Last scanned:
··This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who reaches the web interface could crash the app with one crafted request, and if the app decodes attacker-supplied Brotli data, exploiting CVE-2026-111497 could lead to code execution inside a container that runs as root. Note: CVE-2026-111497 only applies if the application decodes Brotli-encoded input, which must be confirmed before deciding, whereas CVE-2026-111181 is reachable with default options. The base OS is also past end of support, and the scan found 116 exposed findings; the trusted official publisher status does not remove these risks.
Hardening plan for this image · 4 steps. The first closes an actively exploited CVE.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111497 | HIGH8 | node 18.20.3 No fix yet | 55.5% Actively Exploited | Directly ExposedContext importance: MEDIUM |
| CVE-2026-111181 | HIGH7.5 | body-parser 1.20.1 fixed in 2.4.0, 1.20.9 | 0.4% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2024-45590 | MEDIUM6.38 | body-parser 1.20.1 fixed in 1.20.3 | 0.8% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2025-26519 | MEDIUM5.95 | musl 1.2.4-r2 fixed in 1.2.4-r3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-26519 | MEDIUM5.95 | musl-utils 1.2.4-r2 fixed in 1.2.4-r3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2024-5535 | MEDIUM5.9 | libcrypto3 3.1.4-r5 fixed in 3.1.6-r0 | 5.6% Low-Moderate Risk | Directly Exposed |
| CVE-2024-5535 | MEDIUM5.9 | libssl3 3.1.4-r5 fixed in 3.1.6-r0 | 5.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-12590 | MEDIUM5.9 | body-parser 1.20.1 fixed in 1.20.6, 2.3.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-17495 | MEDIUM5.9 | moment 2.29.4 fixed in 2.31.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-104844 | MEDIUM5.9 | postcss-selector-parser 6.0.16 fixed in 7.1.6, 6.1.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-21713 | MEDIUM5.9 | node 18.20.3 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-21717 | MEDIUM5.9 | node 18.20.3 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2023-42282 | MEDIUM5.88 | ip 2.0.0 fixed in 2.0.1, 1.1.9 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-4800 | MEDIUM5.88 | lodash 4.17.21 fixed in 4.18.0 | 2.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-4800 | MEDIUM5.88 | lodash-es 4.17.21 fixed in 4.18.0 | 2.8% Low-Moderate Risk | Directly Exposed |
| CVE-2024-6119 | MEDIUM5.85 | libcrypto3 3.1.4-r5 fixed in 3.1.7-r0 | 66.6% Actively Exploited | Directly Exposed |
| CVE-2024-6119 | MEDIUM5.85 | libssl3 3.1.4-r5 fixed in 3.1.7-r0 | 66.6% Actively Exploited | Directly Exposed |
| CVE-2024-4741 | MEDIUM5.6 | libcrypto3 3.1.4-r5 fixed in 3.1.6-r0 | 2.9% Low-Moderate Risk | Directly Exposed |
| CVE-2024-4741 | MEDIUM5.6 | libssl3 3.1.4-r5 fixed in 3.1.6-r0 | 2.9% Low-Moderate Risk | Directly Exposed |
| CVE-2026-90711 | MEDIUM5.46 | proxy-addr 2.0.7 fixed in 2.0.8 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2024-4603 | MEDIUM5.3 | libcrypto3 3.1.4-r5 fixed in 3.1.5-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2024-4603 | MEDIUM5.3 | libssl3 3.1.4-r5 fixed in 3.1.5-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-15603 | MEDIUM5.3 | morgan 1.10.0 fixed in 1.12.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-5078 | MEDIUM5.3 | morgan 1.10.0 fixed in 1.11.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-87859 | MEDIUM5.3 | morgan 1.10.0 fixed in 1.12.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-21711 | MEDIUM5.3 | node 18.20.3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-21714 | MEDIUM5.3 | node 18.20.3 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2022-46175 | MEDIUM5.28 | json5 2.2.1 fixed in 2.2.2, 1.0.2 | 9.7% Low-Moderate Risk | Directly Exposed |
