW3.54 | org.apache.logging.log4j:log4j-core 2.24.3 fixed in 2.25.4 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | gcc-12-base 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | libgcc-s1 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | libstdc++6 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-102473 | LOW3.3 | dash 0.5.11+git20210903+057cd650a4ed-3build1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW3.3 | libsystemd0 249.11-0ubuntu3.23 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW3.3 | libudev1 249.11-0ubuntu3.23 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95184 | LOW3.18 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95209 | LOW3 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95210 | LOW3 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-68161 | LOW2.88 | org.apache.logging.log4j:log4j-core 2.24.3 fixed in 2.25.3 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-18477 | LOW2.64 | tar 1.34+dfsg-1ubuntu0.1.22.04.6 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.64 | tar 1.34+dfsg-1ubuntu0.1.22.04.6 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-102474 | LOW2.4 | dash 0.5.11+git20210903+057cd650a4ed-3build1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | libncurses6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | libncursesw6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2022-41409 | LOW2.34 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2023-50495 | LOW2.34 | libtinfo6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | ncurses-base 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | ncurses-bin 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2021-31879 | LOW2.2 | wget 1.21.2-2ubuntu1.5 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | login 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-29383 | LOW1.68 | login 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-29383 | LOW1.68 | passwd 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-18374 | NONE0 | locales 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-89092 | NONE0 | locales 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Not Applicable |
Want to check another image? Run a full scan with the Docker Security Scanner.