Last scanned:
This base/runtime image is a clean foundation for building production images. The scan did find 15 low-severity issues in exposed components, with a highest severity of 4.5 and none flagged as actively exploited in the wild, so they do not change the verdict. Images built on top will inherit these issues, so they should still be kept on the normal patch cycle. Running as root by default is worth overriding in derived images to limit the impact of any future flaw. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.
Already in good shape · 2 hardening steps left
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-102276 | MEDIUM4.5 | brace-expansion 5.0.9 fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-102278 | MEDIUM4.5 | brace-expansion 5.0.9 fixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-93748 | MEDIUM4.5 | http-cache-semantics 4.2.0 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-109869 | MEDIUM4.5 | undici 6.28.0 fixed in 6.29.1, 7.30.1, 8.12.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-19534 | MEDIUM4.5 | undici 6.28.0 fixed in 6.28.1, 7.29.1, 8.10.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-109924 | MEDIUM4.5 | undici 6.28.0 fixed in 6.29.1, 7.30.1, 8.12.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-104844 | LOW3.54 | postcss-selector-parser 7.1.4 fixed in 7.1.6, 6.1.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-85024 | LOW3.54 | undici 6.28.0 fixed in 6.28.1, 7.29.1, 8.10.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-102277 | LOW3.18 | brace-expansion 5.0.9 fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101910 | LOW3.18 | ip-address 10.5.0 fixed in 10.5.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101911 | LOW3.18 | ip-address 10.5.0 fixed in 10.7.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101912 | LOW3.18 | ip-address 10.5.0 fixed in 10.7.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-101913 | LOW3.18 | ip-address 10.5.0 fixed in 10.5.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-111997 | LOW3.18 | ip-address 10.5.0 fixed in 10.7.4 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-18540 | LOW2.22 | undici 6.28.0 fixed in 6.28.1, 7.29.1, 8.10.2 | 0.3% Theoretical Threat | Directly Exposed |
Want to check another image? Run a full scan with the Docker Security Scanner.