Vulnerability Reportgoogle/cadvisor:latest

google/cadvisor:latest

digestsha256:815386ebbe9a3490f38785ab11bda34ec8dacf4634af77b8912832d4f85dca04

Executive Summary

Last scanned: Jul 28, 2026

Threat ScoreDANGEROUS• Critical CVE-2019-14697 in musl libc (CVSS 9.8) allows remote code execution via out-of-bounds writes, affecting the core C library in a network-facing container.• The vulnerability is in the exposed surface with high context importance and no special configuration requirements, making it easily exploitable.• Though the image is from a verified publisher (Google) and pinned by digest, it is outdated (last updated 2021) and contains 3 exposed vulnerabilities, 1 critical.

75/100DANGEROUS

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker could exploit CVE-2019-14697 to execute arbitrary code on the host or crash the service, potentially leading to full system compromise. Updating musl libc to a version beyond 1.1.23 would fully mitigate this vulnerability.

Hardening plan for this image · 3 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

10 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2019-14697	CRITICAL9.8	musl 1.1.18-r2 fixed in 1.1.18-r4	2.5% Low-Moderate Risk	Directly ExposedContext importance: HIGH
CVE-2018-0495	MEDIUM4	libressl2.6-libcrypto 2.6.3-r0 fixed in 2.6.5-r0	0.9% Theoretical Threat	Directly Exposed
CVE-2018-0495	MEDIUM4	libressl2.6-libssl 2.6.3-r0 fixed in 2.6.5-r0	0.9% Theoretical Threat	Directly Exposed
CVE-2018-20483	LOW3.98	wget 1.19.5-r0 fixed in 1.20.1-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2019-14697	LOW3.53	musl-utils 1.1.18-r2 fixed in 1.1.18-r4	2.5% Low-Moderate Risk	Post-Exploit
CVE-2018-0732	LOW3.1	libressl2.6-libcrypto 2.6.3-r0 fixed in 2.6.5-r0	49.3% High Exploitation Risk	Post-Exploit
CVE-2018-0732	LOW3.1	libressl2.6-libssl 2.6.3-r0 fixed in 2.6.5-r0	49.3% High Exploitation Risk	Post-Exploit
CVE-2018-20843	LOW2.7	expat 2.2.5-r0 fixed in 2.2.7-r0	7.1% Low-Moderate Risk	Post-Exploit
CVE-2019-15903	LOW2.7	expat 2.2.5-r0 fixed in 2.2.7-r1	6.7% Low-Moderate Risk	Post-Exploit
CVE-2018-20217	LOW1.91	krb5-libs 1.15.3-r0 fixed in 1.15.4-r0	1.5% Low-Moderate Risk	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.