Last scanned:
This image is safe for production use. The provided stats show 1 exposed item and 1 post-exploit-only item, but the maximum exposed severity is 0.0 and the maximum post-exploit severity is 2.29, so there are no high-severity findings driving risk. No CVE IDs appear in the top findings, so no specific vulnerabilities are cited. Trust signals are positive, including a popular community publisher and digest pinning.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-84445 | LOW2.29 | google.golang.org/grpc v1.83.1 fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e | 0.6% Theoretical Threat | Post-Exploit |
| GO-2026-5932 | NONE0 | golang.org/x/crypto v0.57.0 No fix yet | — | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.