Vulnerability Reportghost:6.76.0-alpine

ghost:alpine3.23ghost:alpineghost:6.76.0-alpine3.23ghost:6.76.0-alpineghost:6.76-alpine3.23ghost:6.76-alpineghost:6-alpine3.23ghost:6-alpine
digestsha256:5cb5309974c0f0915321a7ea547d82ee97eb1286700e67a837022f8bee06b90a

Executive Summary

Last scanned:

Threat Score
1/100SAFE
Reputation
TRUSTED

This image is safe for production use. The scan found a small number of low-severity issues: two flaws reachable over the network with a maximum severity of 4.5, and 24 flaws that matter only if an attacker has already gotten into the container, with a maximum severity of 3.3. None of these are actively exploited or rated high enough to change the risk picture for this Ghost service. Keep the image pinned by digest and continue routine rebuilds to pick up future fixes.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

  1. Vulnerability scan
    Full CVE sweep across OS packages and app dependencies
  2. Exploitability check
    CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
  3. Reachability analysis
    Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
  4. Runtime verification
    Live-container probes: exposed endpoints, feature flags, real defaults
  5. Supply chain analysis
    Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
  6. Hardening recommendations
    A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

109 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-56851MEDIUM4.5
golang.org/x/text
v0.38.0
fixed in 0.41.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-56852MEDIUM4.5
golang.org/x/text
v0.38.0
fixed in 0.39.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-61801LOW3.3
github.com/moby/sys/user
v0.1.0
fixed in 0.4.1
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-69192LOW3.1
ip-address
10.1.0
fixed in 10.3.1
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-102276LOW2.7
brace-expansion
2.0.2
fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-102278LOW2.7
brace-expansion
2.0.2
fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-14257LOW2.7
brace-expansion
2.0.2
fixed in 5.0.8, 3.0.3, 2.1.3, 1.1.17
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-69152LOW2.7
brace-expansion
2.0.2
fixed in 1.1.18, 2.1.4, 3.0.6, 5.0.9
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-33750LOW2.7
brace-expansion
2.0.2
fixed in 5.0.5, 3.0.2, 2.0.3, 1.1.13
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-93748LOW2.7
http-cache-semantics
4.2.0
No fix yet
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-9496LOW2.7
pacote
19.0.2
fixed in 21.5.1
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-9496LOW2.7
pacote
20.0.1
fixed in 21.5.1
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-33671LOW2.7
picomatch
4.0.3
fixed in 4.0.4, 3.0.2, 2.3.2
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-48815LOW2.7
sigstore
3.1.0
fixed in 4.1.1
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-39824LOW2.4
golang.org/x/sys
v0.1.0
fixed in 0.44.0
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-42338LOW2.2
ip-address
10.1.0
fixed in 10.1.1
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-104844LOW2.12
postcss-selector-parser
7.1.1
fixed in 7.1.6, 6.1.5
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-48758LOW1.94