| CVE-2025-27789 | MEDIUM5.27 | @babel/helpers 7.19.4 fixed in 7.26.10, 8.0.0-alpha.17 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2024-29041 | MEDIUM5.18 | express 4.18.2 fixed in 4.19.2, 5.0.0-beta.3 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2023-52555 | MEDIUM5.18 | mongo-express 1.0.2 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-21710 | MEDIUM5.17 | node 18.20.3 No fix yet | 25.4% High Exploitation Risk | Directly Exposed |
| CVE-2026-69192 | MEDIUM5.16 | ip-address 9.0.5 fixed in 10.3.1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2024-29415 | MEDIUM4.86 | ip 2.0.0 No fix yet | 8.3% Low-Moderate Risk | Directly Exposed |
| CVE-2024-2511 | MEDIUM4.81 | libcrypto3 3.1.4-r5 fixed in 3.1.4-r6 | 52.4% Actively Exploited | Directly Exposed |
| CVE-2024-2511 | MEDIUM4.81 | libssl3 3.1.4-r5 fixed in 3.1.4-r6 | 52.4% Actively Exploited | Directly Exposed |
| CVE-2024-27088 | MEDIUM4.67 | es5-ext 0.10.62 fixed in 0.10.63 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-102276 | MEDIUM4.5 | brace-expansion 1.1.11 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-102278 | MEDIUM4.5 | brace-expansion 1.1.11 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-14257 | MEDIUM4.5 | brace-expansion 1.1.11 fixed in 5.0.8, 3.0.3, 2.1.3, 1.1.17 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-69152 | MEDIUM4.5 | brace-expansion 1.1.11 fixed in 1.1.18, 2.1.4, 3.0.6, 5.0.9 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-33750 | MEDIUM4.5 | brace-expansion 1.1.11 fixed in 5.0.5, 3.0.2, 2.0.3, 1.1.13 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102276 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-102278 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-14257 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 5.0.8, 3.0.3, 2.1.3, 1.1.17 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-69152 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 1.1.18, 2.1.4, 3.0.6, 5.0.9 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-33750 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 5.0.5, 3.0.2, 2.0.3, 1.1.13 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-73088 | MEDIUM4.5 | browserslist 4.21.3 fixed in 4.28.7 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-73089 | MEDIUM4.5 | browserslist 4.21.3 fixed in 4.28.7 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-24001 | MEDIUM4.5 | diff 5.2.0 fixed in 8.0.3, 5.2.2, 4.0.4, 3.5.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-33036 | MEDIUM4.5 | fast-xml-parser 4.0.11 fixed in 5.5.6, 4.5.5 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-27942 | MEDIUM4.5 | fast-xml-parser 4.0.11 fixed in 5.3.8, 4.5.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-64756 | MEDIUM4.5 | glob 10.3.12 fixed in 11.1.0, 10.5.0 | 3.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-93748 | MEDIUM4.5 | http-cache-semantics 4.1.1 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-59869 | MEDIUM4.5 | js-yaml 3.14.1 fixed in 3.15.0, 4.3.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-84375 | MEDIUM4.5 | js-yaml 3.14.1 fixed in 4.3.2, 3.15.2 | 0.5% Theoretical Threat | Directly Exposed |
| GHSA-5p4m-2wfm-xmqj | MEDIUM4.5 | js-yaml 3.14.1 fixed in 4.3.1, 3.15.1 | — | Directly Exposed |
| CVE-2026-26996 | MEDIUM4.5 | minimatch 3.1.2 fixed in 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-27903 | MEDIUM4.5 | minimatch 3.1.2 fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-27904 | MEDIUM4.5 | minimatch 3.1.2 fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-26996 | MEDIUM4.5 | minimatch 9.0.4 fixed in 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-27903 | MEDIUM4.5 | minimatch 9.0.4 fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-27904 | MEDIUM4.5 | minimatch 9.0.4 fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-4867 | MEDIUM4.5 | path-to-regexp 0.1.7 fixed in 0.1.13 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-2391 | MEDIUM4.5 | qs 6.11.0 fixed in 6.14.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2022-25883 | MEDIUM4.5 | semver 6.3.0 fixed in 7.5.2, 6.3.1, 5.7.2 | 2.