Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could exploit exposed denial-of-service flaws such as CVE-2026-66046 or CVE-2026-92599 to stall or crash Kibana, disrupting service availability, while other medium-severity dependency issues could undermine host-based security decisions or signature validation if those code paths process untrusted input.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-66046 | MEDIUM6.38 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-76641 | MEDIUM6.38 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-93687 | MEDIUM6.38 | braces 3.0.3 No fix yet | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-84292 | MEDIUM6.38 | fast-uri 3.1.6 fixed in 2.4.6, 3.1.7, 4.1.4 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-84394 | MEDIUM6.38 | fast-uri 3.1.6 fixed in 2.4.6, 3.1.7, 4.1.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-92599 | MEDIUM6.38 | joi 18.2.1 fixed in 17.13.7, 18.2.6 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-85393 | MEDIUM6.38 | node-forge 1.4.0 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-88647 | MEDIUM6.29 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM6.29 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-84782 | MEDIUM6.29 | libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101905 | MEDIUM6.29 | axios 1.19.0 fixed in 1.20.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102282 | MEDIUM6.03 | adm-zip 0.6.0 fixed in 0.6.1 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-46675 | MEDIUM5.9 | libpng16-16t64 1.6.43-5ubuntu0.6 fixed in 1.6.43-5ubuntu0.7 | — | Directly Exposed |
| CVE-2026-56132 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56403 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56404 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56405 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56406 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56407 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56410 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56411 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-89158 | MEDIUM5.52 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | MEDIUM5.52 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-8769 | MEDIUM5.52 | @ai-sdk/provider-utils 3.0.25 fixed in 3.0.28, 4.0.33, 5.0.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-77301 | MEDIUM5.52 | adm-zip 0.6.0 fixed in 0.6.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-76845 | MEDIUM5.52 | adm-zip 0.6.0 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-101907 | MEDIUM5.52 | axios 1.19.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101899 | MEDIUM5.52 | axios 1.19.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-101900 | MEDIUM5.52 | axios 1.19.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-101904 | MEDIUM5.52 | axios 1.19.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101908 | MEDIUM5.52 | axios 1.19.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102278 | MEDIUM5.52 | brace-expansion 1.1.18 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102278 | MEDIUM5.52 | brace-expansion 2.1.4 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102278 | MEDIUM5.52 | brace-expansion 5.0.9 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-106445 | MEDIUM5.5 | handlebars 4.7.9 fixed in 4.7.10 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-59375 | MEDIUM5.3 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 1.3% Low-Moderate Risk | Directly Exposed |
| CVE-2026-72522 | MEDIUM5.27 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-66010 | MEDIUM5.18 | dompurify 3.4.11 fixed in 3.4.12 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45822 | MEDIUM5.1 | decode-uri-component 0.2.2 fixed in 0.5.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-50219 | MEDIUM5.02 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56412 | MEDIUM5.02 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-67693 | MEDIUM5.02 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | MEDIUM5.02 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-54872 | MEDIUM5.02 | libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | MEDIUM5.02 | libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-77696 | MEDIUM5.02 | libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-101902 | MEDIUM5.02 | axios 1.19.0 fixed in 0.34.0, 1.20.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-90771 | MEDIUM5.02 | joi 18.2.1 fixed in 17.13.8, 18.2.9 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-17495 | MEDIUM5.02 | moment 2.30.1 fixed in 2.31.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-85024 | MEDIUM5.02 | undici 6.28.0 fixed in 6.28.1, 7.29.1, 8.10.