Last scanned:
This base/runtime image is a clean foundation for building production images. It does contain vulnerabilities, with 46 exposed-surface findings, but the highest severity is 5.9 and none are known to be actively exploited, so they do not drive a higher risk rating. Images built on it will inherit these low-severity findings, which are still worth tracking through normal patch cycles. Since the image runs as root by default, consider setting a non-root user in the images you build on top of it as a general hardening step. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-63073 | MEDIUM5.9 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-69192 | MEDIUM5.16 | ip-address 10.1.0 fixed in 10.3.1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-58043 | MEDIUM5.04 | node 22.23.1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-85091 | MEDIUM5 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-14456 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-18798 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63072 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14457 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54874 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63075 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-14456 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-18798 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63072 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14457 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54874 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63075 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-102276 | MEDIUM4.5 | brace-expansion 2.0.2 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-102278 | MEDIUM4.5 | brace-expansion 2.0.2 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-14257 | MEDIUM4.5 | brace-expansion 2.0.2 fixed in 5.0.8, 3.0.3, 2.1.3, 1.1.17 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-69152 | MEDIUM4.5 | brace-expansion 2.0.2 fixed in 1.1.18, 2.1.4, 3.0.6, 5.0.9 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-33750 | MEDIUM4.5 | brace-expansion 2.0.2 fixed in 5.0.5, 3.0.2, 2.0.3, 1.1.13 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-93748 | MEDIUM4.5 | http-cache-semantics 4.2.0 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-33671 | MEDIUM4.5 | picomatch 4.0.3 fixed in 4.0.4, 3.0.2, 2.3.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-56850 | MEDIUM4.4 | node 22.23.1 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.6-r2 fixed in 1.2.6-r3 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.6-r2 fixed in 1.2.6-r3 | — | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-42338 | LOW3.66 | ip-address 10.1.0 fixed in 10.1.1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-56847 | LOW3.66 | node 22.23.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-104844 | LOW3.54 | postcss-selector-parser 7.1.1 fixed in 7.1.6, 6.1.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-53655 | LOW3.3 | tar 7.5.11 fixed in 7.5.16 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-48758 | LOW3.24 | @sigstore/core 2.0.0 fixed in 3.2.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-13149 | LOW3.18 | brace-expansion 2.0.2 fixed in 5.0.7, 1.1.16, 2.1.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102277 | LOW3.18 | brace-expansion 2.0.2 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101911 | LOW3.18 | ip-address 10.1.0 fixed in 10.7.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101912 | LOW3.18 | ip-address 10.1.0 fixed in 10.7.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101913 | LOW3.18 | ip-address 10.1.0 fixed in 10.5.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-111997 | LOW3.18 | ip-address 10.1.0 fixed in 10.7.4 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-33672 | LOW3.18 | picomatch 4.0.3 fixed in 4.0.4, 3.0.2, 2.3.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-9496 | LOW2.7 | pacote 19.0.2 fixed in 21.5.1 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-9496 | LOW2.7 | pacote 20.0.1 fixed in 21.5.1 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-48815 | LOW2.7 | sigstore 3.1.0 fixed in 4.1.1 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-59873 | LOW2.7 | tar 7.5.11 fixed in 7.5.19 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-59874 | LOW2.7 | tar 7.5.11 fixed in 7.5.18 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-73566 | LOW2.7 | tar 7.5.11 fixed in 7.5.21 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-59871 | LOW2.7 | tar 7.5.11 fixed in 7.5.18 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-9358 | LOW2.58 | postcss-selector-parser 7.1.1 fixed in 6.1.3, 7.1.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-59875 | LOW1.91 | tar 7.5.11 fixed in 7.5.17 | 0.4% Theoretical Threat | Post-Exploit |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.