Last scanned:
This base/runtime image is a clean foundation for building production images. It is an official, digest-pinned Docker image with a trust score of 100 and a threat score of 0. The supplied stats show exposed_total 2 and post_total 5, but exposed_max_severity is 0.0 and post_max_severity is 3.17, with no entries at severity 6.0 or higher. Images built on top inherit these low-severity entries, but no exposed-surface or post-exploit-only CVE IDs were provided to cite, and they do not change the SAFE production-use verdict. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2025-47273 | LOW3.17 | setuptools 70.3.0 fixed in 78.1.1 | 1.6% Low-Moderate Risk | Post-Exploit |
| CVE-2026-59890 | LOW3.11 | setuptools 70.3.0 fixed in 83.0.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-97687 | LOW2.48 | urllib3 2.7.0 fixed in 2.8.0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-97689 | LOW2.29 | urllib3 2.7.0 fixed in 2.8.0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-97688 | LOW1.62 | urllib3 2.7.0 fixed in 2.8.0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-85091 | NONE0 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.4% Theoretical Threat | Not Applicable |
| GHSA-6v7p-g79w-8964 | NONE0 | msgpack 1.1.2 fixed in 1.2.1 | — | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.