Vulnerability Reportopenjdk:28-ea-20-trixie

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. An attacker could abuse CVE-2026-78408 if a privileged operator uses nsenter --join-cgroup against an attacker-controlled target, leaking root cgroup migration authority, or trigger binutils memory corruption through CVE-2025-11082 when derived images process untrusted binaries. Avoiding nsenter --join-cgroup would fully eliminate the CVE-2026-78408 risk, while the overall inherited surface still shows 511 exposed findings, 109 at severity >=6.0, and no exposed findings at severity 7.0 or above, so remediation should be planned before production images rely on this base. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.