Vulnerability Reportnginxinc/nginx-unprivileged:1.31.5-alpine

nginxinc/nginx-unprivileged:1.31.5-alpine

digestsha256:19c132c9ab02d3b783f478743dafc7a7f42e27aa7d2bdcbec1bb1128ca8f2a07

Executive Summary

Last scanned: Oct 20, 2026

Threat ScoreSAFE• Threat score is 0, which maps to the SAFE band (0–24).• Publisher nginxinc is marked VERIFIED/TRUSTED, and the image is pinned by digest for immutability.• Stats show 4 exposed-surface findings and 9 post-exploit findings, but maximum severities are only 4.67 and 2.51.• Counts at or above severity 6 are 0 for exposed findings and 0 for post-exploit findings; no top findings are listed in INPUT 4 or INPUT 5.• No CVE IDs appear in INPUT 4 or INPUT 5, so no specific CVE is cited.

0/100SAFE

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. Trust signals are strong: it comes from the verified publisher nginxinc and is pinned by digest. Although the stats show 4 exposed-surface findings and 9 post-exploit findings, their maximum severities are 4.67 and 2.51, and no top findings or CVE IDs are provided, so they do not meet the thresholds for elevated risk. The pre-calculated threat score of 0 confirms the SAFE verdict.

Vulnerabilities

Vulnerability Log

13 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-94284	MEDIUM4.67	libx11 1.8.13-r0 fixed in 1.8.14-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-94287	MEDIUM4.67	libxpm 3.5.19-r0 fixed in 3.5.20-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-94285	MEDIUM4.33	libx11 1.8.13-r0 fixed in 1.8.14-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-77214	LOW2.51	libexpat 2.8.4-r0 fixed in 2.9.0-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-4775	LOW2.39	tiff 4.7.1-r0 fixed in 4.7.2-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-103111	LOW2.33	pcre2 10.48-r0 fixed in 10.49-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-93990	LOW2.29	libexpat 2.8.4-r0 fixed in 2.8.5-r0	0.4% Theoretical Threat	Post-Exploit
CVE-2026-88806	LOW2.29	libx11 1.8.13-r0 fixed in 1.8.14-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-46675	LOW2.12	libpng 1.6.58-r1 fixed in 1.6.59-r0	—	Post-Exploit
CVE-2026-94283	LOW1.99	libx11 1.8.13-r0 fixed in 1.8.14-r0	0.2% Theoretical Threat	Post-Exploit
CVE-2026-102633	LOW1.81	libexpat 2.8.4-r0 fixed in 2.9.0-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-58055	LOW1.65	nghttp2-libs 1.69.0-r0 fixed in 1.70.0-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-85091	NONE0	zlib 1.3.2-r0 fixed in 1.3.2-r1	0.4% Theoretical Threat	Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.