Vulnerability Reportsonarqube:2025.1.8-enterprise

sonarqube:2025.1.8-enterprisesonarqube:2025.1-enterprisesonarqube:2025-lta-enterprise
digestsha256:afdbedf67095576a7859a82477c3a1544b85b8dea8760287b6448d4b5008aef6

Executive Summary

Last scanned:

Threat Score
0/100NEEDS ATTENTION
Reputation
TRUSTED

AI verdict failed due to an error.

Vulnerabilities

Vulnerability Log

186 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-41992LOW3.82
gzip
1.12-1ubuntu3.1
fixed in 1.12-1ubuntu3.2
0.3%
Theoretical Threat
Post-Exploit
CVE-2021-31879LOW3.66
wget
1.21.4-1ubuntu4.1
No fix yet
1.1%
Low-Moderate Risk
Post-Exploit
CVE-2026-58471LOW3.62
wget
1.21.4-1ubuntu4.1
fixed in 1.21.4-1ubuntu4.3
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-58472LOW3.62
wget
1.21.4-1ubuntu4.1
fixed in 1.21.4-1ubuntu4.3
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-58469LOW3.31
wget
1.21.4-1ubuntu4.1
fixed in 1.21.4-1ubuntu4.3
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-15146LOW3.01
wget
1.21.4-1ubuntu4.1
fixed in 1.21.4-1ubuntu4.4
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-45582LOW2.86
tar
1.35+dfsg-3build1
fixed in 1.35+dfsg-3ubuntu0.2
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-5704LOW2.8
tar
1.35+dfsg-3build1
fixed in 1.35+dfsg-3ubuntu0.4
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-58470LOW2.7
wget
1.21.4-1ubuntu4.1
fixed in 1.21.4-1ubuntu4.3
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
bsdutils
1:2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-10536LOW2.4
curl
8.5.0-2ubuntu10.10
fixed in 8.5.0-2ubuntu10.11
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-41991LOW2.4
gzip
1.12-1ubuntu3.1
fixed in 1.12-1ubuntu3.2
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
mount
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
util-linux
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2024-56433LOW1.84
passwd
1:4.13+dfsg1-4ubuntu3.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-45674NONE0
io.netty:netty-resolver-dns
4.1.115.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.2%
Theoretical Threat
Not Applicable
CVE-2026-47691NONE0
io.netty:netty-resolver-dns
4.1.115.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.3%
Theoretical Threat
Not Applicable
CVE-2026-8376NONE0
perl-base
5.38.2-3.2ubuntu0.2
fixed in 5.38.2-3.2ubuntu0.3
0.4%
Theoretical Threat
Not Applicable
CVE-2026-42581NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.6%
Theoretical Threat
Not Applicable
CVE-2026-42496NONE0
perl-base
5.38.2-3.2ubuntu0.2
fixed in 5.38.2-3.2ubuntu0.3
0.4%
Theoretical Threat
Not Applicable
CVE-2026-42579NONE0
io.netty:netty-codec-dns
4.1.115.Final
fixed in 4.2.13.Final, 4.1.133.Final
1.0%
Theoretical Threat
Not Applicable
CVE-2026-42584NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.8%
Theoretical Threat
Not Applicable
CVE-2026-41901NONE0
org.thymeleaf:thymeleaf
3.1.3.RELEASE
fixed in 3.1.5.RELEASE
0.4%
Theoretical Threat
Not Applicable
CVE-2026-41901NONE0
org.thymeleaf:thymeleaf-spring6
3.1.3.RELEASE
fixed in 3.1.5.RELEASE
0.4%
Theoretical Threat
Not Applicable
CVE-2025-48734NONE0
commons-beanutils:commons-beanutils
1.9.4
fixed in 1.11.0
1.5%
Low-Moderate Risk
Not Applicable
