Vulnerability Reportgetnora/nora:latest

getnora/nora:latestgetnora/nora:1.4.0-02f95bfgetnora/nora:1.4getnora/nora:1.4.0

digestsha256:e9eebedf70536e1c7ba2c4cc3c6d71b7ef9f4f2857d284651e8899eb999e4357

Executive Summary

Last scanned: Oct 20, 2026

Threat ScoreSAFE• No exposed-surface findings are present; exposed_total is 0 and exposed_max_severity is 0.0.• No post-exploit-only findings are present; post_total is 0 and post_max_severity is 0.0.• No CVE IDs appear in the provided findings, so no CVE-specific mitigations are required from the supplied data.• The image is pinned by digest, which makes the deployed artifact immutable.• Trust is limited because the publisher is an unverified community image and is not official, verified, or popular.

5/100SAFE

ReputationCOMMUNITY• Community Image with low/unknown reputation• Pinned by digest (Immutable)

UNVERIFIED

This image is safe for production use. The provided scan reports exposed_total 0, post_total 0, exposed_max_severity 0.0, and post_max_severity 0.0, with no CVE IDs in the findings. The main caveat is trust: it is a community image that is not official or verified, so confirm provenance and deployment controls before relying on it.

Vulnerabilities

Vulnerability Log

0 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
No vulnerabilities found matching filters.

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.