Vulnerability Reportrust:1.94.0-bookworm

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. An attacker could exploit critical flaws such as CVE-2026-42010 to bypass authentication and CVE-2026-49261 to execute arbitrary code if MariaDB's wsrep_notify_cmd is enabled. Note that CVE-2026-49261 only applies when wsrep_notify_cmd is enabled, and disabling it fully mitigates that finding. While the image has a high number of exposed findings (4564), the post-exploit findings are all below 6.0 severity, so the overall risk remains caution-level. Ensure the final image is hardened and updated to patched versions before deployment. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.