Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who exploits CVE-2026-111497 could crash mysqld, corrupt memory, or possibly execute code, and the container runs as root by default, which would raise the impact. Note: CVE-2026-111497 only applies if Brotli compression is negotiated by clients, so disabling Brotli compression would fully eliminate this specific risk. The 13 post-exploit-only findings are low severity (maximum 3.3) and do not change the verdict, but they still exist and should be tracked.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111497 | HIGH7.45 | libbrotli 1.0.9-10.el9_8 fixed in 1.0.9-10.0.1.el9_8 | 36.0% High Exploitation Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-69247 | LOW3.54 | cryptography 46.0.7 fixed in 50.0.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-61801 | LOW3.3 | github.com/moby/sys/user v0.1.0 fixed in 0.4.1 | 0.1% Theoretical Threat | Post-Exploit |
| GHSA-6q48-6c7w-9gw2 | LOW3.28 | certifi 2026.5.20 fixed in 2026.10.18 | — | Post-Exploit |
| CVE-2026-69249 | LOW2.7 | cryptography 46.0.7 fixed in 49.0.0 | 0.3% Theoretical Threat | Post-Exploit |
| GHSA-537c-gmf6-5ccf | LOW2.7 | cryptography 46.0.7 fixed in 48.0.1 | — | Post-Exploit |
| CVE-2026-69248 | LOW2.66 | cryptography 46.0.7 fixed in 49.0.0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-39824 | LOW2.4 | golang.org/x/sys v0.1.0 fixed in 0.44.0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-13346 | LOW2.34 | pip 25.3 fixed in 26.2.0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-6357 | LOW2.09 | pip 25.3 fixed in 26.1 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-8643 | LOW1.98 | pip 25.3 fixed in 26.1.2 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-34743 | LOW1.91 | xz 5.2.5-8.el9_0 fixed in 5.2.5-8.el9_8.1 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-34743 | LOW1.91 | xz-libs 5.2.5-8.el9_0 fixed in 5.2.5-8.el9_8.1 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-3219 | LOW1.8 | pip 25.3 fixed in 26.1 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-1703 | LOW1.4 | pip 25.3 fixed in 26.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2025-68121 | NONE0 | stdlib v1.24.6 fixed in 1.24.13, 1.25.7, 1.26.0-rc.3 | 0.9% Theoretical Threat | Not Applicable |
| CVE-2026-39821 | NONE0 | stdlib v1.24.6 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 1.8% Low-Moderate Risk | Not Applicable |
| CVE-2026-56858 | NONE0 | stdlib v1.24.6 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-39822 | NONE0 | stdlib v1.24.6 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2025-61726 | NONE0 | stdlib v1.24.6 fixed in 1.24.12, 1.25.6 | 2.3% Low-Moderate Risk | Not Applicable |
| CVE-2025-61729 | NONE0 | stdlib v1.24.6 fixed in 1.24.11, 1.25.5 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-25679 | NONE0 | stdlib v1.24.6 fixed in 1.25.8, 1.26.1 | 0.8% Theoretical Threat | Not Applicable |
| CVE-2026-27145 | NONE0 | stdlib v1.24.6 fixed in 1.25.11, 1.26.4 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-32280 | NONE0 | stdlib v1.24.6 fixed in 1.25.9, 1.26.2 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-32281 | NONE0 | stdlib v1.24.6 fixed in 1.25.9, 1.26.2 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-32283 | NONE0 | stdlib v1.24.6 fixed in 1.25.9, 1.26.2 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-33811 | NONE0 | stdlib v1.24.6 fixed in 1.25.10, 1.26.3 | 0.9% Theoretical Threat | Not Applicable |
| CVE-2026-33814 | NONE0 | stdlib v1.24.6 fixed in 1.25.10, 1.26.3 | 0.8% Theoretical Threat | Not Applicable |
| CVE-2026-33818 | NONE0 | stdlib v1.24.6 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-39820 | NONE0 | stdlib v1.24.6 fixed in 1.25.10, 1.26.3 | 0.8% Theoretical Threat | Not Applicable |
| CVE-2026-39836 | NONE0 | stdlib v1.24.6 fixed in 1.25.10, 1.26.3 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-42499 | NONE0 | stdlib v1.24.6 fixed in 1.25.10, 1.26.3 | 0.8% Theoretical Threat | Not Applicable |
