Last scanned:
This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker could exploit XXE in Apache Tika to read internal files or perform SSRF during PDF parsing, use Jetty request smuggling to bypass authentication, or gain full administrative access via hardcoded credentials in Solr. The hardcoded credential issue (CVE-2026-44825) can be fully mitigated by deleting or changing the default users in security.json, but only if Basic Authentication was enabled via the solr auth enable tool. However, the other critical vulnerabilities (e.g., CVE-2025-66516 in Tika, CVE-2024-47561 in Avro) are exploitable by default and require urgent patching.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2025-66516 | CRITICAL10 | org.apache.tika:tika-core 1.28.5 fixed in 3.2.2 | 79.8% Actively Exploited | Directly ExposedContext importance: HIGH |
| CVE-2025-66516 | CRITICAL10 | org.apache.tika:tika-parsers 1.28.5 fixed in 2.0.0 | 79.8% Actively Exploited | Directly ExposedContext importance: HIGH |
| CVE-2025-54988 | CRITICAL9.4 | org.apache.tika:tika-parsers 1.28.5 fixed in 2.0.0-ALPHA | 3.0% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-2332 | CRITICAL9.1 | org.eclipse.jetty:jetty-http 10.0.26 fixed in 12.1.7, 12.0.33 | 1.1% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-2332 | CRITICAL9.1 | org.eclipse.jetty:jetty-http 9.4.53.v20231009 fixed in 12.1.7, 12.0.33 | 1.1% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2024-47561 | HIGH8.8 | org.apache.avro:avro 1.9.2 fixed in 1.11.4 | 3.3% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-44825 | HIGH8.33 | org.apache.solr:solr-core 9.10.1 No fix yet | 0.5% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2017-11164 | HIGH7.5 | libpcre3 2:8.39-13ubuntu0.22.04.1 No fix yet | 3.1% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2023-39410 | HIGH7.5 | org.apache.avro:avro 1.9.2 fixed in 1.11.3 | 1.8% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2025-48734 | HIGH7.04 | commons-beanutils:commons-beanutils 1.9.4 fixed in 1.11.0 | 1.5% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54512 | MEDIUM6.88 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.18.8, 3.1.4, 2.21.4 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-54513 | MEDIUM6.88 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.7% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-54512 | MEDIUM6.88 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.18.8, 3.1.4, 2.21.4 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-54513 | MEDIUM6.88 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.7% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-28208 | MEDIUM6.79 | com.github.junrar:junrar 7.5.3 fixed in 7.5.8 | 12.0% High Exploitation Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-27727 | MEDIUM6.66 | com.mchange:mchange-commons-java 0.2.19 fixed in 0.4.0 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42581 | MEDIUM6.66 | io.netty:netty-codec-http 4.2.6.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2024-29857 | MEDIUM6.5 | org.bouncycastle:bcprov-jdk15on 1.70 fixed in 1.78 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2022-41409 | MEDIUM6.38 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2025-52999 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.12.7 fixed in 2.15.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-50193 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.14.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-41245 | MEDIUM6.38 | com.github.junrar:junrar 7.5.3 fixed in 7.5.10 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-55163 | MEDIUM6.38 | io.grpc:grpc-netty-shaded 1.65.1 fixed in 1.75.0 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-42583 | MEDIUM6.38 | io.netty:netty-codec-compression 4.2.6.Final fixed in 4.2.13.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-33870 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.6.Final fixed in 4.1.132.Final, 4.2.10.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42587 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.6.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-42585 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.6.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-42587 | MEDIUM6.38 | io.netty:netty-codec-http2 4.2.6.