Last scanned:
This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker could exploit CVE-2026-2332 to smuggle HTTP requests through the Jetty front end and bypass proxy rules or poison request routing. The 126 exposed findings include 9 at severity 7 or higher, and the verified, digest-pinned publisher status does not offset that attack surface. If OpenSSL CMP/PBM verification is not required, disabling that specialized feature fully eliminates CVE-2026-63076, but the primary request-smuggling risk remains.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-2332 | CRITICAL9.1 | org.eclipse.jetty:jetty-http 12.0.17 fixed in 12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60 | 1.3% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-63076 | HIGH7.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63076 | HIGH7.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42587 | HIGH7.5 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.13.Final, 4.1.133.Final | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42587 | HIGH7.5 | io.netty:netty-codec-http2 4.2.9.Final fixed in 4.2.13.Final, 4.1.133.Final | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-45416 | HIGH7.5 | io.netty:netty-handler 4.2.9.Final fixed in 4.2.15.Final, 4.1.135.Final | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42578 | HIGH7.5 | io.netty:netty-handler-proxy 4.2.9.Final fixed in 4.1.133.Final, 4.2.13.Final | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42198 | HIGH7.5 | org.postgresql:postgresql 42.7.2 fixed in 42.7.11 | 3.3% Low-Moderate Risk | Directly Exposed |
| CVE-2025-67030 | HIGH7.48 | org.codehaus.plexus:plexus-utils 3.5.1 fixed in 4.0.3, 3.6.1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-54512 | MEDIUM6.88 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.8, 3.1.4, 2.21.4 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-47838 | MEDIUM6.88 | org.springframework.security:spring-security-web 6.5.6 fixed in 6.5.11 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-45674 | MEDIUM6.8 | io.netty:netty-resolver-dns 4.2.9.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-47691 | MEDIUM6.8 | io.netty:netty-resolver-dns 4.2.9.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42581 | MEDIUM6.66 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54513 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.8, 2.21.4, 3.1.4 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-14456 | MEDIUM6.38 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-63072 | MEDIUM6.38 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-54874 | MEDIUM6.38 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM6.38 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63075 | MEDIUM6.38 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-14456 | MEDIUM6.38 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-63072 | MEDIUM6.38 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-54874 | MEDIUM6.38 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM6.38 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63075 | MEDIUM6.38 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-68494 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.20.1 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.20.1 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68497 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42583 | MEDIUM6.38 | io.netty:netty-codec-compression 4.2.9.Final fixed in 4.2.13.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59901 | MEDIUM6.38 | io.netty:netty-codec-compression 4.2.9.Final fixed in 4.2.16.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-73508 | MEDIUM6.38 | io.netty:netty-codec-dns 4.2.9.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-33870 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.1.132.Final, 4.2.10.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-55831 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-55833 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-56745 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42585 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56746 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59898 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59899 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-59903 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56819 | MEDIUM6.38 | io.netty:netty-codec-http2 4.2.9.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-48043 | MEDIUM6.38 | io.netty:netty-codec-http2 4.2.9.Final fixed in 4.1.135.Final, 4.2.15.Final | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-50010 | MEDIUM6.38 | io.netty:netty-handler 4.2.9.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-75596 | MEDIUM6.38 | io.netty:netty-handler 4.2.9.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-13505 | MEDIUM6.38 | org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-13506 | MEDIUM6.38 | org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-3505 | MEDIUM6.38 | org.bouncycastle:bcpg-jdk15to18 1.81 fixed in 1.84 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-5588 | MEDIUM6.38 | org.bouncycastle:bcpkix-jdk15to18 1.81 fixed in 1.84 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-5588 | MEDIUM6.38 | org.bouncycastle:bcpkix-jdk18on 1.81 fixed in 1.84 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2025-14813 | MEDIUM6.38 | org.bouncycastle:bcprov-jdk15to18 1.81 fixed in 1.84 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-13506 | MEDIUM6.38 | org.bouncycastle:bcprov-jdk15to18 1.81 fixed in 1.85 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-13506 | MEDIUM6.38 | org.bouncycastle:bcprov-jdk18on 1.81.1 fixed in 1.85 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84939 | MEDIUM6.38 | org.freemarker:freemarker 2.3.32 fixed in 2.3.35 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-75140 | MEDIUM6.38 | org.jsoup:jsoup 1.15.3 fixed in 1.23.