CVE-2026-40477NONE0
org.thymeleaf:thymeleaf
3.1.3.RELEASE
fixed in 3.1.4.RELEASE
0.9%
Theoretical Threat
Not Applicable
CVE-2026-40478NONE0
org.thymeleaf:thymeleaf
3.1.3.RELEASE
fixed in 3.1.4.RELEASE
0.8%
Theoretical Threat
Not Applicable
CVE-2026-40477NONE0
org.thymeleaf:thymeleaf-spring6
3.1.3.RELEASE
fixed in 3.1.4.RELEASE
0.9%
Theoretical Threat
Not Applicable
CVE-2026-40478NONE0
org.thymeleaf:thymeleaf-spring6
3.1.3.RELEASE
fixed in 3.1.4.RELEASE
0.8%
Theoretical Threat
Not Applicable
CVE-2026-54512NONE0
com.fasterxml.jackson.core:jackson-databind
2.16.1
fixed in 2.18.8, 3.1.4, 2.21.4
0.8%
Theoretical Threat
Not Applicable
CVE-2026-54513NONE0
com.fasterxml.jackson.core:jackson-databind
2.16.1
fixed in 2.18.8, 2.21.4, 3.1.4
0.7%
Theoretical Threat
Not Applicable
CVE-2026-54512NONE0
com.fasterxml.jackson.core:jackson-databind
2.18.2
fixed in 2.18.8, 3.1.4, 2.21.4
0.8%
Theoretical Threat
Not Applicable
CVE-2026-54513NONE0
com.fasterxml.jackson.core:jackson-databind
2.18.2
fixed in 2.18.8, 2.21.4, 3.1.4
0.7%
Theoretical Threat
Not Applicable
CVE-2025-59250NONE0
com.microsoft.sqlserver:mssql-jdbc
12.8.2
fixed in 10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11
0.7%
Theoretical Threat
Not Applicable
CVE-2026-44249NONE0
io.netty:netty-handler
4.1.115.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.6%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
libncursesw6
6.4+20240113-1ubuntu2
fixed in 6.4+20240113-1ubuntu2.1
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
libtinfo6
6.4+20240113-1ubuntu2
fixed in 6.4+20240113-1ubuntu2.1
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
ncurses-base
6.4+20240113-1ubuntu2
fixed in 6.4+20240113-1ubuntu2.1
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
ncurses-bin
6.4+20240113-1ubuntu2
fixed in 6.4+20240113-1ubuntu2.1
0.4%
Theoretical Threat
Not Applicable
CVE-2026-40355NONE0
libgssapi-krb5-2
1.20.1-6ubuntu2.6
fixed in 1.20.1-6ubuntu2.7
0.6%
Theoretical Threat
Not Applicable
CVE-2026-40356NONE0
libgssapi-krb5-2
1.20.1-6ubuntu2.6
fixed in 1.20.1-6ubuntu2.7
0.6%
Theoretical Threat
Not Applicable
CVE-2026-40355NONE0
libk5crypto3
1.20.1-6ubuntu2.6
fixed in 1.20.1-6ubuntu2.7
0.6%
Theoretical Threat
Not Applicable
CVE-2026-40356NONE0
libk5crypto3
1.20.1-6ubuntu2.6
fixed in 1.20.1-6ubuntu2.7
0.6%
Theoretical Threat
Not Applicable
CVE-2026-40355NONE0
libkrb5-3
1.20.1-6ubuntu2.6
fixed in 1.20.1-6ubuntu2.7
0.6%
Theoretical Threat
Not Applicable
CVE-2026-40356NONE0
libkrb5-3
1.20.1-6ubuntu2.6
fixed in 1.20.1-6ubuntu2.7
0.6%
Theoretical Threat
Not Applicable
CVE-2026-40355NONE0
libkrb5support0
1.20.1-6ubuntu2.6
fixed in 1.20.1-6ubuntu2.7
0.6%
Theoretical Threat
Not Applicable
CVE-2026-40356NONE0
libkrb5support0
1.20.1-6ubuntu2.6
fixed in 1.20.1-6ubuntu2.7
0.6%
Theoretical Threat
Not Applicable
CVE-2025-52999NONE0
com.fasterxml.jackson.core:jackson-core
2.14.2
fixed in 2.15.0
0.6%
Theoretical Threat
Not Applicable
CVE-2025-7962NONE0
com.sun.mail:jakarta.mail
1.6.3
fixed in 1.6.8, 2.0.2
0.8%
Theoretical Threat
Not Applicable
CVE-2025-7962NONE0
com.sun.mail:jakarta.mail
2.0.1
fixed in 1.6.8, 2.0.2
0.8%
Theoretical Threat
Not Applicable
CVE-2026-42583NONE0
io.netty:netty-codec
4.1.115.Final
