Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could potentially execute arbitrary code, cause memory corruption, or enable request smuggling by exploiting exposed components, with CVE-2026-54512 and CVE-2026-42581 being among the most impactful. The official publisher and digest pinning improve supply-chain trust, but 103 exposed findings are severity 6 or above, with a maximum exposed severity of 6.97, and 273 total exposed findings remain. Note that CVE-2026-54512 only applies if Jackson polymorphic typing is enabled with attacker-controlled type IDs, and CVE-2026-42581 only applies if the Netty HTTP endpoint is reachable. Disabling Jackson polymorphic typing would fully eliminate CVE-2026-54512.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-86145 | MEDIUM6.97 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54512 | MEDIUM6.88 | com.fasterxml.jackson.core:jackson-databind 2.17.3 fixed in 2.18.8, 3.1.4, 2.21.4 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-54512 | MEDIUM6.88 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.8, 3.1.4, 2.21.4 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-54512 | MEDIUM6.88 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.8, 3.1.4, 2.21.4 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2025-59250 | MEDIUM6.88 | com.microsoft.sqlserver:mssql-jdbc 12.10.2 fixed in 10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-42581 | MEDIUM6.66 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42581 | MEDIUM6.66 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-76957 | MEDIUM6.63 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | MEDIUM6.63 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-54513 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.17.3 fixed in 2.18.8, 2.21.4, 3.1.4 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54513 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.8, 2.21.4, 3.1.4 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54513 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.8, 2.21.4, 3.1.4 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-44249 | MEDIUM6.48 | io.netty:netty-handler 4.1.126.Final fixed in 4.2.15.Final, 4.1.135.Final | 1.3% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-44249 | MEDIUM6.48 | io.netty:netty-handler 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 1.3% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-103111 | MEDIUM6.46 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-45186 | MEDIUM6.38 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-66046 | MEDIUM6.38 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-76641 | MEDIUM6.38 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-68494 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.15.0 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.15.0 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68494 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.17.2 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.17.2 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68494 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.17.3 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.17.3 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68494 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.19.2 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.19.2 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68494 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.20.1 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.20.1 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68497 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.17.3 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.17.3 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.17.3 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-68497 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-68497 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-7962 | MEDIUM6.38 | com.sun.mail:jakarta.mail 1.6.3 fixed in 1.6.8, 2.0.2 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2025-7962 | MEDIUM6.38 | com.sun.mail:jakarta.mail 2.0.1 fixed in 1.6.8, 2.0.2 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-42583 | MEDIUM6.38 | io.netty:netty-codec 4.1.126.Final fixed in 4.1.133.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59901 | MEDIUM6.38 | io.netty:netty-codec 4.1.126.Final fixed in 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42583 | MEDIUM6.38 | io.netty:netty-codec-compression 4.2.2.Final fixed in 4.2.13.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59901 | MEDIUM6.38 | io.netty:netty-codec-compression 4.2.2.Final fixed in 4.2.16.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-58057 | MEDIUM6.38 | io.netty:netty-codec-compression 4.2.2.Final fixed in 4.2.5.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-73508 | MEDIUM6.38 | io.netty:netty-codec-dns 4.1.126.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-33870 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.1.132.Final, 4.2.10.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-55831 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-55833 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-56745 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42585 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56746 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59898 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59899 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-59903 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-33870 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.1.132.Final, 4.2.10.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-55831 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-55833 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-56745 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42585 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56746 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59898 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59899 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-59903 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-58056 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.1.125.Final, 4.2.5.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-56819 | MEDIUM6.38 | io.netty:netty-codec-http2 4.1.126.