Vulnerability Reportsonarqube:2026.5.0-developer

sonarqube:2026.5.0-developer
digestsha256:d3d3a11c738d8a02876aa9d8144636a4fb58f1beb093dea1ffca8b8a70061cb0

Executive Summary

Last scanned:

Threat Score
50/100CAUTION
Reputation
TRUSTED

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could exploit CVE-2026-47691 to poison DNS caches and redirect outbound connections, and if Jackson polymorphic typing with allowIfSubTypeIsArray() is enabled, CVE-2026-54513 could lead to arbitrary code execution. Ensuring that Jackson polymorphic typing with allowIfSubTypeIsArray() is not enabled would fully eliminate CVE-2026-54513. Note that CVE-2026-54513 only applies under that non-default Jackson configuration, while the Netty DNS issue requires a malicious or compromised DNS server.

Vulnerabilities

Vulnerability Log

244 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-45674MEDIUM6.8
io.netty:netty-resolver-dns
4.2.2.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-47691MEDIUM6.8
io.netty:netty-resolver-dns
4.2.2.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-54513MEDIUM6.48
com.fasterxml.jackson.core:jackson-databind
2.15.0
fixed in 2.18.8, 2.21.4, 3.1.4
1.2%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2026-68494MEDIUM6.38
com.fasterxml.jackson.core:jackson-core
2.15.0
fixed in 2.18.8, 2.21.4
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-89425MEDIUM6.38
com.fasterxml.jackson.core:jackson-core
2.15.0
fixed in 2.21.7, 2.22.3, 2.18.11
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-68494MEDIUM6.38
com.fasterxml.jackson.core:jackson-core
2.17.2
fixed in 2.18.8, 2.21.4
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-89425MEDIUM6.38
com.fasterxml.jackson.core:jackson-core
2.17.2
fixed in 2.21.7, 2.22.3, 2.18.11
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-89425MEDIUM6.38
com.fasterxml.jackson.core:jackson-core
2.22.2
fixed in 2.21.7, 2.22.3, 2.18.11
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-68497MEDIUM6.38
com.fasterxml.jackson.core:jackson-databind
2.15.0
fixed in 2.18.10, 2.21.6, 2.22.2
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-91776MEDIUM6.38
com.fasterxml.jackson.core:jackson-databind
2.15.0
fixed in 2.18.11, 2.21.7, 2.22.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-91777MEDIUM6.38
com.fasterxml.jackson.core:jackson-databind
2.15.0
fixed in 2.21.7, 2.18.11, 2.22.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-91776MEDIUM6.38
com.fasterxml.jackson.core:jackson-databind
2.22.2
fixed in 2.18.11, 2.21.7, 2.22.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-91777MEDIUM6.38
com.fasterxml.jackson.core:jackson-databind
2.22.2
fixed in 2.21.7, 2.18.11, 2.22.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2025-7962MEDIUM6.38
com.sun.mail:jakarta.mail
2.0.1
fixed in 1.6.8, 2.0.2
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-59901MEDIUM6.38
io.netty:netty-codec
4.1.135.Final
fixed in 4.1.136.Final
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-42583MEDIUM6.38
io.netty:netty-codec-compression
4.2.2.Final
fixed in 4.2.13.Final
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-59901MEDIUM6.38
io.netty:netty-codec-compression
4.2.2.Final
fixed in 4.2.16.Final
0.5%
Theoretical Threat
Directly Exposed
CVE-2025-58057MEDIUM6.38
io.netty:netty-codec-compression
4.2.2.Final
fixed in 4.2.5.Final
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-73508MEDIUM6.38
io.netty:netty-codec-dns
4.1.135.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-73508MEDIUM6.38
io.netty:netty-codec-dns
4.2.2.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-55831MEDIUM6.38
io.netty:netty-codec-http
4.1.135.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-55833MEDIUM6.38
io.netty:netty-codec-http
4.1.135.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-56745MEDIUM6.38
io.netty:netty-codec-http
4.1.135.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-56746MEDIUM6.38
io.netty:netty-codec-http
4.1.135.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-59898MEDIUM6.38
io.netty:netty-codec-http
4.1.135.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-59899MEDIUM6.38
io.netty:netty-codec-http
4.1.135.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-59903MEDIUM6.38
io.netty:netty-codec-http
4.1.135.Final
fixed in 4.2.17.Final, 4.1.137.Final
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-33870MEDIUM6.38
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.1.132.Final, 4.2.10.Final
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-55831MEDIUM6.38
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-55833MEDIUM6.38
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-56745MEDIUM6.38
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-42585MEDIUM6.38
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-56746MEDIUM6.38
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-59898MEDIUM6.38
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-59899MEDIUM6.38
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-59903MEDIUM6.38
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.17.Final, 4.1.137.Final
