Vulnerability Reportrust:1.95.0-bookworm

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. An attacker could achieve remote code execution or denial of service via crafted image files or database connectors, as illustrated by CVE-2026-49261 and CVE-2009-3546. CVE-2026-49261 only applies if the MariaDB wsrep_notify_cmd feature is enabled; disabling it removes that specific risk. While the image has thousands of exposed findings, the post-exploit-only findings are all low severity (max 4.79), so the immediate risk is concentrated in the exposed surface. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.