Vulnerability Reportgitlab/gitlab-ce:19.1.8-ce.0

gitlab/gitlab-ce:19.1.8-ce.0
digestsha256:4807928c73ed3d7ff9babf196d6894615ec689b9f1829418d21e5824fdd2cddd

Executive Summary

Last scanned:

Threat Score
0/100SAFE
Reputation
RELIABLE

This image is safe for production use. It does have 52 exposed and 36 post-exploit findings in the scan, but none are in the higher severity bands, with maximum severities of 5.78 and 3.98 respectively. The image comes from a popular community publisher, has a reliable trust verdict, and is pinned by digest. No CVE IDs are provided in the top findings, and the supplied inputs do not identify high or critical exposed-surface risk.

Vulnerabilities

Vulnerability Log

89 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-19499MEDIUM5.78
libc-bin
2.39-0ubuntu8.8
fixed in 2.39-0ubuntu8.9
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-19499MEDIUM5.78
libc6
2.39-0ubuntu8.8
fixed in 2.39-0ubuntu8.9
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-86145MEDIUM5.58
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-103111MEDIUM5.17
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.2%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-106553MEDIUM5.1
openssh-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.1%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-106555MEDIUM5.1
openssh-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.1%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-106553MEDIUM5.1
openssh-sftp-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.1%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-106555MEDIUM5.1
openssh-sftp-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.1%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-6791MEDIUM5.02
libc-bin
2.39-0ubuntu8.8
fixed in 2.39-0ubuntu8.9
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-77117MEDIUM5.02
libc-bin
2.39-0ubuntu8.8
fixed in 2.39-0ubuntu8.9
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-80489MEDIUM5.02
libc-bin
2.39-0ubuntu8.8
fixed in 2.39-0ubuntu8.9
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-6791MEDIUM5.02
libc6
2.39-0ubuntu8.8
fixed in 2.39-0ubuntu8.9
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-77117MEDIUM5.02
libc6
2.39-0ubuntu8.8
fixed in 2.39-0ubuntu8.9
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-80489MEDIUM5.02
libc6
2.39-0ubuntu8.8
fixed in 2.39-0ubuntu8.9
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-89156MEDIUM5.02
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-75805MEDIUM5.02
libssl3t64
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-77696MEDIUM5.02
libssl3t64
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-15534MEDIUM4.84
libperl5.38t64
5.38.2-3.2ubuntu0.4
fixed in 5.38.2-3.2ubuntu0.6
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-15534MEDIUM4.84
perl-modules-5.38
5.38.2-3.2ubuntu0.4
fixed in 5.38.2-3.2ubuntu0.6
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-6368MEDIUM4.67
libc-bin
2.39-0ubuntu8.8
fixed in 2.39-0ubuntu8.9
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-6368MEDIUM4.67
libc6
2.39-0ubuntu8.8
fixed in 2.39-0ubuntu8.9
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-75806MEDIUM4.5
libssl3t64
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-89160MEDIUM4.42
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-106585MEDIUM4.42
openssh-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.2%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-106585MEDIUM4.42
openssh-sftp-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.2%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-18374MEDIUM4.17
libc-bin
2.39-0ubuntu8.8
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-18374MEDIUM4.17
libc6
2.39-0ubuntu8.8
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-106583LOW3.98
openssh-client
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-89157LOW3.77
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-84782LOW3.77
libssl3t64
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-106586LOW3.65
openssh-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-106586LOW3.65
openssh-sftp-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-19542LOW3.57
libc-bin
2.39-0ubuntu8.8
fixed in 2.39-0ubuntu8.9
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-89092LOW3.57
libc-bin
2.39-0ubuntu8.8
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-19542LOW3.57
libc6
2.39-0ubuntu8.8
fixed in 2.39-0ubuntu8.9
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-89092LOW3.57
libc6
2.39-0ubuntu8.8
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-89158LOW3.31
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-35189LOW3.15
libssl3t64
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-106582LOW3.15
openssh-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-106582LOW3.15