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-41848 | MEDIUM6.38 | org.springframework:spring-core 6.2.11 fixed in 7.0.8, 6.2.19 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-41851 | MEDIUM6.38 | org.springframework:spring-expression 6.2.11 fixed in 7.0.8, 6.2.19 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42579 | MEDIUM6.18 | io.netty:netty-codec-dns 4.2.9.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42584 | MEDIUM6.18 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75595 | MEDIUM6.18 | io.netty:netty-handler 4.2.9.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-49268 | MEDIUM6.18 | org.apache.shiro:shiro-core 1.13.0 fixed in 2.2.1, 3.0.0-alpha-2 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-8763 | MEDIUM6.18 | org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-8763 | MEDIUM6.18 | org.bouncycastle:bcprov-jdk15to18 1.81 fixed in 1.85 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-8763 | MEDIUM6.18 | org.bouncycastle:bcprov-jdk18on 1.81.1 fixed in 1.85 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-10050 | MEDIUM6.18 | org.eclipse.jetty.ee8:jetty-ee8-security 12.0.17 fixed in 12.0.36, 12.1.10 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33871 | MEDIUM6 | io.netty:netty-codec-http2 4.2.9.Final fixed in 4.1.132.Final, 4.2.11.Final | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-40973 | MEDIUM5.95 | org.springframework.boot:spring-boot 3.3.11 fixed in 4.0.6, 3.5.14 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-46675 | MEDIUM5.9 | libpng 1.6.58-r1 fixed in 1.6.59-r0 | — | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-45673 | MEDIUM5.78 | io.netty:netty-resolver-dns 4.2.9.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59888 | MEDIUM5.52 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.8, 2.21.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59889 | MEDIUM5.52 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-41417 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.1.133.Final, 4.2.13.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-42580 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59921 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-43827 | MEDIUM5.52 | org.apache.shiro:shiro-core 1.13.0 fixed in 2.2.0, 3.0.0-alpha-2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-43828 | MEDIUM5.52 | org.apache.shiro:shiro-web 1.13.0 fixed in 2.2.0, 3.0.0-alpha-2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-0636 | MEDIUM5.52 | org.bouncycastle:bcprov-jdk15to18 1.81 fixed in 1.84 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-0636 | MEDIUM5.52 | org.bouncycastle:bcprov-jdk18on 1.81.1 fixed in 1.84 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-11143 | MEDIUM5.52 | org.eclipse.jetty:jetty-http 12.0.17 fixed in 12.0.31, 12.1.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-22732 | MEDIUM5.52 | org.springframework.security:spring-security-web 6.5.6 fixed in 6.5.9, 7.0.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-41854 | MEDIUM5.52 | org.springframework:spring-web 6.2.11 fixed in 7.0.8, 6.2.19 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM5.02 | com.fasterxml.jackson.core:jackson-core 2.20.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-49844 | MEDIUM5.02 | org.apache.logging.log4j:log4j-api 2.19.0 fixed in 2.25.5, 2.26.1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-41850 | MEDIUM5.02 | org.springframework:spring-expression 6.2.11 fixed in 7.0.8, 6.2.19 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-44249 | MEDIUM4.86 | io.netty:netty-handler 4.2.9.Final fixed in 4.2.15.Final, 4.1.135.Final | 1.3% Low-Moderate Risk | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.76 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-58055 | MEDIUM4.59 | nghttp2-libs 1.69.0-r0 fixed in 1.70.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-41003 | MEDIUM4.59 | org.springframework.security:spring-security-saml2-service-provider 6.5.6 fixed in 7.0.6, 6.5.11 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-18798 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.5% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14457 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-18798 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.5% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14457 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-18401 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.20.1 fixed in 2.21.1, 2.18.6 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-54514 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54515 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-77310 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.20.1 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-50020 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.9.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-47244 | MEDIUM4.5 | io.netty:netty-codec-http2 4.2.9.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-50560 | MEDIUM4.5 | io.netty:netty-codec-http2 4.2.9.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59900 | MEDIUM4.5 | io.netty:netty-codec-http2 4.2.9.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-23903 | MEDIUM4.5 | org.apache.shiro:shiro-spring 1.13.0 fixed in 2.1.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-8384 | MEDIUM4.5 | org.eclipse.jetty:jetty-util 12.0.17 fixed in 12.0.35, 12.1.9 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-41001 | MEDIUM4.5 | org.springframework.boot:spring-boot-autoconfigure 3.3.11 fixed in 4.0.7, 3.5.15 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-41694 | MEDIUM4.5 | org.springframework.security:spring-security-saml2-service-provider 6.5.6 fixed in 7.0.6, 6.5.11 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-41852 | MEDIUM4.5 | org.springframework:spring-expression 6.2.11 fixed in 7.0.8, 6.2.19 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2024-47554 | MEDIUM4.3 | commons-io:commons-io 2.8.0 fixed in 2.14.0 | 1.3% Low-Moderate Risk | Directly Exposed |
