Last scanned:
This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. An attacker who gets an application built on this image to decode untrusted Brotli data could corrupt memory and potentially run code, which is the most serious inherited risk here (CVE-2026-111497). Note: CVE-2026-111497 only applies if the application decompresses attacker-supplied Brotli data, so teams that never do this face a much smaller practical risk. Several other flagged flaws mostly cause crashes or slowdowns and only matter when an application handles untrusted input in specific ways, such as CVE-2026-21710 in the HTTP handling of an application. Because the image runs as root by default, derived images should drop root privileges as part of the final build. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.
Hardening plan for this image · 5 steps. The first closes an actively exploited CVE.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111497 | HIGH8 | node 18.20.8 No fix yet | 55.5% Actively Exploited | Directly ExposedContext importance: MEDIUM |
| CVE-2026-21710 | MEDIUM6.9 | node 18.20.8 No fix yet | 25.4% High Exploitation Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-69192 | MEDIUM6.88 | ip-address 9.0.5 fixed in 10.3.1 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-15467 | MEDIUM6 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 74.8% Actively Exploited | Directly Exposed |
| CVE-2025-15467 | MEDIUM6 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 74.8% Actively Exploited | Directly Exposed |
| CVE-2025-69421 | MEDIUM6 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-69421 | MEDIUM6 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-24001 | MEDIUM6 | diff 5.2.0 fixed in 8.0.3, 5.2.2, 4.0.4, 3.5.1 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-26996 | MEDIUM6 | minimatch 9.0.5 fixed in 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-27903 | MEDIUM6 | minimatch 9.0.5 fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-27904 | MEDIUM6 | minimatch 9.0.5 fixed in 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-21637 | MEDIUM6 | node 18.20.8 No fix yet | 1.1% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2025-69419 | MEDIUM5.92 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-69419 | MEDIUM5.92 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-9231 | MEDIUM5.9 | libcrypto3 3.3.3-r0 fixed in 3.3.5-r0 | 2.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-31790 | MEDIUM5.9 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54872 | MEDIUM5.9 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-72897 | MEDIUM5.9 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | MEDIUM5.9 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-77696 | MEDIUM5.9 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-15468 | MEDIUM5.9 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2025-66199 | MEDIUM5.9 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-69420 | MEDIUM5.9 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-22796 | MEDIUM5.9 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.9 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r1 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.9 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2025-9231 | MEDIUM5.9 | libssl3 3.3.3-r0 fixed in 3.3.5-r0 | 2.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-31790 | MEDIUM5.9 | libssl3 3.3.3-r0 fixed in 3.3.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54872 | MEDIUM5.9 | libssl3 3.3.3-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-72897 | MEDIUM5.9 | libssl3 3.3.3-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | MEDIUM5.9 | libssl3 3.3.3-r0 fixed in 3.3.7-r2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-77696 | MEDIUM5.9 | libssl3 3.3.3-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-15468 | MEDIUM5.9 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2025-66199 | MEDIUM5.9 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-69420 | MEDIUM5.9 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-22796 | MEDIUM5.9 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.9 | libssl3 3.3.3-r0 fixed in 3.3.7-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libssl3 3.3.3-r0 fixed in 3.3.7-r1 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.9 | libssl3 3.3.3-r0 fixed in 3.3.7-r1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-21713 | MEDIUM5.9 | node 18.20.8 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-21717 | MEDIUM5.9 | node 18.20.8 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-31789 | MEDIUM5.88 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-31789 | MEDIUM5.88 | libssl3 3.3.3-r0 fixed in 3.3.7-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-9230 | MEDIUM5.6 | libcrypto3 3.3.3-r0 fixed in 3.3.5-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2025-9230 | MEDIUM5.6 | libssl3 3.3.3-r0 fixed in 