Vulnerability Reporttimberio/vector:0.60.0-alpine

timberio/vector:0.60.0-alpine

digestsha256:1c6a6c4c5c9de08df357fa8adbe72e5a7abcea458b0bd82de0b14ac9b79d5b31

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreSAFE• The scan found 3 vulnerabilities that are reachable in normal operation, but the highest severity is 5.0, which is low, so none of them moves the risk score upward.• None of the findings are listed as known to be actively exploited in the wild, and none need an unusual setup to be reachable.• No findings matter only after the container has already been compromised, so an attacker gains no extra leverage from this image's post-compromise exposure.• The image is published by a verified publisher (trust verdict TRUSTED) and is pinned by digest, so its contents cannot change silently.• The threat score is 1, the lowest possible range, which reflects the low severity of the findings rather than any dangerous exposure.

1/100SAFE

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. The scan did find three vulnerabilities that can be reached in normal operation, but the most severe of them scores only 5.0, and none are known to be exploited in the wild. Nothing in the results suggests a serious attack path through this container, and the findings that matter only after a compromise are also absent. Routine patching in future image updates is still good practice to keep the attack surface small.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

3 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-85091	MEDIUM5	zlib 1.3.2-r0 fixed in 1.3.2-r1	0.5% Theoretical Threat	Directly Exposed
CVE-2026-107891	MEDIUM4	musl 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed
CVE-2026-107891	MEDIUM4	musl-utils 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.