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-66382 | MEDIUM4.67 | libexpat1 2.6.1-2ubuntu0.4 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-32776 | MEDIUM4.67 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-32777 | MEDIUM4.67 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-32778 | MEDIUM4.67 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95512 | MEDIUM4.67 | libfreetype6 2.13.2+dfsg-1ubuntu0.1 fixed in 2.13.2+dfsg-1ubuntu0.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2024-53382 | MEDIUM4.59 | prismjs 1.27.0 fixed in 1.30.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | MEDIUM4.5 | libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-2739 | MEDIUM4.5 | bn.js 4.11.9 fixed in 4.12.3, 5.2.3 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-102277 | MEDIUM4.5 | brace-expansion 1.1.18 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102277 | MEDIUM4.5 | brace-expansion 2.1.4 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102277 | MEDIUM4.5 | brace-expansion 5.0.9 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-39113 | MEDIUM4.25 | libsqlite3-0 3.45.1-1ubuntu2.7 fixed in 3.45.1-1ubuntu2.8 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.17 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.17 | libc6 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-101898 | MEDIUM4.08 | axios 1.19.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-86472 | MEDIUM4.08 | fast-uri 3.1.6 fixed in 2.4.7, 3.1.8, 4.1.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-106444 | MEDIUM4 | handlebars 4.7.9 fixed in 4.7.10 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56131 | LOW3.82 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | LOW3.57 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | LOW3.57 | libc6 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-41080 | LOW3.15 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-35189 | LOW3.15 | libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-84367 | LOW3.15 | joi 18.2.1 fixed in 17.13.5, 18.2.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84368 | LOW3.15 | joi 18.2.1 fixed in 17.13.6, 18.2.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18540 | LOW3.15 | undici 6.28.0 fixed in 6.28.1, 7.29.1, 8.10.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | LOW3.01 | openssl 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-77696 | LOW3.01 | openssl 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-15534 | LOW2.91 | perl-base 5.38.2-3.2ubuntu0.4 fixed in 5.38.2-3.2ubuntu0.6 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-102473 | LOW2.8 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW2.8 | libsystemd0 255.4-1ubuntu8.17 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW2.8 | libudev1 255.4-1ubuntu8.17 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | LOW2.7 | openssl 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-86145 | LOW2.51 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-101909 | LOW2.51 | axios 1.19.0 fixed in 0.34.0, 1.20.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-19693 | LOW2.48 | extract-zip 2.0.1 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-56876 | LOW2.48 | extract-zip 2.0.1 No fix yet | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-106446 | LOW2.48 | handlebars 4.7.9 fixed in 4.7.10 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-102992 | LOW2.48 | piscina 5.2.0 fixed in 5.3.2, 4.9.4, 6.0.0-rc.5 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-76957 | LOW2.39 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-89161 | LOW2.39 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-103111 | LOW2.33 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-45186 | LOW2.29 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-107161 | LOW2.29 | libsasl2-2 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-107161 | LOW2.29 | libsasl2-modules-db 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-101901 | LOW2.29 | axios 1.19.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-101903 | LOW2.29 | axios 1.19.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-101906 | LOW2.29 | axios 1.19.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-102276 | LOW2.29 | brace-expansion 1.1.18 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-102276 | LOW2.29 | brace-expansion 2.1.4 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-102276 | LOW2.29 | brace-expansion 5.0.9 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-73566 | LOW2.29 | tar 7.5.19 fixed in 7.5.21 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-19534 | LOW2.29 | undici 6.28.0 fixed in 6.28.1, 7.29.1, 8.10.2 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-41907 | LOW2.29 | uuid 9.0.1 fixed in 11.1.1, 12.0.1, 13.0.1 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-84782 | LOW2.26 | openssl 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-18477 | LOW2.24 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.24 