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-48043 | MEDIUM6.38 | io.netty:netty-codec-http2 4.2.6.Final fixed in 4.1.135.Final, 4.2.15.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-45416 | MEDIUM6.38 | io.netty:netty-handler 4.2.6.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-50010 | MEDIUM6.38 | io.netty:netty-handler 4.2.6.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-42578 | MEDIUM6.38 | io.netty:netty-handler-proxy 4.2.6.Final fixed in 4.1.133.Final, 4.2.13.Final | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-45292 | MEDIUM6.38 | io.opentelemetry:opentelemetry-api 1.53.0 fixed in 1.62.0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-45205 | MEDIUM6.38 | org.apache.commons:commons-configuration2 2.10.1 fixed in 2.15.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-45205 | MEDIUM6.38 | org.apache.commons:commons-configuration2 2.12.0 fixed in 2.15.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-34479 | MEDIUM6.38 | org.apache.logging.log4j:log4j-1.2-api 2.25.3 fixed in 2.25.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-34478 | MEDIUM6.38 | org.apache.logging.log4j:log4j-core 2.25.3 fixed in 2.25.4 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-34480 | MEDIUM6.38 | org.apache.logging.log4j:log4j-core 2.25.3 fixed in 2.25.4 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-34481 | MEDIUM6.38 | org.apache.logging.log4j:log4j-layout-template-json 2.25.3 fixed in 2.25.4 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-40682 | MEDIUM6.38 | org.apache.opennlp:opennlp-tools 1.9.4 fixed in 2.5.9, 3.0.0-M3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42027 | MEDIUM6.38 | org.apache.opennlp:opennlp-tools 1.9.4 fixed in 2.5.9, 3.0.0-M3 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-42440 | MEDIUM6.38 | org.apache.opennlp:opennlp-tools 1.9.4 fixed in 2.5.9, 3.0.0-M3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-5588 | MEDIUM6.38 | org.bouncycastle:bcpkix-jdk15on 1.70 fixed in 1.84 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-66566 | MEDIUM6.38 | org.lz4:lz4-java 1.8.0 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-24281 | MEDIUM6.29 | org.apache.zookeeper:zookeeper 3.9.4 fixed in 3.8.6, 3.9.5 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-43869 | MEDIUM6.21 | org.apache.thrift:libthrift 0.15.0 fixed in 0.23.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42584 | MEDIUM6.18 | io.netty:netty-codec-http 4.2.6.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33871 | MEDIUM6 | io.netty:netty-codec-http2 4.2.6.Final fixed in 4.1.132.Final, 4.2.11.Final | 1.1% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-24308 | MEDIUM6 | org.apache.zookeeper:zookeeper 3.9.4 fixed in 3.9.5, 3.8.6 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2024-2236 | MEDIUM5.9 | libgcrypt20 1.9.4-3ubuntu3.2 No fix yet | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-35554 | MEDIUM5.78 | org.apache.kafka:kafka-clients 3.9.1 fixed in 3.9.2, 4.0.2, 4.1.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-6238 | MEDIUM5.52 | libc-bin 2.35-0ubuntu3.13 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-6238 | MEDIUM5.52 | libc6 2.35-0ubuntu3.13 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-67735 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.6.Final fixed in 4.2.8.Final, 4.1.129.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-41417 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.6.Final fixed in 4.1.133.Final, 4.2.13.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-42580 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.6.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-11143 | MEDIUM5.52 | org.eclipse.jetty:jetty-http 10.0.26 fixed in 12.0.31, 12.1.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-11143 | MEDIUM5.52 | org.eclipse.jetty:jetty-http 9.4.53.v20231009 fixed in 12.0.31, 12.1.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-12183 | MEDIUM5.52 | org.lz4:lz4-java 1.8.0 fixed in 1.8.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-44249 | MEDIUM5.5 | io.netty:netty-handler 4.2.6.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-27830 | MEDIUM5.44 | com.mchange:c3p0 0.9.5.5 fixed in 0.12.