Last scanned:
This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker could exploit CVE-2026-42581 to smuggle HTTP requests through Netty, bypass front-end controls, or corrupt request handling in SonarQube. The image has 175 exposed vulnerabilities, including 67 at severity 6.0+ and one at 7.0+, so the risk is not limited to a single flaw. Do not deploy until Netty is upgraded to a fixed version that fully eliminates CVE-2026-42581. Note that CVE-2026-54513 only applies if polymorphic deserialization with allowIfSubTypeIsArray() is enabled.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-42581 | HIGH8.33 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.7% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-45674 | MEDIUM6.8 | io.netty:netty-resolver-dns 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-47691 | MEDIUM6.8 | io.netty:netty-resolver-dns 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54513 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.15.0 fixed in 2.18.8, 2.21.4, 3.1.4 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-44249 | MEDIUM6.48 | io.netty:netty-handler 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 1.3% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-68494 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.15.0 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.15.0 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68494 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.17.2 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.17.2 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.22.2 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68497 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.15.0 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.15.0 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.15.0 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.22.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.22.2 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-7962 | MEDIUM6.38 | com.sun.mail:jakarta.mail 2.0.1 fixed in 1.6.8, 2.0.2 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-59901 | MEDIUM6.38 | io.netty:netty-codec 4.1.135.Final fixed in 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42583 | MEDIUM6.38 | io.netty:netty-codec-compression 4.2.2.Final fixed in 4.2.13.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59901 | MEDIUM6.38 | io.netty:netty-codec-compression 4.2.2.Final fixed in 4.2.16.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-58057 | MEDIUM6.38 | io.netty:netty-codec-compression 4.2.2.Final fixed in 4.2.5.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-73508 | MEDIUM6.38 | io.netty:netty-codec-dns 4.1.135.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-73508 | MEDIUM6.38 | io.netty:netty-codec-dns 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-55831 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.135.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-55833 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.135.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-56745 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.135.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-56746 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.135.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59898 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.135.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59899 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.135.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-59903 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.135.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-33870 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.1.132.Final, 4.2.10.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-55831 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-55833 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-56745 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42585 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56746 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59898 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59899 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-59903 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-58056 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.1.125.Final, 4.2.5.Final | 0.7% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-56819 | MEDIUM6.38 | io.netty:netty-codec-http2 4.1.135.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-56819 | MEDIUM6.38 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-48043 | MEDIUM6.38 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.1.135.Final, 4.2.15.Final | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-75596 | MEDIUM6.38 | io.netty:netty-handler 4.1.135.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-50010 | MEDIUM6.38 | io.netty:netty-handler 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-75596 | MEDIUM6.38 | io.netty:netty-handler 4.2.2.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-64607 | MEDIUM6.38 | org.apache.httpcomponents.client5:httpclient5 5.5 fixed in 5.6.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-64607 | MEDIUM6.38 | org.apache.httpcomponents.client5:httpclient5 5.6.1 fixed in 5.6.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-54399 | MEDIUM6.38 | org.apache.httpcomponents.core5:httpcore5 5.3.5 fixed in 5.4.3, 5.5-beta2 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-54399 | MEDIUM6.38 | org.apache.httpcomponents.core5:httpcore5 5.4 fixed in 5.4.3, 5.5-beta2 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-54428 | MEDIUM6.38 | org.apache.httpcomponents.core5:httpcore5-h2 5.3.5 fixed in 5.4.3, 5.5-beta2 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-54428 | MEDIUM6.38 | org.apache.httpcomponents.core5:httpcore5-h2 5.4 fixed in 5.4.3, 5.5-beta2 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-13506 | MEDIUM6.38 | org.bouncycastle:bcprov-jdk18on 1.84 fixed in 1.85 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | tools.jackson.core:jackson-core 3.2.2 fixed in 3.1.7, 3.2.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM6.38 | tools.jackson.core:jackson-databind 3.2.2 fixed in 3.1.7, 3.2.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM6.38 | tools.jackson.core:jackson-databind 3.2.2 fixed in 3.1.7, 3.2.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM6.29 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-42579 | MEDIUM6.18 | io.netty:netty-codec-dns 4.2.2.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42584 | MEDIUM6.18 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75595 | MEDIUM6.18 | io.netty:netty-handler 4.1.135.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75595 | MEDIUM6.18 | io.netty:netty-handler 4.2.2.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-8763 | MEDIUM6.18 | org.bouncycastle:bcprov-jdk18on 1.84 fixed in 1.85 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42587 | MEDIUM6 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.13.Final, 4.1.133.Final | 1.