@sigstore/core
2.0.0
fixed in 3.2.1
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-13149LOW1.91
brace-expansion
2.0.2
fixed in 5.0.7, 1.1.16, 2.1.2
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-102277LOW1.91
brace-expansion
2.0.2
fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-101911LOW1.91
ip-address
10.1.0
fixed in 10.7.1
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-101912LOW1.91
ip-address
10.1.0
fixed in 10.7.1
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-101913LOW1.91
ip-address
10.1.0
fixed in 10.5.1
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-111997LOW1.91
ip-address
10.1.0
fixed in 10.7.4
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-33672LOW1.91
picomatch
4.0.3
fixed in 4.0.4, 3.0.2, 2.3.2
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-9358LOW1.55
postcss-selector-parser
7.1.1
fixed in 6.1.3, 7.1.3
0.3%
Theoretical Threat
Post-Exploit
CVE-2025-68121NONE0
stdlib
v1.24.6
fixed in 1.24.13, 1.25.7, 1.26.0-rc.3
0.9%
Theoretical Threat
Not Applicable
CVE-2026-39821NONE0
stdlib
v1.24.6
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
1.8%
Low-Moderate Risk
Not Applicable
CVE-2026-39821NONE0
stdlib
v1.26.4
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
1.8%
Low-Moderate Risk
Not Applicable
CVE-2026-56858NONE0
stdlib
v1.24.6
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
0.3%
Theoretical Threat
Not Applicable
CVE-2026-56858NONE0
stdlib
v1.26.4
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
0.3%
Theoretical Threat
Not Applicable
CVE-2026-39822NONE0
stdlib
v1.24.6
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.2%
Theoretical Threat
Not Applicable
CVE-2026-39822NONE0
stdlib
v1.26.4
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.2%
Theoretical Threat
Not Applicable
CVE-2025-61726NONE0
stdlib
v1.24.6
fixed in 1.24.12, 1.25.6
2.3%
Low-Moderate Risk
Not Applicable
CVE-2025-61729NONE0
stdlib
v1.24.6
fixed in 1.24.11, 1.25.5
0.5%
Theoretical Threat
Not Applicable
CVE-2026-25679NONE0
stdlib
v1.24.6
fixed in 1.25.8, 1.26.1
0.8%
Theoretical Threat
Not Applicable
CVE-2026-27145NONE0
stdlib
v1.24.6
fixed in 1.25.11, 1.26.4
0.6%
Theoretical Threat
Not Applicable
CVE-2026-32280NONE0
stdlib
v1.24.6
fixed in 1.25.9, 1.26.2
0.6%
Theoretical Threat
Not Applicable
CVE-2026-32281NONE0
stdlib
v1.24.6
fixed in 1.25.9, 1.26.2
0.4%
Theoretical Threat
Not Applicable
CVE-2026-32283NONE0
stdlib
v1.24.6
fixed in 1.25.9, 1.26.2
0.6%
Theoretical Threat
Not Applicable
CVE-2026-33811NONE0
stdlib
v1.24.6
fixed in 1.25.10, 1.26.3
0.9%
Theoretical Threat
Not Applicable
CVE-2026-33814NONE0
stdlib
v1.24.6
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Not Applicable
CVE-2026-33818NONE0
stdlib
v1.24.6
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
0.6%
Theoretical Threat
Not Applicable
CVE-2026-39820NONE0
stdlib
v1.24.6
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Not Applicable
CVE-2026-39836NONE0
stdlib
v1.24.6
fixed in 1.25.10, 1.26.3
0.6%
Theoretical Threat
Not Applicable
CVE-2026-42499NONE0
stdlib
v1.24.6
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Not Applicable
CVE-2026-42504NONE0
stdlib
v1.24.6
fixed in 1.25.11, 1.26.4
0.6%
Theoretical Threat
Not Applicable
CVE-2026-56853NONE0