3.3.5-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-22795 | MEDIUM5.5 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-22795 | MEDIUM5.5 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-6042 | MEDIUM5.5 | musl 1.2.5-r9 fixed in 1.2.5-r10 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-6042 | MEDIUM5.5 | musl-utils 1.2.5-r9 fixed in 1.2.5-r10 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-45445 | MEDIUM5.46 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-45445 | MEDIUM5.46 | libssl3 3.3.3-r0 fixed in 3.3.7-r1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-75804 | MEDIUM5.3 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | MEDIUM5.3 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r2 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-84784 | MEDIUM5.3 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | MEDIUM5.3 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r1 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-75804 | MEDIUM5.3 | libssl3 3.3.3-r0 fixed in 3.3.7-r2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | MEDIUM5.3 | libssl3 3.3.3-r0 fixed in 3.3.7-r2 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-84784 | MEDIUM5.3 | libssl3 3.3.3-r0 fixed in 3.3.7-r2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | MEDIUM5.3 | libssl3 3.3.3-r0 fixed in 3.3.7-r1 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-21711 | MEDIUM5.3 | node 18.20.8 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-21714 | MEDIUM5.3 | node 18.20.8 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42338 | MEDIUM4.88 | ip-address 9.0.5 fixed in 10.1.1 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-28387 | MEDIUM4.86 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-45447 | MEDIUM4.86 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r1 | 4.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-28387 | MEDIUM4.86 | libssl3 3.3.3-r0 fixed in 3.3.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-45447 | MEDIUM4.86 | libssl3 3.3.3-r0 fixed in 3.3.7-r1 | 4.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54875 | MEDIUM4.7 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-68160 | MEDIUM4.7 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-54875 | MEDIUM4.7 | libssl3 3.3.3-r0 fixed in 3.3.7-r2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-68160 | MEDIUM4.7 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40200 | MEDIUM4.68 | musl 1.2.5-r9 fixed in 1.2.5-r11 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40200 | MEDIUM4.68 | musl-utils 1.2.5-r9 fixed in 1.2.5-r11 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-22184 | MEDIUM4.68 | zlib 1.3.1-r2 fixed in 1.3.2-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-28388 | MEDIUM4.5 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-28389 | MEDIUM4.5 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-28390 | MEDIUM4.5 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-34183 | MEDIUM4.5 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r1 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63072 | MEDIUM4.5 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r1 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r1 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-28388 | MEDIUM4.5 | libssl3 3.3.3-r0 fixed in 3.3.7-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-28389 | MEDIUM4.5 | libssl3 3.3.3-r0 fixed in 3.3.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-28390 | MEDIUM4.5 | libssl3 3.3.3-r0 fixed in 3.3.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-34183 | MEDIUM4.5 | libssl3 3.3.3-r0 fixed in 3.3.7-r1 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63072 | MEDIUM4.5 | libssl3 3.3.3-r0 fixed in 3.3.7-r1 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libssl3 3.3.3-r0 fixed in 3.3.7-r1 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-102276 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-102278 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-14257 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 5.0.8, 3.0.3, 2.1.3, 1.1.17 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-69152 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 1.1.18, 2.1.4, 3.0.6, 5.0.9 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-33750 | MEDIUM4.5 | brace-expansion 2.0.1 fixed in 5.0.5, 3.0.2, 2.0.3, 1.1.13 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-64756 | MEDIUM4.5 | glob 10.4.2 fixed in 11.1.0, 10.5.0 | 3.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-93748 | MEDIUM4.5 | http-cache-semantics 4.1.1 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-9496 | MEDIUM4.5 | pacote 18.0.6 fixed in 21.5.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-48815 | MEDIUM4.5 | sigstore 2.3.1 fixed in 4.1.