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2024-21742 | MEDIUM5.3 | org.apache.james:apache-mime4j-core 0.8.4 fixed in 0.8.10 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-13757 | MEDIUM5.27 | libp11-kit0 0.24.0-6build1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-13757 | MEDIUM5.27 | p11-kit 0.24.0-6build1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-13757 | MEDIUM5.27 | p11-kit-modules 0.24.0-6build1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-5435 | MEDIUM5.02 | libc-bin 2.35-0ubuntu3.13 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-5435 | MEDIUM5.02 | libc6 2.35-0ubuntu3.13 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-34477 | MEDIUM5.02 | org.apache.logging.log4j:log4j-core 2.25.3 fixed in 2.25.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2024-30171 | MEDIUM5.02 | org.bouncycastle:bcprov-jdk15on 1.70 fixed in 1.78 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2025-53864 | MEDIUM4.93 | com.nimbusds:nimbus-jose-jwt 9.37.2 fixed in 10.0.2, 9.37.4 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2025-66382 | MEDIUM4.67 | libexpat1 2.4.7-1ubuntu0.7 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | MEDIUM4.67 | libgcc-s1 12.3.0-1ubuntu1~22.04.3 No fix yet | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | MEDIUM4.67 | libstdc++6 12.3.0-1ubuntu1~22.04.3 No fix yet | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-46718 | MEDIUM4.59 | org.apache.calcite:calcite-core 1.37.0 fixed in 1.42.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-4046 | MEDIUM4.5 | libc-bin 2.35-0ubuntu3.13 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-4046 | MEDIUM4.5 | libc6 2.35-0ubuntu3.13 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54514 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-54515 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-54514 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-54515 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-50020 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.6.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-47244 | MEDIUM4.5 | io.netty:netty-codec-http2 4.2.6.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-50560 | MEDIUM4.5 | io.netty:netty-codec-http2 4.2.6.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-8916 | MEDIUM4.5 | org.bouncycastle:bcpkix-jdk15on 1.70 fixed in 1.79 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2023-33201 | MEDIUM4.5 | org.bouncycastle:bcprov-jdk15on 1.70 No fix yet | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2024-34447 | MEDIUM4.5 | org.bouncycastle:bcprov-jdk15on 1.70 fixed in 1.78 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2024-6763 | MEDIUM4.5 | org.eclipse.jetty:jetty-http 10.0.26 fixed in 12.0.12 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2024-6763 | MEDIUM4.5 | org.eclipse.jetty:jetty-http 9.4.53.v20231009 fixed in 12.0.12 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2025-31672 | MEDIUM4.4 | org.apache.poi:poi-ooxml 5.2.2 fixed in 5.4.0 | 1.3% Low-Moderate Risk | Directly Exposed |
| CVE-2026-27456 | MEDIUM4 | libblkid1 2.37.2-4ubuntu3.5 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-27456 | MEDIUM4 | libmount1 2.37.2-4ubuntu3.5 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-27456 | MEDIUM4 | libsmartcols1 2.37.2-4ubuntu3.5 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-27456 | MEDIUM4 | libuuid1 2.37.2-4ubuntu3.5 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-48924 | LOW3.7 | org.apache.commons:commons-lang3 3.12.0 fixed in 3.18.0 | 2.2% Low-Moderate Risk | Directly Exposed |
| CVE-2025-49128 | LOW3.4 | com.fasterxml.jackson.core:jackson-core 2.12.7 fixed in 2.13.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45536 | LOW3.4 | io.netty:netty-transport-native-epoll 4.2.6.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-15146 | LOW3.01 | wget 1.21.2-2ubuntu1.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2025-45582 | LOW2.86 | tar 1.34+dfsg-1ubuntu0.1.22.04.3 fixed in 1.34+dfsg-1ubuntu0.1.22.04.4 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-5704 | LOW2.8 | tar 1.34+dfsg-1ubuntu0.1.22.04.3 fixed in 1.34+dfsg-1ubuntu0.1.22.04.5 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW2.8 | libsystemd0 249.11-0ubuntu3.21 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2022-4899 | LOW2.7 | libzstd1 1.4.8+dfsg-3build1 No fix yet | 1.6% Low-Moderate Risk | Post-Exploit |