fixed in 4.1.133.Final
0.4%
Theoretical Threat
Not Applicable
CVE-2026-59901NONE0
io.netty:netty-codec
4.1.115.Final
fixed in 4.1.136.Final
0.2%
Theoretical Threat
Not Applicable
CVE-2025-58057NONE0
io.netty:netty-codec
4.1.115.Final
fixed in 4.1.125.Final
0.6%
Theoretical Threat
Not Applicable
CVE-2026-33870NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.1.132.Final, 4.2.10.Final
0.6%
Theoretical Threat
Not Applicable
CVE-2026-42587NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.13.Final, 4.1.133.Final
1.0%
Theoretical Threat
Not Applicable
CVE-2026-55831NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Not Applicable
CVE-2026-55833NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Not Applicable
CVE-2026-56745NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.5%
Theoretical Threat
Not Applicable
CVE-2026-42585NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.2%
Theoretical Threat
Not Applicable
CVE-2026-56746NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Not Applicable
CVE-2026-59899NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.3%
Theoretical Threat
Not Applicable
CVE-2025-58056NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.1.125.Final, 4.2.5.Final
0.6%
Theoretical Threat
Not Applicable
CVE-2025-55163NONE0
io.netty:netty-codec-http2
4.1.115.Final
fixed in 4.2.4.Final, 4.1.124.Final
1.0%
Low-Moderate Risk
Not Applicable
CVE-2026-33871NONE0
io.netty:netty-codec-http2
4.1.115.Final
fixed in 4.1.132.Final, 4.2.11.Final
1.1%
Low-Moderate Risk
Not Applicable
CVE-2026-42587NONE0
io.netty:netty-codec-http2
4.1.115.Final
fixed in 4.2.13.Final, 4.1.133.Final
1.0%
Theoretical Threat
Not Applicable
CVE-2026-56819NONE0
io.netty:netty-codec-http2
4.1.115.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.3%
Theoretical Threat
Not Applicable
CVE-2026-48043NONE0
io.netty:netty-codec-http2
4.1.115.Final
fixed in 4.1.135.Final, 4.2.15.Final
0.6%
Theoretical Threat
Not Applicable
CVE-2025-24970NONE0
io.netty:netty-handler
4.1.115.Final
fixed in 4.1.118.Final
2.1%
Low-Moderate Risk
Not Applicable
CVE-2026-45416NONE0
io.netty:netty-handler
4.1.115.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.5%
Theoretical Threat
Not Applicable
CVE-2026-50010NONE0
io.netty:netty-handler
4.1.115.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.3%
Theoretical Threat
Not Applicable
CVE-2026-45292NONE0
io.opentelemetry:opentelemetry-api
1.31.0
fixed in 1.62.0
1.1%
Low-Moderate Risk
Not Applicable
CVE-2024-57699NONE0
net.minidev:json-smart
2.5.1
fixed in 2.5.2
0.6%
Theoretical Threat
Not Applicable
CVE-2026-34479NONE0
org.apache.logging.log4j:log4j-1.2-api
2.19.0
fixed in 2.25.4
0.5%
Theoretical Threat
Not Applicable
CVE-2026-34480NONE0
org.apache.logging.log4j:log4j-core
2.12.4
fixed in 2.25.4
0.9%
Theoretical Threat
Not Applicable
CVE-2026-34480NONE0
org.apache.logging.log4j:log4j-core
2.19.0
fixed in 2.25.4
0.9%
Theoretical Threat
Not Applicable
CVE-2026-5588NONE0
org.bouncycastle:bcpkix-jdk18on
1.78.1
fixed in 1.84
0.4%
Theoretical Threat
Not Applicable
CVE-2025-14813NONE0
org.bouncycastle:bcprov-jdk18on
1.78.1
fixed in 1.80.2, 1.81.1, 1.84
0.3%
Theoretical Threat
Not Applicable
CVE-2025-66566NONE0
org.lz4:lz4-java
