Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The top findings could allow a remote, unauthenticated attacker to crash a worker process or, in some configurations, possibly execute code. Note: CVE-2026-15176 only applies if a location combines the alias directive with rewrite and set or return referencing $request_filename. Note: CVE-2026-97205 only applies if both server-side includes with include virtual and asynchronous file I/O are enabled. Avoiding those specific configurations would fully eliminate the respective flaw. The exposed-surface findings still exist and should be reviewed, but their moderate severity and conditional applicability keep them from driving a higher verdict.
Hardening plan for this image · 5 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-15176 | MEDIUM6.48 | nginx 1.30.4-r1 fixed in 1.30.6-r0 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97205 | MEDIUM6.48 | nginx 1.30.4-r1 fixed in 1.30.6-r0 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-63073 | MEDIUM5.9 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-93479 | MEDIUM5.6 | nginx 1.30.4-r1 fixed in 1.30.6-r0 | 1.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-111497 | MEDIUM5.59 | brotli-libs 1.2.0-r1 fixed in 1.2.1-r0 | 36.0% High Exploitation Risk | Directly Exposed |
| CVE-2026-94287 | MEDIUM5.5 | libxpm 3.5.19-r0 fixed in 3.5.20-r0 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-90439 | MEDIUM5.2 | nginx 1.30.4-r1 fixed in 1.30.6-r0 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97629 | MEDIUM5.2 | nginx 1.30.4-r1 fixed in 1.30.6-r0 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-85091 | MEDIUM5 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-14456 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-18798 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14457 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54874 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63075 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-14456 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-18798 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14457 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54874 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63075 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-95101 | MEDIUM4.24 | nginx 1.30.4-r1 fixed in 1.30.6-r0 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.6-r2 fixed in 1.2.6-r3 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.6-r2 fixed in 1.2.6-r3 | — | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-77214 | LOW2.95 | libexpat 2.8.2-r0 fixed in 2.9.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86145 | LOW2.95 | pcre2 10.47-r1 fixed in 10.48-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-78408 | LOW2.84 | libuuid 2.42.1-r0 fixed in 2.42.3-r1 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-76957 | LOW2.81 | libexpat 2.8.2-r0 fixed in 2.8.4-r0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-76642 | LOW2.81 | libuuid 2.42.1-r0 fixed in 2.42.3-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-78410 | LOW2.81 | libuuid 2.42.1-r0 fixed in 2.42.3-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-89161 | LOW2.81 | pcre2 10.47-r1 fixed in 10.48-r0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-4775 | LOW2.81 | tiff 4.7.1-r0 fixed in 4.7.2-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-103111 | LOW2.74 | pcre2 10.47-r1 fixed in 10.49-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-63072 | LOW2.7 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-66046 | LOW2.7 | libexpat 2.8.2-r0 fixed in 2.8.4-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-76641 | LOW2.7 | libexpat 2.8.2-r0 fixed in 2.8.4-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-76956 | LOW2.7 | libexpat 2.8.2-r0 fixed in 2.8.4-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-93990 | LOW2.7 | libexpat 2.8.2-r0 fixed in 2.8.5-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-63072 | LOW2.7 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-88806 | LOW2.7 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-89157 | LOW2.66 | pcre2 10.47-r1 fixed in 10.48-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-53612 | LOW2.52 | libuuid 2.42.1-r0 fixed in 2.42.3-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-53613 | LOW2.52 | libuuid 2.42.1-r0 fixed in 2.42.3-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-53614 | LOW2.52 | libuuid 2.42.1-r0 fixed in 2.42.3-r0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-78409 | LOW2.52 | libuuid 2.42.1-r0 fixed in 2.42.3-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86410 | LOW2.45 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86410 | LOW2.45 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-19931 | LOW2.34 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-19931 | LOW2.34 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-94283 | LOW2.34 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-89158 | LOW2.34 | pcre2 10.47-r1 fixed in 10.48-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-89160 | LOW2.34 | pcre2 10.47-r1 fixed in 10.48-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86411 | LOW2.12 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-86411 | LOW2.12 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-102633 | LOW2.12 | libexpat 2.8.2-r0 fixed in 2.9.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-46675 | LOW2.12 | libpng 1.6.58-r1 fixed in 1.6.59-r0 | — | Post-Exploit |
| CVE-2026-89156 | LOW2.12 | pcre2 10.47-r1 fixed in 10.48-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-94284 | LOW1.98 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-58055 | LOW1.94 | nghttp2-libs 1.69.0-r0 fixed in 1.70.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86412 | LOW1.91 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86413 | LOW1.91 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86412 | LOW1.91 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86413 | LOW1.91 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-94285 | LOW1.84 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-82208 | LOW1.73 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-107928 | LOW1.73 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-82208 | LOW1.73 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-107928 | LOW1.73 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-27456 | LOW1.69 | libuuid 2.42.1-r0 fixed in 2.42.3-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92386 | LOW1.55 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92386 | LOW1.55 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-80256 | LOW1.44 | curl 8.21.0-r0 fixed in 8.22.0-r0 | — | Post-Exploit |
| CVE-2026-80256 | LOW1.44 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | — | Post-Exploit |
| CVE-2026-107929 | LOW1.33 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-13608 | LOW1.33 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-18924 | LOW1.33 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80229 | LOW1.33 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.33 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-80231 | LOW1.33 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-80255 | LOW1.33 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-86415 | LOW1.33 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-87861 | LOW1.33 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-87862 | LOW1.33 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-87863 | LOW1.33 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-87864 | LOW1.33 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-87865 | LOW1.33 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-87866 | LOW1.33 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92387 | LOW1.33 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-92389 | LOW1.33 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92391 | LOW1.33 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-107929 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-13608 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-18924 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80229 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-80231 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-80255 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-86415 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-87861 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-87862 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-87863 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-87864 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-87865 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-87866 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92387 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-92389 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92391 | LOW1.33 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-94266 | LOW1.19 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-94266 | LOW1.19 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-89162 | LOW1.19 | pcre2 10.47-r1 fixed in 10.48-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-82209 | LOW1.12 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-94265 | LOW1.12 | curl 8.21.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-82209 | LOW1.12 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-94265 | LOW1.12 | libcurl 8.21.0-r0 fixed in 8.23.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
Want to check another image? Run a full scan with the Docker Security Scanner.