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-84782 | MEDIUM4.44 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r2 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-34182 | MEDIUM4.44 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r1 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-84782 | MEDIUM4.44 | libssl3 3.3.3-r0 fixed in 3.3.7-r2 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-34182 | MEDIUM4.44 | libssl3 3.3.3-r0 fixed in 3.3.7-r1 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-101911 | MEDIUM4.24 | ip-address 9.0.5 fixed in 10.7.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-101912 | MEDIUM4.24 | ip-address 9.0.5 fixed in 10.7.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-101913 | MEDIUM4.24 | ip-address 9.0.5 fixed in 10.5.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-111997 | MEDIUM4.24 | ip-address 9.0.5 fixed in 10.7.4 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-69418 | MEDIUM4 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-69418 | MEDIUM4 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.5-r9 fixed in 1.2.5-r12 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.5-r9 fixed in 1.2.5-r12 | — | Directly Exposed |
| CVE-2024-21538 | LOW3.83 | cross-spawn 7.0.3 fixed in 7.0.5, 6.0.6 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-42768 | LOW3.78 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-42768 | LOW3.78 | libssl3 3.3.3-r0 fixed in 3.3.7-r1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-29786 | LOW3.78 | tar 6.2.1 fixed in 7.5.10 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-35189 | LOW3.7 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-35189 | LOW3.7 | libssl3 3.3.3-r0 fixed in 3.3.7-r2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libssl3 3.3.3-r0 fixed in 3.3.7-r1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libssl3 3.3.3-r0 fixed in 3.3.7-r1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-23745 | LOW3.66 | tar 6.2.1 fixed in 7.5.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-104844 | LOW3.54 | postcss-selector-parser 6.1.0 fixed in 7.1.6, 6.1.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-27171 | LOW3.3 | zlib 1.3.1-r2 fixed in 1.3.2-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-31802 | LOW3.3 | tar 6.2.1 fixed in 7.5.11 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-53655 | LOW3.3 | tar 6.2.1 fixed in 7.5.16 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-21715 | LOW3.3 | node 18.20.8 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-21716 | LOW3.3 | node 18.20.8 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-48758 | LOW3.24 | @sigstore/core 1.1.0 fixed in 3.2.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-13149 | LOW3.18 | brace-expansion 2.0.1 fixed in 5.0.7, 1.1.16, 2.1.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102277 | LOW3.18 | brace-expansion 2.0.1 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-9232 | LOW3.1 | libcrypto3 3.3.3-r0 fixed in 3.3.5-r0 | 2.0% Low-Moderate Risk | Directly Exposed |
| CVE-2025-9232 | LOW3.1 | libssl3 3.3.3-r0 fixed in 3.3.5-r0 | 2.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-85091 | LOW3 | zlib 1.3.1-r2 fixed in 1.3.2-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-24842 | LOW2.95 | tar 6.2.1 fixed in 7.5.7 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-59873 | LOW2.7 | tar 6.2.1 fixed in 7.5.19 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-59874 | LOW2.7 | tar 6.2.1 fixed in 7.5.18 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-73566 | LOW2.7 | tar 6.2.1 fixed in 7.5.21 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-59871 | LOW2.7 | tar 6.2.1 fixed in 7.5.18 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-9358 | LOW2.58 | postcss-selector-parser 6.1.0 fixed in 6.1.3, 7.1.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-26960 | LOW2.56 | tar 6.2.1 fixed in 7.5.8 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2024-58251 | LOW2.55 | busybox 1.37.0-r12 fixed in 1.37.0-r14 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2024-58251 | LOW2.55 | busybox-binsh 1.37.0-r12 fixed in 1.37.0-r14 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2024-58251 | LOW2.55 | ssl_client 1.37.0-r12 fixed in 1.37.0-r14 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-23950 | LOW2.12 | tar 6.2.1 fixed in 7.5.4 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-59875 | LOW1.91 | tar 6.2.1 fixed in 7.5.17 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2025-46394 | LOW1.68 | busybox 1.37.0-r12 fixed in 1.37.0-r14 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-46394 | LOW1.68 | busybox-binsh 1.37.0-r12 fixed in 1.37.0-r14 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-46394 | LOW1.68 | ssl_client 1.37.0-r12 fixed in 1.37.0-r14 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-5889 | LOW1.58 | brace-expansion 2.0.1 fixed in 2.0.2, 1.1.12, 3.0.1, 4.0.1 | 0.6% Theoretical Threat | Directly Exposed |
Want to check another image? Run a full scan with the Docker Security Scanner.