1.8.0
No fix yet
0.6%
Theoretical Threat
Not Applicable
CVE-2025-41249NONE0
org.springframework:spring-core
6.2.1
fixed in 6.2.11
0.5%
Theoretical Threat
Not Applicable
CVE-2026-41848NONE0
org.springframework:spring-core
6.2.1
fixed in 7.0.8, 6.2.19
0.3%
Theoretical Threat
Not Applicable
CVE-2026-41851NONE0
org.springframework:spring-expression
6.2.1
fixed in 7.0.8, 6.2.19
0.4%
Theoretical Threat
Not Applicable
CVE-2025-37731NONE0
org.elasticsearch:elasticsearch
8.16.1
fixed in 8.19.8, 9.1.8, 9.2.2
0.2%
Theoretical Threat
Not Applicable
CVE-2026-45673NONE0
io.netty:netty-resolver-dns
4.1.115.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.3%
Theoretical Threat
Not Applicable
CVE-2026-4437NONE0
libc-bin
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.3%
Theoretical Threat
Not Applicable
CVE-2026-6238NONE0
libc-bin
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.4%
Theoretical Threat
Not Applicable
CVE-2026-4437NONE0
libc6
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.3%
Theoretical Threat
Not Applicable
CVE-2026-6238NONE0
libc6
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.4%
Theoretical Threat
Not Applicable
CVE-2026-4437NONE0
locales
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.3%
Theoretical Threat
Not Applicable
CVE-2026-6238NONE0
locales
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.4%
Theoretical Threat
Not Applicable
CVE-2026-59888NONE0
com.fasterxml.jackson.core:jackson-databind
2.16.1
fixed in 2.18.8, 2.21.4
0.2%
Theoretical Threat
Not Applicable
CVE-2026-59888NONE0
com.fasterxml.jackson.core:jackson-databind
2.18.2
fixed in 2.18.8, 2.21.4
0.2%
Theoretical Threat
Not Applicable
CVE-2025-67735NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.8.Final, 4.1.129.Final
0.3%
Theoretical Threat
Not Applicable
CVE-2026-41417NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.1.133.Final, 4.2.13.Final
0.3%
Theoretical Threat
Not Applicable
CVE-2026-42580NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.4%
Theoretical Threat
Not Applicable
CVE-2026-59900NONE0
io.netty:netty-codec-http2
4.1.115.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.3%
Theoretical Threat
Not Applicable
CVE-2024-29857NONE0
org.bouncycastle:bc-fips
1.0.2.4
fixed in 1.0.2.5
1.1%
Low-Moderate Risk
Not Applicable
CVE-2026-0636NONE0
org.bouncycastle:bcprov-jdk18on
1.78.1
fixed in 1.84
0.5%
Theoretical Threat
Not Applicable
CVE-2025-68384NONE0
org.elasticsearch.plugin:x-pack-security
8.16.1
fixed in 8.19.9, 9.1.9, 9.2.3
0.3%
Theoretical Threat
Not Applicable
CVE-2024-12539NONE0
org.elasticsearch:elasticsearch
8.16.1
fixed in 8.16.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-12183NONE0
org.lz4:lz4-java
1.8.0
fixed in 1.8.1
0.7%
Theoretical Threat
Not Applicable
CVE-2026-13757NONE0
libp11-kit0
0.25.3-4ubuntu2.1
No fix yet
0.1%
Theoretical Threat
Not Applicable
CVE-2026-13757NONE0
p11-kit
0.25.3-4ubuntu2.1
No fix yet
0.1%
Theoretical Threat
Not Applicable
CVE-2026-13757NONE0
p11-kit-modules
0.25.3-4ubuntu2.1
No fix yet
0.1%
Theoretical Threat
Not Applicable
CVE-2026-5435NONE0
libc-bin
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.2%
Theoretical Threat
Not Applicable
CVE-2026-5435NONE0
libc6