| CVE-2026-1225 | MEDIUM4.25 | ch.qos.logback:logback-core 1.5.19 fixed in 1.5.25 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-22751 | MEDIUM4.08 | org.springframework.security:spring-security-core 6.5.6 fixed in 6.5.10, 7.0.5 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-71497 | MEDIUM4 | org.jsoup:jsoup 1.15.3 fixed in 1.23.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45536 | LOW3.4 | io.netty:netty-transport-native-epoll 4.2.9.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-45536 | LOW3.4 | io.netty:netty-transport-native-kqueue 4.2.9.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-19931 | LOW3.31 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-75803 | LOW3.15 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.15 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-22746 | LOW3.15 | org.springframework.security:spring-security-core 6.5.6 fixed in 6.5.10, 7.0.5 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-26740 | LOW2.7 | giflib 5.2.2-r1 fixed in 5.2.2-r2 | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-18798 | LOW2.7 | openssl 3.5.7-r0 fixed in 3.5.8-r0 | 1.5% Low-Moderate Risk | Post-Exploit |
| CVE-2026-63076 | LOW2.7 | openssl 3.5.7-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Post-Exploit |
| CVE-2026-14457 | LOW2.7 | openssl 3.5.7-r0 fixed in 3.5.8-r0 | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2026-82208 | LOW2.45 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-82208 | LOW2.45 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-14456 | LOW2.29 | openssl 3.5.7-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-63072 | LOW2.29 | openssl 3.5.7-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-54874 | LOW2.29 | openssl 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-63074 | LOW2.29 | openssl 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-63075 | LOW2.29 | openssl 3.5.7-r0 fixed in 3.5.8-r0 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-63073 | LOW2.12 | openssl 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-23901 | LOW2.12 | org.apache.shiro:shiro-core 1.13.0 fixed in 2.1.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-19931 | LOW1.99 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-13608 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-18924 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80229 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-80231 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-80255 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-13608 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-18924 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80229 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-80231 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-80255 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-75803 | LOW1.89 | openssl 3.5.7-r0 fixed in 3.5.8-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-82209 | LOW1.58 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-82209 | LOW1.58 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-88807 | NONE0 | libxrender 0.9.12-r0 fixed in 0.9.13-r0 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-88806 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-45292 | NONE0 | io.opentelemetry:opentelemetry-api 1.47.0 fixed in 1.62.0 | 0.8% Theoretical Threat | Not Applicable |
| CVE-2026-94286 | NONE0 | libxtst 1.2.5-r0 fixed in 1.2.6-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-94283 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93541 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93542 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93543 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93544 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93545 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-94281 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-94282 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-94284 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-94285 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-80256 | NONE0 | curl 8.21.0-r0 fixed in 8.22.0-r0 | — | Not Applicable |
| CVE-2026-80256 | NONE0 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | — | Not Applicable |
| CVE-2026-109089 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | — | Not Applicable |
| CVE-2026-109090 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | — | Not Applicable |
| CVE-2026-109088 | NONE0 | libxtst 1.2.5-r0 fixed in 1.2.6-r0 | — | Not Applicable |
| CVE-2026-85091 | NONE0 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-10532 | NONE0 | ch.qos.logback:logback-core 1.5.19 fixed in 1.5.34 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-9828 | NONE0 | ch.qos.logback:logback-core 1.5.19 fixed in 1.5.33 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-42577 | NONE0 | io.netty:netty-transport-classes-epoll 4.2.9.Final fixed in 4.2.13.Final | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-8798 | NONE0 | org.bouncycastle:bc-fips 2.1.2 fixed in 2.1.3 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-40988 | NONE0 | org.springframework.security:spring-security-saml2-service-provider 6.5.6 fixed in 7.0.6, 6.5.11 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-41706 | NONE0 | org.springframework.security:spring-security-web 6.5.6 fixed in 7.0.6, 6.5.11 | 0.3% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.