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-56819MEDIUM6.38
io.netty:netty-codec-http2
4.1.135.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-56819MEDIUM6.38
io.netty:netty-codec-http2
4.2.2.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-48043MEDIUM6.38
io.netty:netty-codec-http2
4.2.2.Final
fixed in 4.1.135.Final, 4.2.15.Final
0.9%
Theoretical Threat
Directly Exposed
CVE-2026-75596MEDIUM6.38
io.netty:netty-handler
4.1.135.Final
fixed in 4.2.17.Final, 4.1.137.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-50010MEDIUM6.38
io.netty:netty-handler
4.2.2.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-75596MEDIUM6.38
io.netty:netty-handler
4.2.2.Final
fixed in 4.2.17.Final, 4.1.137.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-64607MEDIUM6.38
org.apache.httpcomponents.client5:httpclient5
5.5
fixed in 5.6.3
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-64607MEDIUM6.38
org.apache.httpcomponents.client5:httpclient5
5.6.1
fixed in 5.6.3
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-54399MEDIUM6.38
org.apache.httpcomponents.core5:httpcore5
5.3.5
fixed in 5.4.3, 5.5-beta2
0.9%
Theoretical Threat
Directly Exposed
CVE-2026-54399MEDIUM6.38
org.apache.httpcomponents.core5:httpcore5
5.4
fixed in 5.4.3, 5.5-beta2
0.9%
Theoretical Threat
Directly Exposed
CVE-2026-54428MEDIUM6.38
org.apache.httpcomponents.core5:httpcore5-h2
5.3.5
fixed in 5.4.3, 5.5-beta2
0.9%
Theoretical Threat
Directly Exposed
CVE-2026-54428MEDIUM6.38
org.apache.httpcomponents.core5:httpcore5-h2
5.4
fixed in 5.4.3, 5.5-beta2
0.9%
Theoretical Threat
Directly Exposed
CVE-2026-13506MEDIUM6.38
org.bouncycastle:bcprov-jdk18on
1.84
fixed in 1.85
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-89425MEDIUM6.38
tools.jackson.core:jackson-core
3.2.2
fixed in 3.1.7, 3.2.3
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-91776MEDIUM6.38
tools.jackson.core:jackson-databind
3.2.2
fixed in 3.1.7, 3.2.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-91777MEDIUM6.38
tools.jackson.core:jackson-databind
3.2.2
fixed in 3.1.7, 3.2.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-89157MEDIUM6.29
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-84782MEDIUM6.29
libssl3t64
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-42579MEDIUM6.18
io.netty:netty-codec-dns
4.2.2.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.8%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-8763MEDIUM6.18
org.bouncycastle:bcprov-jdk18on
1.84
fixed in 1.85
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-106451MEDIUM5.95
at.yawk.lz4:lz4-java
1.10.1
fixed in 1.11.4
<0.1%
Theoretical Threat
Directly Exposed
CVE-2026-106451MEDIUM5.95
at.yawk.lz4:lz4-java
1.11.2
fixed in 1.11.4
<0.1%
Theoretical Threat
Directly Exposed
CVE-2026-46675MEDIUM5.9
libpng16-16t64
1.6.43-5ubuntu0.6
fixed in 1.6.43-5ubuntu0.7
—
Directly Exposed
CVE-2026-45673MEDIUM5.78
io.netty:netty-resolver-dns
4.2.2.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-89158MEDIUM5.52
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-89160MEDIUM5.52
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-59888MEDIUM5.52
com.fasterxml.jackson.core:jackson-databind
2.15.0
fixed in 2.18.8, 2.21.4
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-59889MEDIUM5.52
com.fasterxml.jackson.core:jackson-databind
2.15.0
fixed in 2.21.5, 2.18.9, 2.22.1
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-59921MEDIUM5.52
io.netty:netty-codec-http
4.1.135.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.5%
Theoretical Threat
Directly Exposed
CVE-2025-67735MEDIUM5.52
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.8.Final, 4.1.129.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-41417MEDIUM5.52
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.1.133.Final, 4.2.13.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42580MEDIUM5.52
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-59921MEDIUM5.52
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-54512MEDIUM5.5
com.fasterxml.jackson.core:jackson-databind
2.15.0
fixed in 2.18.8, 3.1.4, 2.21.4
1.0%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2017-13716MEDIUM5.5
libbinutils
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Directly Exposed
CVE-2017-13716MEDIUM5.5
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Directly Exposed
CVE-2017-13716MEDIUM5.5
libctf0
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Directly Exposed
CVE-2017-13716MEDIUM5.5
libgprofng0
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Directly Exposed
CVE-2017-13716MEDIUM5.5
libsframe1
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Directly Exposed
CVE-2025-22227MEDIUM5.18
io.projectreactor.netty:reactor-netty-http
1.0.45
fixed in 1.3.0-M5, 1.2.8
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-89156MEDIUM5.02
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-54872MEDIUM5.02
libssl3t64
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-75805MEDIUM5.02
libssl3t64
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-77696MEDIUM5.02