stdlib
v1.24.6
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
0.6%
Theoretical Threat
Not Applicable
CVE-2026-56859NONE0
stdlib
v1.24.6
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
0.6%
Theoretical Threat
Not Applicable
CVE-2026-56860NONE0
stdlib
v1.24.6
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
0.5%
Theoretical Threat
Not Applicable
CVE-2026-56862NONE0
stdlib
v1.24.6
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
0.6%
Theoretical Threat
Not Applicable
CVE-2026-78667NONE0
stdlib
v1.24.6
fixed in 1.26.9, 1.27.2
0.7%
Theoretical Threat
Not Applicable
CVE-2026-78669NONE0
stdlib
v1.24.6
fixed in 1.26.9, 1.27.2
0.8%
Theoretical Threat
Not Applicable
CVE-2026-97031NONE0
stdlib
v1.24.6
fixed in 1.26.9, 1.27.2
0.7%
Theoretical Threat
Not Applicable
CVE-2025-58183NONE0
stdlib
v1.24.6
fixed in 1.24.8, 1.25.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-58188NONE0
stdlib
v1.24.6
fixed in 1.24.8, 1.25.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-61728NONE0
stdlib
v1.24.6
fixed in 1.24.12, 1.25.6
0.7%
Theoretical Threat
Not Applicable
CVE-2026-78659NONE0
stdlib
v1.24.6
fixed in 1.26.9, 1.27.2
0.9%
Theoretical Threat
Not Applicable
CVE-2026-78660NONE0
stdlib
v1.24.6
fixed in 1.26.9, 1.27.2
0.5%
Theoretical Threat
Not Applicable
CVE-2026-94440NONE0
stdlib
v1.24.6
fixed in 1.26.9, 1.27.2
0.7%
Theoretical Threat
Not Applicable
CVE-2026-33818NONE0
stdlib
v1.26.4
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
0.6%
Theoretical Threat
Not Applicable
CVE-2026-46600NONE0
stdlib
v1.26.4
fixed in 1.26.6, 1.27.0-rc.3
0.5%
Theoretical Threat
Not Applicable
CVE-2026-56853NONE0
stdlib
v1.26.4
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
0.6%
Theoretical Threat
Not Applicable
CVE-2026-56859NONE0
stdlib
v1.26.4
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
0.6%
Theoretical Threat
Not Applicable
CVE-2026-56860NONE0
stdlib
v1.26.4
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
0.5%
Theoretical Threat
Not Applicable
CVE-2026-56862NONE0
stdlib
v1.26.4
fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
0.6%
Theoretical Threat
Not Applicable
CVE-2026-78667NONE0
stdlib
v1.26.4
fixed in 1.26.9, 1.27.2
0.7%
Theoretical Threat
Not Applicable
CVE-2026-78669NONE0
stdlib
v1.26.4
fixed in 1.26.9, 1.27.2
0.8%
Theoretical Threat
Not Applicable
CVE-2026-97031NONE0
stdlib
v1.26.4
fixed in 1.26.9, 1.27.2
0.7%
Theoretical Threat
Not Applicable
CVE-2026-78659NONE0
stdlib
v1.26.4
fixed in 1.26.9, 1.27.2
0.9%
Theoretical Threat
Not Applicable
CVE-2026-78660NONE0
stdlib
v1.26.4
fixed in 1.26.9, 1.27.2
0.5%
Theoretical Threat
Not Applicable
CVE-2026-94440NONE0
stdlib
v1.26.4
fixed in 1.26.9, 1.27.2
0.7%
Theoretical Threat
Not Applicable
CVE-2026-111943NONE0
stdlib
v1.24.6
fixed in 1.26.10, 1.27.3
0.4%
Theoretical Threat
Not Applicable
CVE-2026-111943NONE0
stdlib
v1.26.4
fixed in 1.26.10, 1.27.3
0.4%
Theoretical Threat
Not Applicable
CVE-2025-61727NONE0
stdlib
v1.24.6
fixed in 1.24.11, 1.25.5
0.3%
Theoretical Threat
Not Applicable
CVE-2026-39825NONE0
stdlib
v1.24.6
fixed in 1.25.10, 1.26.3
0.4%
Theoretical Threat
Not Applicable
CVE-2026-56866NONE0
stdlib
v1.24.6
fixed in 1.26.9, 1.27.2
0.6%
Theoretical Threat
Not Applicable
CVE-2026-94439NONE0
stdlib
v1.24.6