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2025-55163 | MEDIUM6 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.2.4.Final, 4.1.124.Final | 1.1% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33871 | MEDIUM6 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.1.132.Final, 4.2.11.Final | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42587 | MEDIUM6 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.2.13.Final, 4.1.133.Final | 1.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-45416 | MEDIUM6 | io.netty:netty-handler 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 1.6% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42578 | MEDIUM6 | io.netty:netty-handler-proxy 4.2.2.Final fixed in 4.1.133.Final, 4.2.13.Final | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-106451 | MEDIUM5.95 | at.yawk.lz4:lz4-java 1.10.1 fixed in 1.11.4 | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-106451 | MEDIUM5.95 | at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4 | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-46675 | MEDIUM5.9 | libpng16-16t64 1.6.43-5ubuntu0.6 fixed in 1.6.43-5ubuntu0.7 | — | Directly Exposed |
| CVE-2026-45673 | MEDIUM5.78 | io.netty:netty-resolver-dns 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89158 | MEDIUM5.52 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | MEDIUM5.52 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-59888 | MEDIUM5.52 | com.fasterxml.jackson.core:jackson-databind 2.15.0 fixed in 2.18.8, 2.21.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59889 | MEDIUM5.52 | com.fasterxml.jackson.core:jackson-databind 2.15.0 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59921 | MEDIUM5.52 | io.netty:netty-codec-http 4.1.135.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-67735 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.8.Final, 4.1.129.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-41417 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.1.133.Final, 4.2.13.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-42580 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59921 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-54512 | MEDIUM5.5 | com.fasterxml.jackson.core:jackson-databind 2.15.0 fixed in 2.18.8, 3.1.4, 2.21.4 | 1.0% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2017-13716 | MEDIUM5.5 | libbinutils 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2017-13716 | MEDIUM5.5 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2017-13716 | MEDIUM5.5 | libctf0 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2017-13716 | MEDIUM5.5 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2017-13716 | MEDIUM5.5 | libsframe1 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Directly Exposed |
| CVE-2025-22227 | MEDIUM5.18 | io.projectreactor.netty:reactor-netty-http 1.0.45 fixed in 1.3.0-M5, 1.2.8 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | MEDIUM5.02 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM5.02 | com.fasterxml.jackson.core:jackson-core 2.17.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM5.02 | com.fasterxml.jackson.core:jackson-core 2.22.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-49844 | MEDIUM5.02 | org.apache.logging.log4j:log4j-api 2.25.4 fixed in 2.25.5, 2.26.1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-49844 | MEDIUM5.02 | org.apache.logging.log4j:log4j-api 2.26.0 fixed in 2.25.5, 2.26.1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2024-41909 | MEDIUM5.02 | org.apache.sshd:sshd-common 2.9.2 fixed in 2.12.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.76 | com.fasterxml.jackson.core:jackson-databind 2.15.0 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2025-69651 | MEDIUM4.67 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69651 | MEDIUM4.67 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69651 | MEDIUM4.67 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-66382 | MEDIUM4.67 | libexpat1 2.6.1-2ubuntu0.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95512 | MEDIUM4.67 | libfreetype6 2.13.2+dfsg-1ubuntu0.1 fixed in 2.13.2+dfsg-1ubuntu0.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69651 | MEDIUM4.67 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69651 | MEDIUM4.67 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-106450 | MEDIUM4.5 | at.yawk.lz4:lz4-java 1.10.1 fixed in 1.11.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-106452 | MEDIUM4.5 | at.yawk.lz4:lz4-java 1.10.1 fixed in 1.11.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-106453 | MEDIUM4.5 | at.yawk.lz4:lz4-java 1.10.1 fixed in 1.11.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-106450 | MEDIUM4.5 | at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18401 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.15.0 fixed in 2.21.1, 2.18.6 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18401 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.17.2 fixed in 2.21.1, 2.18.6 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.15.0 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-54514 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.15.0 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54515 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.15.0 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-77310 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.15.0 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-50020 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59900 | MEDIUM4.5 | io.netty:netty-codec-http2 4.1.135.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-47244 | MEDIUM4.5 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-50560 | MEDIUM4.5 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59900 | MEDIUM4.5 | io.netty:netty-codec-http2 4.2.2.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2023-35887 | MEDIUM4.3 | org.apache.sshd:sshd-common 2.9.2 fixed in 2.9.3 | 1.3% Low-Moderate Risk | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.18 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.17 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.17 | libc6 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | LOW3.88 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | LOW3.57 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | LOW3.57 | libc6 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-45536 | LOW3.4 | io.netty:netty-transport-native-epoll 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-45536 | LOW3.4 | io.netty:netty-transport-native-kqueue 4.2.2.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2017-13716 | LOW3.3 | binutils 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Post-Exploit |
| CVE-2017-13716 | LOW3.3 | binutils-common 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Post-Exploit |
| CVE-2017-13716 | LOW3.3 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 1.4% Low-Moderate Risk | Post-Exploit |