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-48043 | MEDIUM6.38 | io.netty:netty-codec-http2 4.1.126.Final fixed in 4.1.135.Final, 4.2.15.Final | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-56819 | MEDIUM6.38 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-48043 | MEDIUM6.38 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.1.135.Final, 4.2.15.Final | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-50010 | MEDIUM6.38 | io.netty:netty-handler 4.1.126.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-75596 | MEDIUM6.38 | io.netty:netty-handler 4.1.126.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-50010 | MEDIUM6.38 | io.netty:netty-handler 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-75596 | MEDIUM6.38 | io.netty:netty-handler 4.2.2.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-45292 | MEDIUM6.38 | io.opentelemetry:opentelemetry-api 1.31.0 fixed in 1.62.0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-64607 | MEDIUM6.38 | org.apache.httpcomponents.client5:httpclient5 5.3.1 fixed in 5.6.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-54399 | MEDIUM6.38 | org.apache.httpcomponents.core5:httpcore5 5.2.5 fixed in 5.4.3, 5.5-beta2 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-54428 | MEDIUM6.38 | org.apache.httpcomponents.core5:httpcore5-h2 5.2.4 fixed in 5.4.3, 5.5-beta2 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-34479 | MEDIUM6.38 | org.apache.logging.log4j:log4j-1.2-api 2.19.0 fixed in 2.25.4 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-13505 | MEDIUM6.38 | org.bouncycastle:bc-fips 1.0.2.6 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-13506 | MEDIUM6.38 | org.bouncycastle:bc-fips 1.0.2.6 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-5588 | MEDIUM6.38 | org.bouncycastle:bcpkix-jdk18on 1.79 fixed in 1.84 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2025-14813 | MEDIUM6.38 | org.bouncycastle:bcprov-jdk18on 1.79 fixed in 1.80.2, 1.81.1, 1.84 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-13506 | MEDIUM6.38 | org.bouncycastle:bcprov-jdk18on 1.79 fixed in 1.85 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75140 | MEDIUM6.38 | org.jsoup:jsoup 1.21.2 fixed in 1.23.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-66566 | MEDIUM6.38 | org.lz4:lz4-java 1.8.0 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | tools.jackson.core:jackson-core 3.1.5 fixed in 3.1.7, 3.2.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68497 | MEDIUM6.38 | tools.jackson.core:jackson-databind 3.1.5 fixed in 3.2.2, 3.1.6 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM6.38 | tools.jackson.core:jackson-databind 3.1.5 fixed in 3.1.7, 3.2.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM6.38 | tools.jackson.core:jackson-databind 3.1.5 fixed in 3.1.7, 3.2.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM6.29 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-84782 | MEDIUM6.29 | libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75595 | MEDIUM6.18 | io.netty:netty-handler 4.1.126.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75595 | MEDIUM6.18 | io.netty:netty-handler 4.2.2.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-8763 | MEDIUM6.18 | org.bouncycastle:bc-fips 1.0.2.6 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-8763 | MEDIUM6.18 | org.bouncycastle:bcprov-jdk18on 1.79 fixed in 1.85 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42587 | MEDIUM6 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.13.Final, 4.1.133.Final | 1.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42587 | MEDIUM6 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.13.Final, 4.1.133.Final | 1.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33871 | MEDIUM6 | io.netty:netty-codec-http2 4.1.126.Final fixed in 4.1.132.Final, 4.2.11.Final | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42587 | MEDIUM6 | io.netty:netty-codec-http2 4.1.126.Final fixed in 4.2.13.Final, 4.1.133.Final | 1.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2025-55163 | MEDIUM6 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.2.4.Final, 4.1.124.Final | 1.1% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33871 | MEDIUM6 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.1.132.Final, 4.2.11.Final | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42587 | MEDIUM6 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.2.13.Final, 4.1.133.Final | 1.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-45416 | MEDIUM6 | io.netty:netty-handler 4.1.126.Final fixed in 4.2.15.Final, 4.1.135.Final | 1.6% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-45416 | MEDIUM6 | io.netty:netty-handler 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 1.6% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-107726 | MEDIUM5.98 | com.hazelcast:hazelcast 5.6.0 fixed in 5.7.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-107725 | MEDIUM5.98 | com.hazelcast:hazelcast 5.6.0 fixed in 5.7.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-106451 | MEDIUM5.95 | org.lz4:lz4-java 1.8.0 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-46675 | MEDIUM5.9 | libpng16-16t64 1.6.43-5ubuntu0.6 fixed in 1.6.43-5ubuntu0.7 | — | Directly Exposed |
| CVE-2026-56132 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56403 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56404 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56405 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56406 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56407 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56410 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56411 | MEDIUM5.87 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-45673 | MEDIUM5.78 | io.netty:netty-resolver-dns 4.1.126.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89158 | MEDIUM5.52 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | MEDIUM5.52 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-59888 | MEDIUM5.52 | com.fasterxml.jackson.core:jackson-databind 2.17.3 fixed in 2.18.8, 2.21.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59889 | MEDIUM5.52 | com.fasterxml.jackson.core:jackson-databind 2.17.3 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59888 | MEDIUM5.52 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.8, 2.21.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59889 | MEDIUM5.52 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59888 | MEDIUM5.52 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.8, 2.21.