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-41907 | MEDIUM4.5 | uuid 8.3.2 fixed in 11.1.1, 12.0.1, 13.0.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2024-47178 | MEDIUM4.5 | basic-auth-connect 1.0.0 fixed in 1.1.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-21637 | MEDIUM4.5 | node 18.20.3 No fix yet | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2023-45133 | MEDIUM4.49 | @babel/traverse 7.19.6 fixed in 7.23.2, 8.0.0-alpha.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2024-13176 | MEDIUM4 | libcrypto3 3.1.4-r5 fixed in 3.1.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2024-13176 | MEDIUM4 | libssl3 3.1.4-r5 fixed in 3.1.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2024-43796 | MEDIUM4 | express 4.18.2 fixed in 4.20.0, 5.0.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2024-43799 | MEDIUM4 | send 0.18.0 fixed in 0.19.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2024-43800 | MEDIUM4 | serve-static 1.15.0 fixed in 1.16.0, 2.1.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2023-26920 | LOW3.9 | fast-xml-parser 4.0.11 fixed in 4.1.2 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2024-21538 | LOW3.83 | cross-spawn 7.0.3 fixed in 7.0.5, 6.0.6 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2021-32050 | LOW3.83 | mongodb 4.13.0 fixed in 3.6.10, 4.17.0, 5.8.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2024-45296 | LOW3.83 | path-to-regexp 0.1.7 fixed in 1.9.0, 0.1.10, 8.0.0, 3.3.0, 6.3.0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2024-52798 | LOW3.83 | path-to-regexp 0.1.7 fixed in 0.1.12 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-29786 | LOW3.78 | tar 6.2.1 fixed in 7.5.10 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2024-9143 | LOW3.7 | libcrypto3 3.1.4-r5 fixed in 3.1.7-r1 | 5.8% Low-Moderate Risk | Directly Exposed |
| CVE-2024-9143 | LOW3.7 | libssl3 3.1.4-r5 fixed in 3.1.7-r1 | 5.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-41650 | LOW3.66 | fast-xml-parser 4.0.11 fixed in 5.7.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-42338 | LOW3.66 | ip-address 9.0.5 fixed in 10.1.1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-23745 | LOW3.66 | tar 6.2.1 fixed in 7.5.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-49356 | LOW3.6 | @babel/core 7.19.6 fixed in 8.0.0-rc.6, 7.29.6 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-33349 | LOW3.54 | fast-xml-parser 4.0.11 fixed in 4.5.5, 5.5.7 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-31802 | LOW3.3 | tar 6.2.1 fixed in 7.5.11 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-53655 | LOW3.3 | tar 6.2.1 fixed in 7.5.16 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-21715 | LOW3.3 | node 18.20.3 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-21716 | LOW3.3 | node 18.20.3 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-13149 | LOW3.18 | brace-expansion 1.1.11 fixed in 5.0.7, 1.1.16, 2.1.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102277 | LOW3.18 | brace-expansion 1.1.11 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-13149 | LOW3.18 | brace-expansion 2.0.1 fixed in 5.0.7, 1.1.16, 2.1.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102277 | LOW3.18 | brace-expansion 2.0.1 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101911 | LOW3.18 | ip-address 9.0.5 fixed in 10.7.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101912 | LOW3.18 | ip-address 9.0.5 fixed in 10.7.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101913 | LOW3.18 | ip-address 9.0.5 fixed in 10.5.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-111997 | LOW3.18 | ip-address 9.0.5 fixed in 10.7.4 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-64718 | LOW3.18 | js-yaml 3.14.1 fixed in 4.1.1, 3.14.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-53550 | LOW3.18 | js-yaml 3.14.1 fixed in 4.2.0, 3.15.