Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker able to authenticate to Odoo could execute arbitrary code and escalate privileges on the main service (CVE-2020-29396), while malformed headers handled by the bundled Node.js runtime could enable request smuggling (CVE-2024-27982). The image ships 35 exposed-surface findings, seven of which are severity 6.0 or higher and one reaching 8.8, although the 29 post-exploit findings stay low severity with a maximum of 3.9. Note that CVE-2020-29396 is documented for Odoo 11.0-13.0 while this container runs Odoo 19.0, so confirm whether it applies to your version. Because that flaw requires a remote authenticated user, enforcing strict authentication and network restrictions on the Odoo interface fully removes that specific path.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2020-29396 | HIGH8.8 | odoo 19.0.20260926 No fix yet | 3.1% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2018-18064 | MEDIUM6.5 | libcairo2 1.18.0-3build1 No fix yet | 1.5% Low-Moderate Risk | Directly Exposed |
| CVE-2024-22020 | MEDIUM6.5 | libnode109 18.19.1+dfsg-6ubuntu5 No fix yet | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2019-6988 | MEDIUM6.5 | libopenjp2-7 2.5.0-2ubuntu0.5 No fix yet | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2025-23166 | MEDIUM6.38 | libnode109 18.19.1+dfsg-6ubuntu5 No fix yet | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-86143 | MEDIUM6.21 | libxml2 2.9.14+dfsg-1.3ubuntu3.9 fixed in 2.9.14+dfsg-1.3ubuntu3.10 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2024-27982 | MEDIUM6.1 | libnode109 18.19.1+dfsg-6ubuntu5 No fix yet | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2025-5222 | MEDIUM5.95 | libicu74 74.2-1ubuntu3.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-49825 | MEDIUM5.58 | python3-lxml 5.2.1-1 fixed in 5.2.1-1ubuntu0.2 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2023-39329 | MEDIUM5.52 | libopenjp2-7 2.5.0-2ubuntu0.5 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2023-37769 | MEDIUM5.52 | libpixman-1-0 0.42.2-1build1 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2017-7475 | MEDIUM5.5 | libcairo2 1.18.0-3build1 No fix yet | 1.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-86138 | MEDIUM5.3 | libxml2 2.9.14+dfsg-1.3ubuntu3.9 fixed in 2.9.14+dfsg-1.3ubuntu3.10 | 0.1% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-86142 | MEDIUM5.3 | libxml2 2.9.14+dfsg-1.3ubuntu3.9 fixed in 2.9.14+dfsg-1.3ubuntu3.10 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-86144 | MEDIUM5.3 | libxml2 2.9.14+dfsg-1.3ubuntu3.9 fixed in 2.9.14+dfsg-1.3ubuntu3.10 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-64512 | MEDIUM5.3 | python3-pdfminer 20221105+dfsg-1 No fix yet | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-23085 | MEDIUM5.3 | libnode109 18.19.1+dfsg-6ubuntu5 No fix yet | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2026-41066 | MEDIUM5.02 | python3-lxml 5.2.1-1 fixed in 5.2.1-1ubuntu0.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-66382 | MEDIUM4.67 | libexpat1 2.6.1-2ubuntu0.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95512 | MEDIUM4.67 | libfreetype6 2.13.2+dfsg-1ubuntu0.1 fixed in 2.13.2+dfsg-1ubuntu0.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2023-39328 | MEDIUM4.67 | libopenjp2-7 2.5.0-2ubuntu0.5 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-76781 | MEDIUM4.67 | libxml2 2.9.14+dfsg-1.3ubuntu3.9 fixed in 2.9.14+dfsg-1.3ubuntu3.10 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-10911 | MEDIUM4.67 | libxslt1.1 1.1.39-0exp1ubuntu0.24.04.3 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86469 | MEDIUM4.5 | libglib2.0-0t64 2.80.0-6ubuntu3.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-22693 | MEDIUM4.5 | libharfbuzz0b 8.3.0-2build2 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.17 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.17 | libc6 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2024-22020 | LOW3.9 | nodejs 18.19.1+dfsg-6ubuntu5 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-89092 | LOW3.57 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | LOW3.57 | libc6 2.39-0ubuntu8.9 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2024-27983 | LOW3.51 | libnode109 18.19.1+dfsg-6ubuntu5 No fix yet | 87.2% Actively Exploited | Post-Exploit |