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59889 | MEDIUM5.52 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-67735 | MEDIUM5.52 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.8.Final, 4.1.129.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-41417 | MEDIUM5.52 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.1.133.Final, 4.2.13.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-42580 | MEDIUM5.52 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59921 | MEDIUM5.52 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-67735 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.8.Final, 4.1.129.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-41417 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.1.133.Final, 4.2.13.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-42580 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59921 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-0636 | MEDIUM5.52 | org.bouncycastle:bcprov-jdk18on 1.79 fixed in 1.84 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-68384 | MEDIUM5.52 | org.elasticsearch.plugin:x-pack-security 8.19.8 fixed in 8.19.9, 9.1.9, 9.2.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-12183 | MEDIUM5.52 | org.lz4:lz4-java 1.8.0 fixed in 1.8.1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2017-13716 | MEDIUM5.5 | libbinutils 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2017-13716 | MEDIUM5.5 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2017-13716 | MEDIUM5.5 | libctf0 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2017-13716 | MEDIUM5.5 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2017-13716 | MEDIUM5.5 | libsframe1 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2025-11226 | MEDIUM5.44 | ch.qos.logback:logback-core 1.5.18 fixed in 1.5.19, 1.3.16 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-59375 | MEDIUM5.3 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 1.3% Low-Moderate Risk | Directly Exposed |
| CVE-2026-72522 | MEDIUM5.27 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-50219 | MEDIUM5.02 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56412 | MEDIUM5.02 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | MEDIUM5.02 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-54872 | MEDIUM5.02 | libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | MEDIUM5.02 | libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-77696 | MEDIUM5.02 | libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM5.02 | com.fasterxml.jackson.core:jackson-core 2.17.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM5.02 | com.fasterxml.jackson.core:jackson-core 2.17.3 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM5.02 | com.fasterxml.jackson.core:jackson-core 2.19.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM5.02 | com.fasterxml.jackson.core:jackson-core 2.20.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-49844 | MEDIUM5.02 | org.apache.logging.log4j:log4j-api 2.19.0 fixed in 2.25.5, 2.26.1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-49844 | MEDIUM5.02 | org.apache.logging.log4j:log4j-api 2.25.0 fixed in 2.25.5, 2.26.1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-49844 | MEDIUM5.02 | org.apache.logging.log4j:log4j-api 2.25.3 fixed in 2.25.5, 2.26.1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-34477 | MEDIUM5.02 | org.apache.logging.log4j:log4j-core 2.19.0 fixed in 2.25.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-34477 | MEDIUM5.02 | org.apache.logging.log4j:log4j-core 2.25.0 fixed in 2.25.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-54291 | MEDIUM5.02 | org.postgresql:postgresql 42.7.11 fixed in 42.7.12 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM5.02 | tools.jackson.core:jackson-core 3.1.5 fixed in 3.1.7, 3.2.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.76 | com.fasterxml.jackson.core:jackson-databind 2.17.3 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.76 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.76 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.76 | tools.jackson.core:jackson-databind 3.1.5 fixed in 3.1.6, 3.2.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2025-69651 | MEDIUM4.67 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69651 | MEDIUM4.67 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69651 | MEDIUM4.67 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-66382 | MEDIUM4.67 | libexpat1 2.6.1-2ubuntu0.4 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-32776 | MEDIUM4.67 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-32777 | MEDIUM4.67 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-32778 | MEDIUM4.67 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95512 | MEDIUM4.67 | libfreetype6 2.13.2+dfsg-1ubuntu0.1 fixed in 2.13.2+dfsg-1ubuntu0.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69651 | MEDIUM4.67 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69651 | MEDIUM4.67 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | MEDIUM4.5 | libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18401 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.15.0 fixed in 2.21.1, 2.18.6 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18401 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.17.2 fixed in 2.21.1, 2.18.6 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18401 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.17.3 fixed in 2.21.1, 2.18.6 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18401 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.19.2 fixed in 2.21.1, 2.18.6 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18401 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.20.1 fixed in 2.21.1, 2.18.6 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.17.3 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-54514 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.17.3 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54515 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.17.3 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-77310 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.17.3 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-54514 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54515 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-77310 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.19.2 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-54514 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54515 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-77310 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-50020 | MEDIUM4.5 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-50020 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-47244 | MEDIUM4.5 | io.netty:netty-codec-http2 4.1.126.