libssl3t64
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-89407MEDIUM5.02
com.fasterxml.jackson.core:jackson-core
2.17.2
fixed in 2.18.11, 2.21.7, 2.22.3
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-89407MEDIUM5.02
com.fasterxml.jackson.core:jackson-core
2.22.2
fixed in 2.18.11, 2.21.7, 2.22.3
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-49844MEDIUM5.02
org.apache.logging.log4j:log4j-api
2.25.4
fixed in 2.25.5, 2.26.1
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-49844MEDIUM5.02
org.apache.logging.log4j:log4j-api
2.26.0
fixed in 2.25.5, 2.26.1
0.8%
Theoretical Threat
Directly Exposed
CVE-2024-41909MEDIUM5.02
org.apache.sshd:sshd-common
2.9.2
fixed in 2.12.0
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-44249MEDIUM4.86
io.netty:netty-handler
4.2.2.Final
fixed in 4.2.15.Final, 4.1.135.Final
1.3%
Low-Moderate Risk
Directly Exposed
CVE-2026-83557MEDIUM4.76
com.fasterxml.jackson.core:jackson-databind
2.15.0
fixed in 2.18.10, 2.21.6, 2.22.2
0.7%
Theoretical Threat
Directly Exposed
CVE-2025-69651MEDIUM4.67
libbinutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69651MEDIUM4.67
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69651MEDIUM4.67
libctf0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-66382MEDIUM4.67
libexpat1
2.6.1-2ubuntu0.6
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-95512MEDIUM4.67
libfreetype6
2.13.2+dfsg-1ubuntu0.1
fixed in 2.13.2+dfsg-1ubuntu0.2
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69651MEDIUM4.67
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69651MEDIUM4.67
libsframe1
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42584MEDIUM4.64
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-75595MEDIUM4.64
io.netty:netty-handler
4.1.135.Final
fixed in 4.2.17.Final, 4.1.137.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-75595MEDIUM4.64
io.netty:netty-handler
4.2.2.Final
fixed in 4.2.17.Final, 4.1.137.Final
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-75806MEDIUM4.5
libssl3t64
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-106450MEDIUM4.5
at.yawk.lz4:lz4-java
1.10.1
fixed in 1.11.4
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-106452MEDIUM4.5
at.yawk.lz4:lz4-java
1.10.1
fixed in 1.11.2
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-106453MEDIUM4.5
at.yawk.lz4:lz4-java
1.10.1
fixed in 1.11.2
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-106450MEDIUM4.5
at.yawk.lz4:lz4-java
1.11.2
fixed in 1.11.4
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-18401MEDIUM4.5
com.fasterxml.jackson.core:jackson-core
2.15.0
fixed in 2.21.1, 2.18.6
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-18401MEDIUM4.5
com.fasterxml.jackson.core:jackson-core
2.17.2
fixed in 2.21.1, 2.18.6
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-19032MEDIUM4.5
com.fasterxml.jackson.core:jackson-databind
2.15.0
fixed in 2.18.10, 2.21.6, 2.22.2
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-54514MEDIUM4.5
com.fasterxml.jackson.core:jackson-databind
2.15.0
fixed in 2.18.8, 2.21.4, 3.1.4
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-54515MEDIUM4.5
com.fasterxml.jackson.core:jackson-databind
2.15.0
fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-77310MEDIUM4.5
com.fasterxml.jackson.core:jackson-databind
2.15.0
fixed in 2.18.9, 2.21.5, 2.22.1
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-50020MEDIUM4.5
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-59900MEDIUM4.5
io.netty:netty-codec-http2
4.1.135.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-47244MEDIUM4.5
io.netty:netty-codec-http2
4.2.2.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-50560MEDIUM4.5
io.netty:netty-codec-http2
4.2.2.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-59900MEDIUM4.5
io.netty:netty-codec-http2
4.2.2.Final
fixed in 4.2.16.Final, 4.1.136.Final
0.4%
Theoretical Threat
Directly Exposed
CVE-2023-35887MEDIUM4.3
org.apache.sshd:sshd-common
2.9.2
fixed in 2.9.3
1.3%
Low-Moderate Risk
Directly Exposed
CVE-2026-18374MEDIUM4.17
libc-bin
2.39-0ubuntu8.9
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-18374MEDIUM4.17
libc6
2.39-0ubuntu8.9
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-89092LOW3.57
libc-bin
2.39-0ubuntu8.9
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-89092LOW3.57
libc6
2.39-0ubuntu8.9
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-45536LOW3.4
io.netty:netty-transport-native-epoll
4.2.2.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-45536LOW3.4
io.netty:netty-transport-native-kqueue
4.2.2.Final
fixed in 4.2.15.Final, 4.1.135.Final
0.2%
Theoretical Threat
Directly Exposed
CVE-2017-13716LOW3.3
binutils
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Post-Exploit
CVE-2017-13716LOW3.3
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Post-Exploit
CVE-2025-1152LOW3.15
libbinutils
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Directly Exposed
CVE-2025-1152LOW3.15
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Directly Exposed
CVE-2025-1152LOW3.15
libctf0