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.2%
Theoretical Threat
Not Applicable
CVE-2024-2236NONE0
libgcrypt20
1.10.3-2ubuntu0.1
No fix yet
1.1%
Low-Moderate Risk
Not Applicable
CVE-2026-5435NONE0
locales
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.2%
Theoretical Threat
Not Applicable
CVE-2026-34477NONE0
org.apache.logging.log4j:log4j-core
2.12.4
fixed in 2.25.4
0.4%
Theoretical Threat
Not Applicable
CVE-2026-34477NONE0
org.apache.logging.log4j:log4j-core
2.19.0
fixed in 2.25.4
0.4%
Theoretical Threat
Not Applicable
CVE-2026-54291NONE0
org.postgresql:postgresql
42.7.11
fixed in 42.7.12
0.2%
Theoretical Threat
Not Applicable
CVE-2026-41850NONE0
org.springframework:spring-expression
6.2.1
fixed in 7.0.8, 6.2.19
0.4%
Theoretical Threat
Not Applicable
CVE-2025-53864NONE0
com.nimbusds:nimbus-jose-jwt
9.37.3
fixed in 10.0.2, 9.37.4
0.8%
Theoretical Threat
Not Applicable
CVE-2025-53864NONE0
com.nimbusds:nimbus-jose-jwt
9.40
fixed in 10.0.2, 9.37.4
0.8%
Theoretical Threat
Not Applicable
CVE-2026-59921NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.3%
Theoretical Threat
Not Applicable
CVE-2025-37727NONE0
org.elasticsearch:elasticsearch
8.16.1
fixed in 8.18.8, 8.19.5, 9.0.8, 9.1.5
0.2%
Theoretical Threat
Not Applicable
CVE-2025-66382NONE0
libexpat1
2.6.1-2ubuntu0.4
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-27171NONE0
zlib1g
1:1.3.dfsg-3.1ubuntu2.1
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2025-25193NONE0
io.netty:netty-common
4.1.115.Final
fixed in 4.1.118.Final
0.4%
Theoretical Threat
Not Applicable
CVE-2026-58055NONE0
libnghttp2-14
1.59.0-1ubuntu0.3
fixed in 1.59.0-1ubuntu0.4
0.2%
Theoretical Threat
Not Applicable
CVE-2026-4046NONE0
libc-bin
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.4%
Theoretical Threat
Not Applicable
CVE-2026-4046NONE0
libc6
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.4%
Theoretical Threat
Not Applicable
CVE-2026-4046NONE0
locales
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.4%
Theoretical Threat
Not Applicable
CVE-2026-54514NONE0
com.fasterxml.jackson.core:jackson-databind
2.16.1
fixed in 2.18.8, 2.21.4, 3.1.4
0.2%
Theoretical Threat
Not Applicable
CVE-2026-54515NONE0
com.fasterxml.jackson.core:jackson-databind
2.16.1
fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54514NONE0
com.fasterxml.jackson.core:jackson-databind
2.18.2
fixed in 2.18.8, 2.21.4, 3.1.4
0.2%
Theoretical Threat
Not Applicable
CVE-2026-54515NONE0
com.fasterxml.jackson.core:jackson-databind
2.18.2
fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1
0.3%
Theoretical Threat
Not Applicable
CVE-2026-50020NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.2%
Theoretical Threat
Not Applicable
CVE-2026-59898NONE0
io.netty:netty-codec-http
4.1.115.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.3%
Theoretical Threat
Not Applicable
CVE-2026-47244NONE0
io.netty:netty-codec-http2
4.1.115.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.3%
Theoretical Threat
Not Applicable
CVE-2026-50560NONE0
io.netty:netty-codec-http2
4.1.115.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.3%
Theoretical Threat
Not Applicable
CVE-2025-8885NONE0
org.bouncycastle:bc-fips
1.0.2.4
fixed in 1.0.2.6, 2.0.1