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-50560 | MEDIUM4.5 | io.netty:netty-codec-http2 4.1.126.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59900 | MEDIUM4.5 | io.netty:netty-codec-http2 4.1.126.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-47244 | MEDIUM4.5 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-50560 | MEDIUM4.5 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59900 | MEDIUM4.5 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-106450 | MEDIUM4.5 | org.lz4:lz4-java 1.8.0 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-106452 | MEDIUM4.5 | org.lz4:lz4-java 1.8.0 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-106453 | MEDIUM4.5 | org.lz4:lz4-java 1.8.0 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.5 | tools.jackson.core:jackson-databind 3.1.5 fixed in 3.1.6, 3.2.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-39113 | MEDIUM4.25 | libsqlite3-0 3.45.1-1ubuntu2.7 fixed in 3.45.1-1ubuntu2.8 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-1225 | MEDIUM4.25 | ch.qos.logback:logback-core 1.5.18 fixed in 1.5.25 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.17 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.17 | libc6 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-68161 | MEDIUM4.08 | org.apache.logging.log4j:log4j-core 2.19.0 fixed in 2.25.3 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2025-68161 | MEDIUM4.08 | org.apache.logging.log4j:log4j-core 2.25.0 fixed in 2.25.3 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-71497 | MEDIUM4 | org.jsoup:jsoup 1.21.2 fixed in 1.23.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56131 | LOW3.82 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-48924 | LOW3.7 | org.apache.commons:commons-lang3 3.17.0 fixed in 3.18.0 | 2.6% Low-Moderate Risk | Directly Exposed |
| CVE-2025-48924 | LOW3.7 | org.apache.commons:commons-lang3 3.9 fixed in 3.18.0 | 2.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-89092 | LOW3.57 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | LOW3.57 | libc6 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-45536 | LOW3.4 | io.netty:netty-transport-native-epoll 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2017-13716 | LOW3.3 | binutils 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Post-Exploit |
| CVE-2017-13716 | LOW3.3 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Post-Exploit |
| CVE-2025-1152 | LOW3.15 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-1152 | LOW3.15 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-1152 | LOW3.15 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-41080 | LOW3.15 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-1152 | LOW3.15 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-1152 | LOW3.15 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-35189 | LOW3.15 | libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-106449 | LOW3.15 | org.lz4:lz4-java 1.8.0 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45674 | LOW3.06 | io.netty:netty-resolver-dns 4.1.126.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-47691 | LOW3.06 | io.netty:netty-resolver-dns 4.1.126.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-75805 | LOW3.01 | openssl 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-77696 | LOW3.01 | openssl 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-15534 | LOW2.91 | perl-base 5.38.2-3.2ubuntu0.4 fixed in 5.38.2-3.2ubuntu0.6 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2025-69651 | LOW2.8 | binutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69651 | LOW2.8 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-102473 | LOW2.8 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2025-69647 | LOW2.8 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69648 | LOW2.8 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69652 | LOW2.8 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69647 | LOW2.8 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69648 | LOW2.8 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69652 | LOW2.8 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69647 | LOW2.8 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69648 | LOW2.8 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69652 | LOW2.8 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69647 | LOW2.8 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69648 | LOW2.8 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69652 | LOW2.8 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69647 | LOW2.8 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69648 | LOW2.8 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69652 | LOW2.8 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW2.8 | libsystemd0 255.4-1ubuntu8.17 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW2.8 | libudev1 255.4-1ubuntu8.17 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-42579 | LOW2.78 | io.netty:netty-codec-dns 4.1.126.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-42584 | LOW2.78 | io.netty:netty-codec-http 4.1.126.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-42584 | LOW2.78 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-42578 | LOW2.7 | io.netty:netty-handler-proxy 4.2.2.Final fixed in 4.1.133.Final, 4.2.13.Final | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-34480 | LOW2.7 | org.apache.logging.log4j:log4j-core 2.19.0 fixed in 2.25.4 | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-34478 | LOW2.7 | org.apache.logging.log4j:log4j-core 2.25.0 fixed in 2.25.4 | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-34480 | LOW2.7 | org.apache.logging.log4j:log4j-core 2.25.0 fixed in 2.25.4 | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-75806 | LOW2.7 | openssl 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2025-69644 | LOW2.38 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-69645 | LOW2.38 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69646 | LOW2.38 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69644 | LOW2.38 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-69645 | LOW2.38 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69646 | LOW2.38 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69644 | LOW2.38 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-69645 | LOW2.38 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69646 | LOW2.38 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69644 | LOW2.38 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-69645 | LOW2.38 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69646 | LOW2.38 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69644 | LOW2.38 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-69645 | LOW2.38 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69646 | LOW2.38 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86414 | LOW2.34 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-84782 | LOW2.26 | openssl 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-18477 | LOW2.24 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.24 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-87862 | LOW2.22 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-87863 | LOW2.22 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-87864 | LOW2.22 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-92389 | LOW2.22 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-92391 | LOW2.22 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-87862 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-87863 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-87864 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-92389 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-92391 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2021-31879 | LOW2.2 | wget 1.21.4-1ubuntu4.5 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-102474 | LOW2.04 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-19487 | LOW1.99 | perl-base 5.38.2-3.2ubuntu0.4 fixed in 5.38.2-3.2ubuntu0.6 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | curl 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | libcurl4t64 8.5.0-2ubuntu10.13 No fix yet | — | Post-Exploit |
| CVE-2025-1152 | LOW1.89 | binutils 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2025-1152 | LOW1.89 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-13608 | LOW1.89 | curl 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-18924 | LOW1.89 | curl 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.89 | curl 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-13608 | LOW1.89 | libcurl4t64 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-18924 | LOW1.89 | libcurl4t64 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.89 | libcurl4t64 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-35189 | LOW1.89 | openssl 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-54872 | LOW1.81 | openssl 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2025-69647 | LOW1.68 | binutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69648 | LOW1.68 | binutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69652 | LOW1.68 | binutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69647 | LOW1.68 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69648 | LOW1.68 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69652 | LOW1.68 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-82209 | LOW1.58 | curl 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-82209 | LOW1.58 | libcurl4t64 8.5.0-2ubuntu10.13 fixed in 8.5.0-2ubuntu10.15 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2025-69644 | LOW1.43 | binutils 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2025-69645 | LOW1.43 | binutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69646 | LOW1.43 | binutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69644 | LOW1.43 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2025-69645 | LOW1.43 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69646 | LOW1.43 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69651 | NONE0 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2017-13716 | NONE0 | binutils-common 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Not Applicable |
| CVE-2026-77420 | NONE0 | org.jline:jline-reader 3.21.0 fixed in 4.3.1, 3.30.15 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-18374 | NONE0 | locales 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-89092 | NONE0 | locales 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2025-1152 | NONE0 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Not Applicable |
| CVE-2024-56433 | NONE0 | login 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Not Applicable |
| CVE-2025-69647 | NONE0 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2025-69648 | NONE0 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2025-69652 | NONE0 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2025-69644 | NONE0 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Not Applicable |
| CVE-2025-69645 | NONE0 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2025-69646 | NONE0 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-56408 | NONE0 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.5 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-56409 | NONE0 | libexpat1 2.6.1-2ubuntu0.4 fixed in 2.6.1-2ubuntu0.6 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-67693 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-88647 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-95184 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-95209 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-95210 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-107161 | NONE0 | libsasl2-2 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-107161 | NONE0 | libsasl2-modules-db 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-85091 | NONE0 | zlib1g 1:1.3.dfsg-3.1ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-10532 | NONE0 | ch.qos.logback:logback-core 1.5.18 fixed in 1.5.34 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-9828 | NONE0 | ch.qos.logback:logback-core 1.5.18 fixed in 1.5.33 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-10532 | NONE0 | ch.qos.logback:logback-core 1.5.26 fixed in 1.5.34 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-9828 | NONE0 | ch.qos.logback:logback-core 1.5.26 fixed in 1.5.33 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-42577 | NONE0 | io.netty:netty-transport-classes-epoll 4.2.2.Final fixed in 4.2.13.Final | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-59949 | NONE0 | org.lz4:lz4-java 1.8.0 No fix yet | 0.5% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.