fixed in 1.26.9, 1.27.2
0.5%
Theoretical Threat
Not Applicable
CVE-2026-56866NONE0
stdlib
v1.26.4
fixed in 1.26.9, 1.27.2
0.6%
Theoretical Threat
Not Applicable
CVE-2026-94439NONE0
stdlib
v1.26.4
fixed in 1.26.9, 1.27.2
0.5%
Theoretical Threat
Not Applicable
CVE-2026-32282NONE0
stdlib
v1.24.6
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Not Applicable
CVE-2026-32289NONE0
stdlib
v1.24.6
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Not Applicable
CVE-2026-94448NONE0
stdlib
v1.24.6
fixed in 1.26.9, 1.27.2
0.3%
Theoretical Threat
Not Applicable
CVE-2026-97030NONE0
stdlib
v1.24.6
fixed in 1.26.9, 1.27.2
0.3%
Theoretical Threat
Not Applicable
CVE-2026-94448NONE0
stdlib
v1.26.4
fixed in 1.26.9, 1.27.2
0.3%
Theoretical Threat
Not Applicable
CVE-2026-97030NONE0
stdlib
v1.26.4
fixed in 1.26.9, 1.27.2
0.3%
Theoretical Threat
Not Applicable
CVE-2026-97032NONE0
stdlib
v1.24.6
fixed in 1.26.9, 1.27.2
0.7%
Theoretical Threat
Not Applicable
CVE-2026-97032NONE0
stdlib
v1.26.4
fixed in 1.26.9, 1.27.2
0.7%
Theoretical Threat
Not Applicable
CVE-2026-32288NONE0
stdlib
v1.24.6
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Not Applicable
CVE-2026-27142NONE0
stdlib
v1.24.6
fixed in 1.25.8, 1.26.1
0.4%
Theoretical Threat
Not Applicable
CVE-2026-39823NONE0
stdlib
v1.24.6
fixed in 1.25.10, 1.26.3
0.3%
Theoretical Threat
Not Applicable
CVE-2026-39826NONE0
stdlib
v1.24.6
fixed in 1.25.10, 1.26.3
0.4%
Theoretical Threat
Not Applicable
CVE-2025-47912NONE0
stdlib
v1.24.6
fixed in 1.24.8, 1.25.2
0.5%
Theoretical Threat
Not Applicable
CVE-2025-58185NONE0
stdlib
v1.24.6
fixed in 1.24.8, 1.25.2
0.6%
Theoretical Threat
Not Applicable
CVE-2025-58187NONE0
stdlib
v1.24.6
fixed in 1.24.9, 1.25.3
0.4%
Theoretical Threat
Not Applicable
CVE-2025-58189NONE0
stdlib
v1.24.6
fixed in 1.24.8, 1.25.2
0.5%
Theoretical Threat
Not Applicable
CVE-2025-61723NONE0
stdlib
v1.24.6
fixed in 1.24.8, 1.25.2
0.7%
Theoretical Threat
Not Applicable
CVE-2025-61724NONE0
stdlib
v1.24.6
fixed in 1.24.8, 1.25.2
0.6%
Theoretical Threat
Not Applicable
CVE-2025-61725NONE0
stdlib
v1.24.6
fixed in 1.24.8, 1.25.2
0.6%
Theoretical Threat
Not Applicable
CVE-2025-61730NONE0
stdlib
v1.24.6
fixed in 1.24.12, 1.25.6
0.3%
Theoretical Threat
Not Applicable
CVE-2026-42505NONE0
stdlib
v1.24.6
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.4%
Theoretical Threat
Not Applicable
CVE-2026-42507NONE0
stdlib
v1.24.6
fixed in 1.25.11, 1.26.4
0.4%
Theoretical Threat
Not Applicable
CVE-2026-78663NONE0
stdlib
v1.24.6
fixed in 1.26.9, 1.27.2
0.9%
Theoretical Threat
Not Applicable
CVE-2025-58186NONE0
stdlib
v1.24.6
fixed in 1.24.8, 1.25.2
0.6%
Theoretical Threat
Not Applicable
CVE-2026-42505NONE0
stdlib
v1.26.4
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.4%
Theoretical Threat
Not Applicable
CVE-2026-78663NONE0
stdlib
v1.26.4
fixed in 1.26.9, 1.27.2
0.9%
Theoretical Threat
Not Applicable
CVE-2026-56857NONE0
stdlib
v1.24.6
fixed in 1.26.9, 1.27.2
0.6%
Theoretical Threat
Not Applicable
CVE-2026-56857NONE0
stdlib
v1.26.4
fixed in 1.26.9, 1.27.2
0.6%
Theoretical Threat
Not Applicable
CVE-2026-27139NONE0
stdlib
v1.24.6
fixed in 1.25.8, 1.26.1
0.2%
Theoretical Threat
Not Applicable

Want to check another image? Run a full scan with the Docker Security Scanner.