Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The image is an official, digest-pinned Kibana container with strong trust signals, yet it still carries 59 exposed findings and 46 post-exploit findings. The highest exposed severity is 6.29, with two findings at or above 6.0, including CVE-2026-88647 and CVE-2026-89157, and neither reaches the 7.0 threshold that would trigger a higher risk band. The PCRE2 issue in CVE-2026-89157 is described as affecting 32-bit platforms, so its practical impact may be limited if this deployment runs 64-bit. Post-exploit findings are present but none are high severity (max 2.8), so the main action is to remediate the exposed 6.x findings and keep the image updated.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-88647 | MEDIUM6.29 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM6.29 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-46675 | MEDIUM5.9 | libpng16-16t64 1.6.43-5ubuntu0.6 fixed in 1.6.43-5ubuntu0.7 | — | Directly Exposed |
| CVE-2026-89158 | MEDIUM5.52 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | MEDIUM5.52 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-8769 | MEDIUM5.52 | @ai-sdk/provider-utils 3.0.25 fixed in 3.0.28, 4.0.33, 5.0.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-101907 | MEDIUM5.52 | axios 1.19.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101899 | MEDIUM5.52 | axios 1.19.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-101900 | MEDIUM5.52 | axios 1.19.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-101904 | MEDIUM5.52 | axios 1.19.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101908 | MEDIUM5.52 | axios 1.19.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102278 | MEDIUM5.52 | brace-expansion 1.1.18 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102278 | MEDIUM5.52 | brace-expansion 2.1.4 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102278 | MEDIUM5.52 | brace-expansion 5.0.9 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-45822 | MEDIUM5.1 | decode-uri-component 0.2.2 fixed in 0.5.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-67693 | MEDIUM5.02 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | MEDIUM5.02 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-101902 | MEDIUM5.02 | axios 1.19.0 fixed in 0.34.0, 1.20.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-17495 | MEDIUM5.02 | moment 2.30.1 fixed in 2.31.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-66382 | MEDIUM4.67 | libexpat1 2.6.1-2ubuntu0.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95512 | MEDIUM4.67 | libfreetype6 2.13.2+dfsg-1ubuntu0.1 fixed in 2.13.2+dfsg-1ubuntu0.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2024-53382 | MEDIUM4.59 | prismjs 1.27.0 fixed in 1.30.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | MEDIUM4.5 | @opentelemetry/instrumentation-cassandra-driver 0.65.0 fixed in 0.66.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | MEDIUM4.5 | @opentelemetry/instrumentation-knex 0.64.0 fixed in 0.65.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | MEDIUM4.5 | @opentelemetry/instrumentation-mongoose 0.66.0 fixed in 0.67.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | MEDIUM4.5 | @opentelemetry/instrumentation-mysql 0.66.0 fixed in 0.67.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | MEDIUM4.5 | @opentelemetry/instrumentation-mysql2 0.66.0 fixed in 0.67.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | MEDIUM4.5 | @opentelemetry/instrumentation-oracledb 0.45.0 fixed in 0.46.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | MEDIUM4.5 | @opentelemetry/instrumentation-pg 0.72.0 fixed in 0.73.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104872 | MEDIUM4.5 | @opentelemetry/instrumentation-tedious 0.39.0 fixed in 0.40.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-2739 | MEDIUM4.5 | bn.js 4.11.9 fixed in 4.12.3, 5.2.3 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-102277 | MEDIUM4.5 | brace-expansion 1.1.18 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102277 | MEDIUM4.5 | brace-expansion 2.1.4 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102277 | MEDIUM4.5 | brace-expansion 5.0.9 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.17 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.17 | libc6 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-101898 | MEDIUM4.08 | axios 1.19.0 fixed in 1.20.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-86472 | MEDIUM4.08 | fast-uri 3.1.7 fixed in 2.4.7, 3.1.8, 4.1.