Last scanned:
This image is safe for production use. It has one exposed-surface entry and two post-exploit-only entries, but the provided stats show no findings at severity 6.0 or above and maximum severities of 0.0 and 2.51, so they do not change the SAFE verdict. The image is from a verified publisher and is pinned by digest, which supports supply-chain trust. Routine monitoring and patching remain good practice.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-77214 | LOW2.51 | libexpat 2.8.5-r0 fixed in 2.9.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-102633 | LOW1.81 | libexpat 2.8.5-r0 fixed in 2.9.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-88806 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-94283 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-94284 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-94287 | NONE0 | libxpm 3.5.19-r0 fixed in 3.5.20-r0 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-94285 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-85091 | NONE0 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.4% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.