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Directly Exposed
CVE-2025-1152LOW3.15
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Directly Exposed
CVE-2025-1152LOW3.15
libsframe1
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-35189LOW3.15
libssl3t64
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-106449LOW3.15
at.yawk.lz4:lz4-java
1.10.1
fixed in 1.11.4
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-106449LOW3.15
at.yawk.lz4:lz4-java
1.11.2
fixed in 1.11.4
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-77696LOW3.01
openssl
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-42581LOW3
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.13.Final, 4.1.133.Final
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-15534LOW2.91
perl-base
5.38.2-3.2ubuntu0.4
fixed in 5.38.2-3.2ubuntu0.6
0.3%
Theoretical Threat
Post-Exploit
CVE-2025-69651LOW2.8
binutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69651LOW2.8
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-102473LOW2.8
dash
0.5.12-6ubuntu5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2025-69647LOW2.8
libbinutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69648LOW2.8
libbinutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69652LOW2.8
libbinutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69647LOW2.8
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69648LOW2.8
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69652LOW2.8
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69647LOW2.8
libctf0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69648LOW2.8
libctf0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69652LOW2.8
libctf0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69647LOW2.8
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69648LOW2.8
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69652LOW2.8
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69647LOW2.8
libsframe1
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69648LOW2.8
libsframe1
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69652LOW2.8
libsframe1
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-40228LOW2.8
libsystemd0
255.4-1ubuntu8.17
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-40228LOW2.8
libudev1
255.4-1ubuntu8.17
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-42587LOW2.7
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.2.13.Final, 4.1.133.Final
1.0%
Low-Moderate Risk
Post-Exploit
CVE-2025-55163LOW2.7
io.netty:netty-codec-http2
4.2.2.Final
fixed in 4.2.4.Final, 4.1.124.Final
1.1%
Low-Moderate Risk
Post-Exploit
CVE-2026-33871LOW2.7
io.netty:netty-codec-http2
4.2.2.Final
fixed in 4.1.132.Final, 4.2.11.Final
1.2%
Low-Moderate Risk
Post-Exploit
CVE-2026-42587LOW2.7
io.netty:netty-codec-http2
4.2.2.Final
fixed in 4.2.13.Final, 4.1.133.Final
1.0%
Low-Moderate Risk
Post-Exploit
CVE-2026-45416LOW2.7
io.netty:netty-handler
4.2.2.Final
fixed in 4.2.15.Final, 4.1.135.Final
1.6%
Low-Moderate Risk
Post-Exploit
CVE-2026-42578LOW2.7
io.netty:netty-handler-proxy
4.2.2.Final
fixed in 4.1.133.Final, 4.2.13.Final
1.2%
Low-Moderate Risk
Post-Exploit
CVE-2026-75806LOW2.7
openssl
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-86145LOW2.51
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-89161LOW2.39
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2025-69644LOW2.38
libbinutils
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2025-69645LOW2.38
libbinutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69646LOW2.38
libbinutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69644LOW2.38
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2025-69645LOW2.38
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69646LOW2.38
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69644LOW2.38
libctf0
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2025-69645LOW2.38
libctf0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69646LOW2.38
libctf0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69644LOW2.38
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2025-69645LOW2.38
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69646LOW2.38
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69644LOW2.38
libsframe1
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2025-69645LOW2.38
libsframe1
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69646LOW2.38
libsframe1
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-86414LOW2.34
curl
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-92388LOW2.34
curl
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-86414LOW2.34
libcurl4t64
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-92388LOW2.34
libcurl4t64
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-103111LOW2.33
libpcre2-8-0
10.42-4ubuntu2.1
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-58056LOW2.29
io.netty:netty-codec-http
4.2.2.Final
fixed in 4.1.125.Final, 4.2.5.Final
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-84782LOW2.26
openssl
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-18477LOW2.24
