Last scanned:
This image is safe for production use. The scan reports 6 exposed and 48 post-exploit-only items, but their maximum severities are 5.1 and 3.54 respectively, and there are no exposed findings at or above severity 6.0 or 7.0. The top exposed and post-exploit finding lists are empty, and no CVE IDs are provided in those inputs, so no specific CVE-based remediation is indicated. Trust signals are positive, including a popular community publisher and digest pinning. Continue normal monitoring and image hygiene.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-78669 | MEDIUM5.1 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM5.1 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97032 | MEDIUM4.02 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78660 | LOW3.83 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86411 | LOW3.54 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-86411 | LOW3.54 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-86409 | LOW3.18 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-86412 | LOW3.18 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-86413 | LOW3.18 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-86409 | LOW3.18 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-86412 | LOW3.18 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-86413 | LOW3.18 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-107928 | LOW2.88 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-107928 | LOW2.88 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-78663 | LOW2.7 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-92386 | LOW2.58 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-92386 | LOW2.58 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-92392 | LOW2.48 | curl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-92392 | LOW2.48 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-86410 | LOW2.45 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-86410 | LOW2.45 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-107929 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-86415 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-87861 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-87862 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-87863 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-87864 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-87865 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-87866 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-92387 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-92389 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-92391 | LOW2.22 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-107929 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-86415 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-87861 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-87862 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-87863 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-87864 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-87865 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-87866 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-92387 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-92389 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-92391 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-94265 | LOW1.86 | curl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| CVE-2026-94265 | LOW1.86 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | — | Post-Exploit |
| GO-2026-5932 | NONE0 | golang.org/x/crypto v0.57.0 No fix yet | — | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.