Vulnerability Reportpython:3.10.22-slim-bookworm

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. The most practical inherited risk comes from util-linux issues such as CVE-2026-78408, where nsenter --join-cgroup can leak root cgroup migration authority and let an unprivileged user migrate or terminate root processes after a privileged operation, and CVE-2026-76642, where a failed external mount helper can still run privileged X-mount post-hooks and enable local privilege escalation. These are local-access and specific-workflow issues rather than remote unauthenticated compromise, and the exposed severity max is 6.8 with no exposed findings at or above 7.0. Note that several findings depend on non-default util-linux operations such as nsenter --join-cgroup or X-mount/mount-helper configurations, so minimal non-privileged containers may not expose them. Still, because 23 exposed findings are severity 6.0 or higher, the base image should be rebuilt or patched before production images inherit it. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.