tar
1.35+dfsg-3ubuntu0.4
No fix yet
<0.1%
Theoretical Threat
Post-Exploit
CVE-2026-18508LOW2.24
tar
1.35+dfsg-3ubuntu0.4
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-87862LOW2.22
curl
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-87863LOW2.22
curl
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-87864LOW2.22
curl
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-92389LOW2.22
curl
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-92391LOW2.22
curl
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-87862LOW2.22
libcurl4t64
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-87863LOW2.22
libcurl4t64
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-87864LOW2.22
libcurl4t64
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-92389LOW2.22
libcurl4t64
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-92391LOW2.22
libcurl4t64
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-102474LOW2.04
dash
0.5.12-6ubuntu5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-19487LOW1.99
perl-base
5.38.2-3.2ubuntu0.4
fixed in 5.38.2-3.2ubuntu0.6
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-94266LOW1.98
curl
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-94266LOW1.98
libcurl4t64
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-86409LOW1.91
curl
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2026-86409LOW1.91
libcurl4t64
8.5.0-2ubuntu10.15
No fix yet
—
Post-Exploit
CVE-2025-1152LOW1.89
binutils
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Post-Exploit
CVE-2025-1152LOW1.89
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-35189LOW1.89
openssl
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.3%
Theoretical Threat
Post-Exploit
CVE-2024-56433LOW1.84
login
1:4.13+dfsg1-4ubuntu3.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2024-56433LOW1.84
passwd
1:4.13+dfsg1-4ubuntu3.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-54872LOW1.81
openssl
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-75805LOW1.81
openssl
3.0.13-0ubuntu3.15
fixed in 3.0.13-0ubuntu3.16
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69647LOW1.68
binutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69648LOW1.68
binutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69652LOW1.68
binutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69647LOW1.68
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69648LOW1.68
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69652LOW1.68
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69644LOW1.43
binutils
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2025-69645LOW1.43
binutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69646LOW1.43
binutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69644LOW1.43
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2025-69645LOW1.43
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69646LOW1.43
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69651NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2017-13716NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Not Applicable
CVE-2026-77420NONE0
org.jline:jline-reader
3.21.0
fixed in 4.3.1, 3.30.15
0.1%
Theoretical Threat
Not Applicable
CVE-2026-18374NONE0
locales
2.39-0ubuntu8.9
No fix yet
0.1%
Theoretical Threat
Not Applicable
CVE-2026-89092NONE0
locales
2.39-0ubuntu8.9
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2025-1152NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Not Applicable
CVE-2025-69647NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2025-69648NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2025-69652NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2025-69644NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Not Applicable
CVE-2025-69645NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2025-69646NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-67693NONE0
libgnutls30t64
3.8.3-1.1ubuntu3.6
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-88647NONE0
libgnutls30t64
3.8.3-1.1ubuntu3.6
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-95184NONE0
libgnutls30t64
3.8.3-1.1ubuntu3.6
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-95209NONE0
libgnutls30t64
3.8.3-1.1ubuntu3.6
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-95210NONE0
libgnutls30t64
3.8.3-1.1ubuntu3.6
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2026-107161NONE0
libsasl2-2
2.1.28+dfsg1-5ubuntu3.1
No fix yet
0.3%
Theoretical Threat
Not Applicable
CVE-2026-107161NONE0
libsasl2-modules-db
2.1.28+dfsg1-5ubuntu3.1
No fix yet
0.3%
Theoretical Threat
Not Applicable
CVE-2026-85091NONE0
zlib1g
1:1.3.dfsg-3.1ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Not Applicable
CVE-2026-59949NONE0
at.yawk.lz4:lz4-java
1.10.1
fixed in 1.11.1
0.5%
Theoretical Threat
Not Applicable
CVE-2026-42577NONE0
io.netty:netty-transport-classes-epoll
4.2.2.Final
fixed in 4.2.13.Final
0.6%
Theoretical Threat
Not Applicable
CVE-2020-36843NONE0
net.i2p.crypto:eddsa
0.3.0
No fix yet
0.1%
Theoretical Threat
Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.