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-13465 | LOW3.18 | lodash 4.17.21 fixed in 4.17.23 | 1.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-2950 | LOW3.18 | lodash 4.17.21 fixed in 4.18.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-13465 | LOW3.18 | lodash-es 4.17.21 fixed in 4.17.23 | 1.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-2950 | LOW3.18 | lodash-es 4.17.21 fixed in 4.18.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-82417 | LOW3.18 | qs 6.11.0 fixed in 6.16.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59875 | LOW3.18 | tar 6.2.1 fixed in 7.5.17 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2024-47764 | LOW3.15 | cookie 0.4.0 fixed in 0.7.0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2024-47764 | LOW3.15 | cookie 0.4.1 fixed in 0.7.0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2024-47764 | LOW3.15 | cookie 0.4.2 fixed in 0.7.0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2024-47764 | LOW3.15 | cookie 0.5.0 fixed in 0.7.0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-24842 | LOW2.95 | tar 6.2.1 fixed in 7.5.7 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2025-7339 | LOW2.89 | on-headers 1.0.2 fixed in 1.1.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2023-42363 | LOW2.8 | busybox 1.36.1-r5 fixed in 1.36.1-r7 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-42364 | LOW2.8 | busybox 1.36.1-r5 fixed in 1.36.1-r7 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-42365 | LOW2.8 | busybox 1.36.1-r5 fixed in 1.36.1-r7 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-42366 | LOW2.8 | busybox 1.36.1-r5 fixed in 1.36.1-r6 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-42363 | LOW2.8 | busybox-binsh 1.36.1-r5 fixed in 1.36.1-r7 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-42364 | LOW2.8 | busybox-binsh 1.36.1-r5 fixed in 1.36.1-r7 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-42365 | LOW2.8 | busybox-binsh 1.36.1-r5 fixed in 1.36.1-r7 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-42366 | LOW2.8 | busybox-binsh 1.36.1-r5 fixed in 1.36.1-r6 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-42363 | LOW2.8 | ssl_client 1.36.1-r5 fixed in 1.36.1-r7 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-42364 | LOW2.8 | ssl_client 1.36.1-r5 fixed in 1.36.1-r7 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-42365 | LOW2.8 | ssl_client 1.36.1-r5 fixed in 1.36.1-r7 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-42366 | LOW2.8 | ssl_client 1.36.1-r5 fixed in 1.36.1-r6 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-9496 | LOW2.7 | pacote 18.0.3 fixed in 21.5.1 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-48815 | LOW2.7 | sigstore 2.3.0 fixed in 4.1.1 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-59873 | LOW2.7 | tar 6.2.1 fixed in 7.5.19 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-59874 | LOW2.7 | tar 6.2.1 fixed in 7.5.18 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-73566 | LOW2.7 | tar 6.2.1 fixed in 7.5.21 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-59871 | LOW2.7 | tar 6.2.1 fixed in 7.5.18 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-26960 | LOW2.56 | tar 6.2.1 fixed in 7.5.8 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2025-15284 | LOW2.22 | qs 6.11.0 fixed in 6.14.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-23950 | LOW2.12 | tar 6.2.1 fixed in 7.5.4 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-48758 | LOW1.94 | @sigstore/core 1.1.0 fixed in 3.2.1 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-5889 | LOW1.58 | brace-expansion 1.1.11 fixed in 2.0.2, 1.1.12, 3.0.1, 4.0.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-5889 | LOW1.58 | brace-expansion 2.0.1 fixed in 2.0.2, 1.1.12, 3.0.1, 4.0.1 | 0.6% Theoretical Threat | Directly Exposed |
Want to check another image? Run a full scan with the Docker Security Scanner.