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-87862 | LOW2.22 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-87863 | LOW2.22 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-87864 | LOW2.22 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-92389 | LOW2.22 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-92391 | LOW2.22 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-87862 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-87863 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-87864 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-92389 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-92391 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-102474 | LOW2.04 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-19487 | LOW1.99 | perl-base 5.38.2-3.2ubuntu0.4 fixed in 5.38.2-3.2ubuntu0.6 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-13608 | LOW1.89 | curl 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-18924 | LOW1.89 | curl 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.89 | curl 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-13608 | LOW1.89 | libcurl4t64 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-18924 | LOW1.89 | libcurl4t64 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.89 | libcurl4t64 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-35189 | LOW1.89 | openssl 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-54872 | LOW1.81 | openssl 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-82209 | LOW1.58 | curl 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-82209 | LOW1.58 | libcurl4t64 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-45819 | NONE0 | baseline-browser-mapping 2.9.14 fixed in 2.11.0 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-101916 | NONE0 | @grpc/grpc-js 1.14.4 fixed in 1.13.6, 1.14.5 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-104872 | NONE0 | @opentelemetry/instrumentation-cassandra-driver 0.65.0 fixed in 0.66.0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-104872 | NONE0 | @opentelemetry/instrumentation-knex 0.64.0 fixed in 0.65.0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-104872 | NONE0 | @opentelemetry/instrumentation-mongoose 0.66.0 fixed in 0.67.0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-104872 | NONE0 | @opentelemetry/instrumentation-mysql 0.66.0 fixed in 0.67.0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-104872 | NONE0 | @opentelemetry/instrumentation-mysql2 0.66.0 fixed in 0.67.0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-104872 | NONE0 | @opentelemetry/instrumentation-oracledb 0.45.0 fixed in 0.46.0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-104872 | NONE0 | @opentelemetry/instrumentation-pg 0.72.0 fixed in 0.73.0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-104872 | NONE0 | @opentelemetry/instrumentation-tedious 0.39.0 fixed in 0.40.0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2024-56433 | NONE0 | login 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-56408 | NONE0 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-56409 | NONE0 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-95184 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-95209 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-95210 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-85091 | NONE0 | zlib1g 1:1.3.dfsg-3.1ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-101915 | NONE0 | @grpc/grpc-js 1.14.4 fixed in 1.13.6, 1.14.5 | 0.3% Theoretical Threat | Not Applicable |
| GHSA-8238-w5pm-2374 | NONE0 | adm-zip 0.6.0 fixed in 0.6.1 | — | Not Applicable |
| GHSA-rcw4-f5rp-g42v | NONE0 | adm-zip 0.6.0 fixed in 0.6.1 | — | Not Applicable |
| GHSA-c6fg-446q-cg94 | NONE0 | adm-zip 0.6.0 fixed in 0.6.1 | — | Not Applicable |
| GHSA-p634-w6r4-rjp2 | NONE0 | adm-zip 0.6.0 fixed in 0.6.1 | — | Not Applicable |
| GHSA-55q2-fjhq-7xh7 | NONE0 | dompurify 3.4.11 fixed in 3.4.13 | — | Not Applicable |
| GHSA-6688-9rhm-gjv2 | NONE0 | dompurify 3.4.11 fixed in 3.4.16 | — | Not Applicable |
| GHSA-r3ph-w7gj-g6xm | NONE0 | js-yaml 5.3.0 fixed in 5.4.1 | — | Not Applicable |
| GHSA-253c-mchw-3w2r | NONE0 | markdown-it 14.2.0 fixed in 15.0.1, 14.3.1 | — | Not Applicable |
| GHSA-2x7j-588g-ccc2 | NONE0 | nodemailer 9.0.4 fixed in 9.1.0 | — | Not Applicable |
| GHSA-v53p-9fqp-m79j | NONE0 | nodemailer 9.0.4 fixed in 10.0.6 | — | Not Applicable |
| GHSA-6vj9-mwq6-2f5v | NONE0 | nodemailer 9.0.4 fixed in 10.0.2 | — | Not Applicable |
| GHSA-8m3c-c648-2xjj | NONE0 | nodemailer 9.0.4 fixed in 9.1.1 | — | Not Applicable |
| GHSA-8vvx-rff5-p5rq | NONE0 | nodemailer 9.0.4 fixed in 10.0.2 | — | Not Applicable |
| GHSA-cc9r-2j5m-2m83 | NONE0 | nodemailer 9.0.4 fixed in 9.1.0 | — | Not Applicable |
| GHSA-wmmp-3585-3rmp | NONE0 | nodemailer 9.0.4 fixed in 9.1.0 | — | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.