0.5%
Theoretical Threat
Not Applicable
CVE-2025-8916NONE0
org.bouncycastle:bcpkix-jdk18on
1.78.1
fixed in 1.79
0.5%
Theoretical Threat
Not Applicable
CVE-2025-4949NONE0
org.eclipse.jgit:org.eclipse.jgit
7.0.0.202409031743-r
fixed in 7.2.1.202505142326-r, 7.1.1.202505221757-r, 7.0.1.202505221510-r, 6.10.1.202505221210-r, 6.0.0.202111291000-r, 5.13.4.202507202350-r
1.0%
Low-Moderate Risk
Not Applicable
CVE-2026-41852NONE0
org.springframework:spring-expression
6.2.1
fixed in 7.0.8, 6.2.19
0.2%
Theoretical Threat
Not Applicable
CVE-2026-5450NONE0
libc-bin
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.5%
Theoretical Threat
Not Applicable
CVE-2026-5928NONE0
libc-bin
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.4%
Theoretical Threat
Not Applicable
CVE-2026-5450NONE0
libc6
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.5%
Theoretical Threat
Not Applicable
CVE-2026-5928NONE0
libc6
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.4%
Theoretical Threat
Not Applicable
CVE-2026-11850NONE0
libgssapi-krb5-2
1.20.1-6ubuntu2.6
fixed in 1.20.1-6ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-11850NONE0
libk5crypto3
1.20.1-6ubuntu2.6
fixed in 1.20.1-6ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-11850NONE0
libkrb5-3
1.20.1-6ubuntu2.6
fixed in 1.20.1-6ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-11850NONE0
libkrb5support0
1.20.1-6ubuntu2.6
fixed in 1.20.1-6ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-5450NONE0
locales
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.5%
Theoretical Threat
Not Applicable
CVE-2026-5928NONE0
locales
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.4%
Theoretical Threat
Not Applicable
CVE-2025-68390NONE0
org.elasticsearch.plugin:x-pack-core
8.16.1
fixed in 8.19.8, 9.1.8, 9.2.2
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam-modules
1.5.3-5ubuntu5.5
fixed in 1.5.3-5ubuntu5.6
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam-modules-bin
1.5.3-5ubuntu5.5
fixed in 1.5.3-5ubuntu5.6
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam-runtime
1.5.3-5ubuntu5.5
fixed in 1.5.3-5ubuntu5.6
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam0g
1.5.3-5ubuntu5.5
fixed in 1.5.3-5ubuntu5.6
0.3%
Theoretical Threat
Not Applicable
CVE-2025-68161NONE0
org.apache.logging.log4j:log4j-core
2.12.4
fixed in 2.25.3
0.8%
Theoretical Threat
Not Applicable
CVE-2025-68161NONE0
org.apache.logging.log4j:log4j-core
2.19.0
fixed in 2.25.3
0.8%
Theoretical Threat
Not Applicable
CVE-2026-27456NONE0
libblkid1
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Not Applicable
CVE-2026-10536NONE0
libcurl4t64
8.5.0-2ubuntu10.10
fixed in 8.5.0-2ubuntu10.11
0.5%
Theoretical Threat
Not Applicable
CVE-2026-27456NONE0
libmount1
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Not Applicable
CVE-2026-27456NONE0
libsmartcols1
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Not Applicable
CVE-2026-27456NONE0
libuuid1
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Not Applicable
CVE-2026-4438NONE0
libc-bin
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.3%
Theoretical Threat
Not Applicable
CVE-2026-4438NONE0
libc6
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.3%