openssh-sftp-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-54872LOW3.01
libssl3t64
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-77696LOW3.01
openssl
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-15534LOW2.91
perl
5.38.2-3.2ubuntu0.4
fixed in 5.38.2-3.2ubuntu0.6
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-15534LOW2.91
perl-base
5.38.2-3.2ubuntu0.4
fixed in 5.38.2-3.2ubuntu0.6
0.3%
Theoretical Threat
Post-Exploit
CVE-2023-42366LOW2.8
busybox
1:1.36.1-6ubuntu3.1
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-102473LOW2.8
dash
0.5.12-6ubuntu5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-40228LOW2.8
libsystemd0
255.4-1ubuntu8.17
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-40228LOW2.8
libudev1
255.4-1ubuntu8.17
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-106584LOW2.8
openssh-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
<0.1%
Theoretical Threat
Directly Exposed
CVE-2026-106587LOW2.8
openssh-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
<0.1%
Theoretical Threat
Directly Exposed
CVE-2026-106584LOW2.8
openssh-sftp-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
<0.1%
Theoretical Threat
Directly Exposed
CVE-2026-106587LOW2.8
openssh-sftp-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
<0.1%
Theoretical Threat
Directly Exposed
CVE-2025-60876LOW2.75
busybox
1:1.36.1-6ubuntu3.1
No fix yet
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-75806LOW2.7
openssl
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-89161LOW2.39
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-106583LOW2.39
openssh-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-106583LOW2.39
openssh-sftp-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-106553LOW2.29
openssh-client
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-106555LOW2.29
openssh-client
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-84782LOW2.26
openssl
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-18477LOW2.24
tar
1.35+dfsg-3ubuntu0.4
No fix yet
<0.1%
Theoretical Threat
Post-Exploit
CVE-2026-18508LOW2.24
tar
1.35+dfsg-3ubuntu0.4
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2021-31879LOW2.2
wget
1.21.4-1ubuntu4.5
No fix yet
1.1%
Low-Moderate Risk
Post-Exploit
CVE-2026-106586LOW2.19
openssh-client
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-102474LOW2.04
dash
0.5.12-6ubuntu5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-19487LOW1.99
libperl5.38t64
5.38.2-3.2ubuntu0.4
fixed in 5.38.2-3.2ubuntu0.6
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-106552LOW1.99
openssh-client
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-106585LOW1.99
openssh-client
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-106552LOW1.99
openssh-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-106552LOW1.99
openssh-sftp-server
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-19487LOW1.99
perl
5.38.2-3.2ubuntu0.4
fixed in 5.38.2-3.2ubuntu0.6
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-19487LOW1.99
perl-base
5.38.2-3.2ubuntu0.4
fixed in 5.38.2-3.2ubuntu0.6
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-19487LOW1.99
perl-modules-5.38
5.38.2-3.2ubuntu0.4
fixed in 5.38.2-3.2ubuntu0.6
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-106582LOW1.89
openssh-client
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-35189LOW1.89
openssl
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.3%
Theoretical Threat
Post-Exploit
CVE-2024-56433LOW1.84
passwd
1:4.13+dfsg1-4ubuntu3.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-54872LOW1.81
openssl
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-75805LOW1.81
openssl
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-46394LOW1.68
busybox
1:1.36.1-6ubuntu3.1
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-106584LOW1.68
openssh-client
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
<0.1%
Theoretical Threat
Post-Exploit
CVE-2026-106587LOW1.68
openssh-client
1:9.6p1-3ubuntu13.19
fixed in 1:9.6p1-3ubuntu13.20
<0.1%
Theoretical Threat
Post-Exploit
CVE-2024-56433NONE0
login
1:4.13+dfsg1-4ubuntu3.2
No fix yet
0.4%
Theoretical Threat
Not Applicable
CVE-2024-58251NONE0
busybox
1:1.36.1-6ubuntu3.1
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-67693NONE0
libgnutls30t64
3.8.3-1.1ubuntu3.6
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-88647NONE0
libgnutls30t64
3.8.3-1.1ubuntu3.6
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-95184NONE0
libgnutls30t64
3.8.3-1.1ubuntu3.6
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-95209NONE0
libgnutls30t64
3.8.3-1.1ubuntu3.6
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-95210NONE0
libgnutls30t64
3.8.3-1.1ubuntu3.6
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-85091NONE0
zlib1g
1:1.3.dfsg-3.1ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.