Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. The image has 35 exposed-surface findings, 12 of which are severity 6 or higher, and the most severe reach 6.38, so the practical impact is mainly denial of service and possible path traversal rather than remote code execution. An attacker could exploit issues such as CVE-2026-84939 to read files outside the intended template directory or CVE-2026-89425 to exhaust JVM memory and disrupt Nexus availability. Some findings depend on specific configurations, such as FreeMarker localized lookup or Jackson DataInput parsing, so not every deployment will be equally exposed. Disabling FreeMarker localized lookup fully mitigates CVE-2026-84939.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-89425 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.22.1 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-73508 | MEDIUM6.38 | io.netty:netty-codec-dns 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75596 | MEDIUM6.38 | io.netty:netty-handler 4.2.15.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84939 | MEDIUM6.38 | org.freemarker:freemarker 2.3.32 fixed in 2.3.35 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-75140 | MEDIUM6.38 | org.jsoup:jsoup 1.15.3 fixed in 1.23.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | tools.jackson.core:jackson-core 3.2.0 fixed in 3.1.7, 3.2.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM6.38 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.7, 3.2.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM6.38 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.7, 3.2.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-49268 | MEDIUM6.18 | org.apache.shiro:shiro-core 1.13.0 fixed in 2.2.1, 3.0.0-alpha-2 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-8763 | MEDIUM6.18 | org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-46675 | MEDIUM5.9 | libpng 1.6.58-r1 fixed in 1.6.59-r0 | — | Directly Exposed |
| CVE-2026-59921 | MEDIUM5.52 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-43827 | MEDIUM5.52 | org.apache.shiro:shiro-core 1.13.0 fixed in 2.2.0, 3.0.0-alpha-2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-43828 | MEDIUM5.52 | org.apache.shiro:shiro-web 1.13.0 fixed in 2.2.0, 3.0.0-alpha-2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-59889 | MEDIUM5.52 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.5, 3.2.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-68497 | MEDIUM5.1 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-13506 | MEDIUM5.1 | org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89407 | MEDIUM5.02 | com.fasterxml.jackson.core:jackson-core 2.22.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-49844 | MEDIUM5.02 | org.apache.logging.log4j:log4j-api 2.19.0 fixed in 2.25.5, 2.26.1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM5.02 | tools.jackson.core:jackson-core 3.2.0 fixed in 3.1.7, 3.2.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.76 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.76 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.6, 3.2.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-58055 | MEDIUM4.59 | nghttp2-libs 1.69.0-r0 fixed in 1.70.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59900 | MEDIUM4.5 | io.netty:netty-codec-http2 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-23903 | MEDIUM4.5 | org.apache.shiro:shiro-spring 1.13.0 fixed in 2.1.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-8384 | MEDIUM4.5 | org.eclipse.jetty:jetty-util 12.0.33 fixed in 12.0.35, 12.1.9 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.5 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.6, 3.2.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-77310 | MEDIUM4.5 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.5, 3.2.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-71497 | MEDIUM4 | org.jsoup:jsoup 1.15.3 fixed in 1.23.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75595 | LOW2.78 | io.netty:netty-handler 4.2.15.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-8763 | LOW2.78 | org.bouncycastle:bcprov-jdk18on 1.84 fixed in 1.85 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-26740 | LOW2.7 | giflib 5.2.2-r1 fixed in 5.2.2-r2 | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-82208 | LOW2.45 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-82208 | LOW2.45 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-59901 | LOW2.29 | io.netty:netty-codec-compression 4.2.15.Final fixed in 4.2.16.Final | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-55831 | LOW2.29 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-55833 | LOW2.29 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-56745 | LOW2.29 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-56746 | LOW2.29 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-59898 | LOW2.29 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-59899 | LOW2.29 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-59903 | LOW2.29 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-56819 | LOW2.29 | io.netty:netty-codec-http2 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-56816 | LOW2.29 | io.netty:netty-codec-http3 4.2.15.Final fixed in 4.2.16.Final | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-13505 | LOW2.29 | org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-13506 | LOW2.29 | org.bouncycastle:bcprov-jdk18on 1.84 fixed in 1.85 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-68497 | LOW2.29 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.2.2, 3.1.6 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-23901 | LOW2.12 | org.apache.shiro:shiro-core 1.13.0 fixed in 2.1.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-19931 | LOW1.99 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-19931 | LOW1.99 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-13608 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-18924 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80229 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-80231 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-80255 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-13608 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-18924 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80229 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-80231 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-80255 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-82209 | LOW1.58 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-82209 | LOW1.58 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-88807 | NONE0 | libxrender 0.9.12-r0 fixed in 0.9.13-r0 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-88806 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-94286 | NONE0 | libxtst 1.2.5-r0 fixed in 1.2.6-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-94283 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93541 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93542 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93543 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93544 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93545 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-94281 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-94282 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-94284 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-94285 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-80256 | NONE0 | curl 8.21.0-r0 fixed in 8.22.0-r0 | — | Not Applicable |
| CVE-2026-80256 | NONE0 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | — | Not Applicable |
| CVE-2026-109089 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | — | Not Applicable |
| CVE-2026-109090 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | — | Not Applicable |
| CVE-2026-109088 | NONE0 | libxtst 1.2.5-r0 fixed in 1.2.6-r0 | — | Not Applicable |
| CVE-2026-85091 | NONE0 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-8798 | NONE0 | org.bouncycastle:bc-fips 2.1.2 fixed in 2.1.3 | 0.4% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.