| CVE-2024-27983 | LOW3.51 | nodejs 18.19.1+dfsg-6ubuntu5 No fix yet | 87.2% Actively Exploited | Post-Exploit |
| CVE-2024-35195 | LOW2.86 | python3-pip 24.0+dfsg-1ubuntu1.3 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-24049 | LOW2.8 | python3-wheel 0.42.0-2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW2.8 | libsystemd0 255.4-1ubuntu8.17 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW2.8 | libudev1 255.4-1ubuntu8.17 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2017-11555 | LOW2.7 | libsass1 3.6.5+20231221-3 No fix yet | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2017-11556 | LOW2.7 | libsass1 3.6.5+20231221-3 No fix yet | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2017-10687 | LOW2.7 | libsass1 3.6.5+20231221-3 No fix yet | 1.8% Low-Moderate Risk | Post-Exploit |
| CVE-2017-11341 | LOW2.7 | libsass1 3.6.5+20231221-3 No fix yet | 1.7% Low-Moderate Risk | Post-Exploit |
| CVE-2017-11342 | LOW2.7 | libsass1 3.6.5+20231221-3 No fix yet | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2017-12962 | LOW2.7 | libsass1 3.6.5+20231221-3 No fix yet | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2017-12963 | LOW2.7 | libsass1 3.6.5+20231221-3 No fix yet | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2017-12964 | LOW2.7 | libsass1 3.6.5+20231221-3 No fix yet | 1.8% Low-Moderate Risk | Post-Exploit |
| CVE-2026-21441 | LOW2.7 | python3-pip 24.0+dfsg-1ubuntu1.3 No fix yet | 2.9% Low-Moderate Risk | Post-Exploit |
| CVE-2026-88807 | LOW2.54 | libxrender1 1:0.9.10-1.1build1 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86145 | LOW2.51 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-22018 | LOW2.46 | libnode109 18.19.1+dfsg-6ubuntu5 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | LOW2.39 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2025-7425 | LOW2.39 | libxslt1.1 1.1.39-0exp1ubuntu0.24.04.3 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2017-11605 | LOW2.34 | libsass1 3.6.5+20231221-3 No fix yet | 1.5% Low-Moderate Risk | Post-Exploit |
| CVE-2025-23166 | LOW2.29 | nodejs 18.19.1+dfsg-6ubuntu5 No fix yet | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2025-66418 | LOW2.29 | python3-pip 24.0+dfsg-1ubuntu1.3 No fix yet | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2025-66471 | LOW2.29 | python3-pip 24.0+dfsg-1ubuntu1.3 No fix yet | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-18477 | LOW2.24 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.24 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2024-27982 | LOW2.2 | nodejs 18.19.1+dfsg-6ubuntu5 No fix yet | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-1703 | LOW1.99 | python3-pip 24.0+dfsg-1ubuntu1.3 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2025-23085 | LOW1.91 | nodejs 18.19.1+dfsg-6ubuntu5 No fix yet | 1.4% Low-Moderate Risk | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-22018 | LOW1.48 | nodejs 18.19.1+dfsg-6ubuntu5 No fix yet | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | NONE0 | login 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-46675 | NONE0 | libpng16-16t64 1.6.43-5ubuntu0.6 fixed in 1.6.43-5ubuntu0.7 | — | Not Applicable |
| CVE-2025-70559 | NONE0 | python3-pdfminer 20221105+dfsg-1 No fix yet | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-85091 | NONE0 | zlib1g 1:1.3.dfsg-3.1ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.