Theoretical Threat
Not Applicable
CVE-2026-4438NONE0
locales
2.39-0ubuntu8.7
fixed in 2.39-0ubuntu8.8
0.3%
Theoretical Threat
Not Applicable
CVE-2025-48924NONE0
commons-lang:commons-lang
2.6
No fix yet
2.2%
Low-Moderate Risk
Not Applicable
CVE-2025-48924NONE0
org.apache.commons:commons-lang3
3.14.0
fixed in 3.18.0
2.2%
Low-Moderate Risk
Not Applicable
CVE-2025-48924NONE0
org.apache.commons:commons-lang3
3.16.0
fixed in 3.18.0
2.2%
Low-Moderate Risk
Not Applicable
CVE-2025-48924NONE0
org.apache.commons:commons-lang3
3.17.0
fixed in 3.18.0
2.2%
Low-Moderate Risk
Not Applicable
CVE-2024-56433NONE0
login
1:4.13+dfsg1-4ubuntu3.2
No fix yet
0.4%
Theoretical Threat
Not Applicable
CVE-2026-40228NONE0
libsystemd0
255.4-1ubuntu8.16
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-40228NONE0
libudev1
255.4-1ubuntu8.16
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-50812NONE0
libsqlite3-0
3.45.1-1ubuntu2.6
fixed in 3.45.1-1ubuntu2.7
0.1%
Theoretical Threat
Not Applicable
CVE-2026-50813NONE0
libsqlite3-0
3.45.1-1ubuntu2.6
fixed in 3.45.1-1ubuntu2.7
0.1%
Theoretical Threat
Not Applicable
CVE-2026-10532NONE0
ch.qos.logback:logback-core
1.5.26
fixed in 1.5.34
0.4%
Theoretical Threat
Not Applicable
CVE-2026-9828NONE0
ch.qos.logback:logback-core
1.5.26
fixed in 1.5.33
0.4%
Theoretical Threat
Not Applicable
GHSA-r7wm-3cxj-wff9NONE0
com.fasterxml.jackson.core:jackson-core
2.14.2
fixed in 2.18.8, 2.21.4, 2.22.1
—
Not Applicable
GHSA-72hv-8253-57qqNONE0
com.fasterxml.jackson.core:jackson-core
2.14.2
fixed in 2.21.1, 2.18.6
—
Not Applicable
GHSA-r7wm-3cxj-wff9NONE0
com.fasterxml.jackson.core:jackson-core
2.15.0
fixed in 2.18.8, 2.21.4, 2.22.1
—
Not Applicable
GHSA-72hv-8253-57qqNONE0
com.fasterxml.jackson.core:jackson-core
2.15.0
fixed in 2.21.1, 2.18.6
—
Not Applicable
GHSA-r7wm-3cxj-wff9NONE0
com.fasterxml.jackson.core:jackson-core
2.16.1
fixed in 2.18.8, 2.21.4, 2.22.1
—
Not Applicable
GHSA-72hv-8253-57qqNONE0
com.fasterxml.jackson.core:jackson-core
2.16.1
fixed in 2.21.1, 2.18.6
—
Not Applicable
GHSA-r7wm-3cxj-wff9NONE0
com.fasterxml.jackson.core:jackson-core
2.17.2
fixed in 2.18.8, 2.21.4, 2.22.1
—
Not Applicable
GHSA-72hv-8253-57qqNONE0
com.fasterxml.jackson.core:jackson-core
2.17.2
fixed in 2.21.1, 2.18.6
—
Not Applicable
GHSA-r7wm-3cxj-wff9NONE0
com.fasterxml.jackson.core:jackson-core
2.18.2
fixed in 2.18.8, 2.21.4, 2.22.1
—
Not Applicable
GHSA-72hv-8253-57qqNONE0
com.fasterxml.jackson.core:jackson-core
2.18.2
fixed in 2.21.1, 2.18.6
—
Not Applicable
CVE-2026-59889NONE0
com.fasterxml.jackson.core:jackson-databind
2.18.2
fixed in 2.21.5, 2.18.9, 2.22.1
0.3%
Theoretical Threat
Not Applicable
GHSA-mhm7-754m-9p8wNONE0
com.fasterxml.jackson.core:jackson-databind
2.18.2
fixed in 2.18.9, 2.21.5
—
Not Applicable
GHSA-mfg7-5gfp-c4w3NONE0
io.netty:netty-codec-dns
4.1.115.Final
fixed in 4.2.16.Final, 4.1.136.Final
—
Not Applicable
CVE-2020-36843NONE0
net.i2p.crypto:eddsa
0.3.0
No fix yet
0.1%
Theoretical Threat
Not Applicable
CVE-2026-59949NONE0
org.lz4:lz4-java
1.8.0
No fix yet
—
Not Applicable
CVE-2025-22233NONE0
org.springframework:spring-context
6.2.1
fixed in 6.2.7, 6.1.20
0.4%
Theoretical Threat
Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.