| CVE-2026-42504 | NONE0 | stdlib v1.24.6 fixed in 1.25.11, 1.26.4 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-56853 | NONE0 | stdlib v1.24.6 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-56859 | NONE0 | stdlib v1.24.6 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-56860 | NONE0 | stdlib v1.24.6 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-56862 | NONE0 | stdlib v1.24.6 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-78667 | NONE0 | stdlib v1.24.6 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-78669 | NONE0 | stdlib v1.24.6 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-97031 | NONE0 | stdlib v1.24.6 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2025-58183 | NONE0 | stdlib v1.24.6 fixed in 1.24.8, 1.25.2 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2025-58188 | NONE0 | stdlib v1.24.6 fixed in 1.24.8, 1.25.2 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2025-61728 | NONE0 | stdlib v1.24.6 fixed in 1.24.12, 1.25.6 | 0.7% Theoretical Threat | Not Applicable |
| CVE-2026-78659 | NONE0 | stdlib v1.24.6 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-78660 | NONE0 | stdlib v1.24.6 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-94440 | NONE0 | stdlib v1.24.6 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-111943 | NONE0 | stdlib v1.24.6 fixed in 1.26.10, 1.27.3 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2025-61727 | NONE0 | stdlib v1.24.6 fixed in 1.24.11, 1.25.5 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-39825 | NONE0 | stdlib v1.24.6 fixed in 1.25.10, 1.26.3 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-56866 | NONE0 | stdlib v1.24.6 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-94439 | NONE0 | stdlib v1.24.6 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-32282 | NONE0 | stdlib v1.24.6 fixed in 1.25.9, 1.26.2 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-32289 | NONE0 | stdlib v1.24.6 fixed in 1.25.9, 1.26.2 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-94448 | NONE0 | stdlib v1.24.6 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-97030 | NONE0 | stdlib v1.24.6 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-97032 | NONE0 | stdlib v1.24.6 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-32288 | NONE0 | stdlib v1.24.6 fixed in 1.25.9, 1.26.2 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-27142 | NONE0 | stdlib v1.24.6 fixed in 1.25.8, 1.26.1 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-39823 | NONE0 | stdlib v1.24.6 fixed in 1.25.10, 1.26.3 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-39826 | NONE0 | stdlib v1.24.6 fixed in 1.25.10, 1.26.3 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2025-47912 | NONE0 | stdlib v1.24.6 fixed in 1.24.8, 1.25.2 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2025-58185 | NONE0 | stdlib v1.24.6 fixed in 1.24.8, 1.25.2 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2025-58187 | NONE0 | stdlib v1.24.6 fixed in 1.24.9, 1.25.3 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2025-58189 | NONE0 | stdlib v1.24.6 fixed in 1.24.8, 1.25.2 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2025-61723 | NONE0 | stdlib v1.24.6 fixed in 1.24.8, 1.25.2 | 0.7% Theoretical Threat | Not Applicable |
| CVE-2025-61724 | NONE0 | stdlib v1.24.6 fixed in 1.24.8, 1.25.2 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2025-61725 | NONE0 | stdlib v1.24.6 fixed in 1.24.8, 1.25.2 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2025-61730 | NONE0 | stdlib v1.24.6 fixed in 1.24.12, 1.25.6 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-42505 | NONE0 | stdlib v1.24.6 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-42507 | NONE0 | stdlib v1.24.6 fixed in 1.25.11, 1.26.4 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-78663 | NONE0 | stdlib v1.24.6 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2025-58186 | NONE0 | stdlib v1.24.6 fixed in 1.24.8, 1.25.2 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-56857 | NONE0 | stdlib v1.24.6 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-27139 | NONE0 | stdlib v1.24.6 fixed in 1.25.8, 1.26.1 | 0.2% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.