Vulnerability Reportrust:1.94.0

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. An attacker could exploit CVE-2026-49261 to execute arbitrary code if wsrep_notify_cmd is enabled, or trigger buffer overflows via crafted files using CVE-2009-3546, potentially compromising the runtime environment. Disabling wsrep_notify_cmd fully mitigates the MariaDB issue, and the post-exploit-only findings are low severity, but the large number of high-severity exposed-scan results means derived images should be patched or rebuilt before production. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.