| CVE-2025-1152 | LOW3.15 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-1152 | LOW3.15 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-1152 | LOW3.15 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-1152 | LOW3.15 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-1152 | LOW3.15 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-106449 | LOW3.15 | at.yawk.lz4:lz4-java 1.10.1 fixed in 1.11.4 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-106449 | LOW3.15 | at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-69651 | LOW2.8 | binutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69651 | LOW2.8 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69651 | LOW2.8 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-102473 | LOW2.8 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2025-69647 | LOW2.8 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69648 | LOW2.8 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69652 | LOW2.8 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69647 | LOW2.8 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69648 | LOW2.8 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69652 | LOW2.8 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69647 | LOW2.8 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69648 | LOW2.8 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69652 | LOW2.8 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69647 | LOW2.8 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69648 | LOW2.8 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69652 | LOW2.8 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69647 | LOW2.8 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69648 | LOW2.8 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69652 | LOW2.8 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW2.8 | libsystemd0 255.4-1ubuntu8.17 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW2.8 | libudev1 255.4-1ubuntu8.17 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | LOW2.39 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2025-69644 | LOW2.38 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-69645 | LOW2.38 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69646 | LOW2.38 | libbinutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69644 | LOW2.38 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-69645 | LOW2.38 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69646 | LOW2.38 | libctf-nobfd0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69644 | LOW2.38 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-69645 | LOW2.38 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69646 | LOW2.38 | libctf0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69644 | LOW2.38 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-69645 | LOW2.38 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69646 | LOW2.38 | libgprofng0 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69644 | LOW2.38 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-69645 | LOW2.38 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-69646 | LOW2.38 | libsframe1 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86414 | LOW2.34 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-18477 | LOW2.24 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.24 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-87862 | LOW2.22 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-87863 | LOW2.22 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-87864 | LOW2.22 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-92389 | LOW2.22 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-92391 | LOW2.22 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-87862 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-87863 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-87864 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-92389 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-92391 | LOW2.22 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-102474 | LOW2.04 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | curl 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | libcurl4t64 8.5.0-2ubuntu10.15 No fix yet | — | Post-Exploit |
| CVE-2025-1152 | LOW1.89 | binutils 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2025-1152 | LOW1.89 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2025-1152 | LOW1.89 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2025-69647 | LOW1.68 | binutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69648 | LOW1.68 | binutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69652 | LOW1.68 | binutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69647 | LOW1.68 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69648 | LOW1.68 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69652 | LOW1.68 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69647 | LOW1.68 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69648 | LOW1.68 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69652 | LOW1.68 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69644 | LOW1.43 | binutils 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2025-69645 | LOW1.43 | binutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69646 | LOW1.43 | binutils 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69644 | LOW1.43 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2025-69645 | LOW1.43 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69646 | LOW1.43 | binutils-common 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69644 | LOW1.43 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2025-69645 | LOW1.43 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-69646 | LOW1.43 | binutils-x86-64-linux-gnu 2.42-4ubuntu2.10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-77420 | NONE0 | org.jline:jline-reader 3.21.0 fixed in 4.3.1, 3.30.15 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-18374 | NONE0 | locales 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-89092 | NONE0 | locales 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2024-56433 | NONE0 | login 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-67693 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-88647 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-95184 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-95209 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-95210 | NONE0 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-107161 | NONE0 | libsasl2-2 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-107161 | NONE0 | libsasl2-modules-db 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-85091 | NONE0 | zlib1g 1:1.3.dfsg-3.1ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-59949 | NONE0 | at.yawk.lz4:lz4-java 1.10.1 fixed in 1.11.1 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-42577 | NONE0 | io.netty:netty-transport-classes-epoll 4.2.2.Final fixed in 4.2.13.Final | 0.6% Theoretical Threat | Not Applicable |
| CVE-2020-36843 | NONE0 | net.i2p.crypto:eddsa 0.3.0 No fix yet | 0.1% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.