| CVE-2026-58470 | LOW2.7 | wget 1.21.2-2ubuntu1.1 fixed in 1.21.2-2ubuntu1.3 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-27456 | LOW2.4 | bsdutils 1:2.37.2-4ubuntu3.5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-41991 | LOW2.4 | gzip 1.10-4ubuntu4.1 fixed in 1.10-4ubuntu4.2 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-27456 | LOW2.4 | mount 2.37.2-4ubuntu3.5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-27456 | LOW2.4 | util-linux 2.37.2-4ubuntu3.5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-41992 | LOW2.29 | gzip 1.10-4ubuntu4.1 fixed in 1.10-4ubuntu4.2 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2021-31879 | LOW2.2 | wget 1.21.2-2ubuntu1.1 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-58471 | LOW2.17 | wget 1.21.2-2ubuntu1.1 fixed in 1.21.2-2ubuntu1.3 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-58472 | LOW2.17 | wget 1.21.2-2ubuntu1.1 fixed in 1.21.2-2ubuntu1.3 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | login 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-29383 | LOW1.68 | login 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-29383 | LOW1.68 | passwd 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2025-69720 | NONE0 | libncurses6 6.3-2ubuntu0.1 fixed in 6.3-2ubuntu0.2 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2025-69720 | NONE0 | libncursesw6 6.3-2ubuntu0.1 fixed in 6.3-2ubuntu0.2 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2025-69720 | NONE0 | libtinfo6 6.3-2ubuntu0.1 fixed in 6.3-2ubuntu0.2 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2025-69720 | NONE0 | ncurses-base 6.3-2ubuntu0.1 fixed in 6.3-2ubuntu0.2 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2025-69720 | NONE0 | ncurses-bin 6.3-2ubuntu0.1 fixed in 6.3-2ubuntu0.2 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2023-50495 | NONE0 | libncurses6 6.3-2ubuntu0.1 No fix yet | 1.0% Theoretical Threat | Not Applicable |
| CVE-2023-50495 | NONE0 | libncursesw6 6.3-2ubuntu0.1 No fix yet | 1.0% Theoretical Threat | Not Applicable |
| CVE-2023-50495 | NONE0 | libtinfo6 6.3-2ubuntu0.1 No fix yet | 1.0% Theoretical Threat | Not Applicable |
| CVE-2026-6238 | NONE0 | locales 2.35-0ubuntu3.13 No fix yet | 0.3% Theoretical Threat | Not Applicable |
| CVE-2023-50495 | NONE0 | ncurses-base 6.3-2ubuntu0.1 No fix yet | 1.0% Theoretical Threat | Not Applicable |
| CVE-2023-50495 | NONE0 | ncurses-bin 6.3-2ubuntu0.1 No fix yet | 1.0% Theoretical Threat | Not Applicable |
| CVE-2026-5435 | NONE0 | locales 2.35-0ubuntu3.13 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2022-27943 | NONE0 | gcc-12-base 12.3.0-1ubuntu1~22.04.3 No fix yet | 0.9% Theoretical Threat | Not Applicable |
| CVE-2026-4046 | NONE0 | locales 2.35-0ubuntu3.13 No fix yet | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-40228 | NONE0 | libudev1 249.11-0ubuntu3.21 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-58055 | NONE0 | libnghttp2-14 1.43.0-1ubuntu0.3 fixed in 1.43.0-1ubuntu0.4 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-40930 | NONE0 | libpng16-16 1.6.37-3ubuntu0.5 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-58469 | NONE0 | wget 1.21.2-2ubuntu1.1 fixed in 1.21.2-2ubuntu1.3 | 0.4% Theoretical Threat | Not Applicable |
| GHSA-72hv-8253-57qq | NONE0 | com.fasterxml.jackson.core:jackson-core 2.12.7 fixed in 2.21.1, 2.18.6 | — | Not Applicable |
| GHSA-72hv-8253-57qq | NONE0 | com.fasterxml.jackson.core:jackson-core 2.18.0 fixed in 2.21.1, 2.18.6 | — | Not Applicable |
| CVE-2026-42577 | NONE0 | io.netty:netty-transport-native-epoll 4.2.6.Final fixed in 4.2.13.Final | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-33558 | NONE0 | org.apache.kafka:kafka-clients 3.9.1 fixed in 3.9.2, 4.0.1 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2025-68280 | NONE0 | org.apache.sis.core:sis-metadata 1.2 fixed in 1.6 | 0.6% Theoretical Threat | Not Applicable |
| GHSA-2r2c-cx56-8933 | NONE0 | org.jline:jline-remote-telnet 3.9.0 fixed in 4.2.1 | — | Not Applicable |
| GHSA-47qp-hqvx-6r3f | NONE0 | org.jline:jline-remote-telnet 3.9.0 fixed in 4.2.1 | — | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.