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-106444 | MEDIUM4 | handlebars 4.7.9 fixed in 4.7.10 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | LOW3.57 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | LOW3.57 | libc6 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-102473 | LOW2.8 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW2.8 | libsystemd0 255.4-1ubuntu8.17 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW2.8 | libudev1 255.4-1ubuntu8.17 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | LOW2.51 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-101909 | LOW2.51 | axios 1.19.0 fixed in 0.34.0, 1.20.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-19693 | LOW2.48 | extract-zip 2.0.1 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-56876 | LOW2.48 | extract-zip 2.0.1 No fix yet | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-106445 | LOW2.48 | handlebars 4.7.9 fixed in 4.7.10 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-106446 | LOW2.48 | handlebars 4.7.9 fixed in 4.7.10 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-102992 | LOW2.48 | piscina 5.3.1 fixed in 5.3.2, 4.9.4, 6.0.0-rc.5 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-89161 | LOW2.39 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-103111 | LOW2.33 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-107161 | LOW2.29 | libsasl2-2 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-107161 | LOW2.29 | libsasl2-modules-db 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-101901 | LOW2.29 | axios 1.19.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-101903 | LOW2.29 | axios 1.19.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-101906 | LOW2.29 | axios 1.19.0 fixed in 1.20.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-102276 | LOW2.29 | brace-expansion 1.1.18 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-102276 | LOW2.29 | brace-expansion 2.1.4 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-102276 | LOW2.29 | brace-expansion 5.0.9 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-93687 | LOW2.29 | braces 3.0.3 No fix yet | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-85393 | LOW2.29 | node-forge 1.4.0 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-73566 | LOW2.29 | tar 7.5.19 fixed in 7.5.21 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-101916 | LOW2.26 | @grpc/grpc-js 1.14.4 fixed in 1.13.6, 1.14.5 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-101905 | LOW2.26 | axios 1.19.0 fixed in 1.20.0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-18477 | LOW2.24 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.24 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-87862 | LOW2.22 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-87863 | LOW2.22 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-87864 | LOW2.22 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-92389 | LOW2.22 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-92391 | LOW2.22 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-87862 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-87863 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-87864 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-92389 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-92391 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-102474 | LOW2.04 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | login 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-95184 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-95209 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-95210 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-85091 | NONE0 | zlib1g 1:1.3.dfsg-3.1ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-101915 | NONE0 | @grpc/grpc-js 1.14.4 fixed in 1.13.6, 1.14.5 | 0.3% Theoretical Threat | Not Applicable |
| GHSA-36jr-mh4h-2g58 | NONE0 | d3-color 2.0.0 fixed in 3.1.0 | — | Not Applicable |
| GHSA-6688-9rhm-gjv2 | NONE0 | dompurify 3.4.14 fixed in 3.4.16 | — | Not Applicable |
| GHSA-p98j-92pf-mc4p | NONE0 | dompurify 3.4.14 fixed in 3.4.16 | — | Not Applicable |
| GHSA-253c-mchw-3w2r | NONE0 | markdown-it 14.2.0 fixed in 15.0.1, 14.3.1 | — | Not Applicable |
| GHSA-2x7j-588g-ccc2 | NONE0 | nodemailer 9.0.4 fixed in 9.1.0 | — | Not Applicable |
| GHSA-v53p-9fqp-m79j | NONE0 | nodemailer 9.0.4 fixed in 10.0.6 | — | Not Applicable |
| GHSA-6vj9-mwq6-2f5v | NONE0 | nodemailer 9.0.4 fixed in 10.0.2 | — | Not Applicable |
| GHSA-8m3c-c648-2xjj | NONE0 | nodemailer 9.0.4 fixed in 9.1.1 | — | Not Applicable |
| GHSA-8vvx-rff5-p5rq | NONE0 | nodemailer 9.0.4 fixed in 10.0.2 | — | Not Applicable |
| GHSA-cc9r-2j5m-2m83 | NONE0 | nodemailer 9.0.4 fixed in 9.1.0 | — | Not Applicable |
| GHSA-wmmp-3585-3rmp | NONE0 | nodemailer 9.0.4 fixed in 9.1.0 | — | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.