Last scanned:
This image is safe for production use. Its vulnerability findings are real: 9 affect the exposed surface and 46 are post-exploitation only, but the highest exposed severity is 5.5 and the highest post-exploitation severity is 3.3, and none are known to be actively exploited. The image comes from a trusted official source and is pinned by digest, which supports reliable deployments. Running as root is the main hardening gap, so tightening the runtime user is a sensible follow-up, though it does not block production use.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2025-66382 | MEDIUM5.5 | libexpat1 2.7.4-1ubuntu0.2 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc-bin 2.43-2ubuntu2.4 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc-gconv-modules-extra 2.43-2ubuntu2.4 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.43-2ubuntu2.4 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc-bin 2.43-2ubuntu2.4 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc-gconv-modules-extra 2.43-2ubuntu2.4 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.43-2ubuntu2.4 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-102473 | LOW3.3 | dash 0.5.12-12ubuntu3 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW3.3 | libsystemd0 259.9-0ubuntu0.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW3.3 | libudev1 259.9-0ubuntu0.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18477 | LOW2.64 | tar 1.35+dfsg-4ubuntu0.4 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.64 | tar 1.35+dfsg-4ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-88647 | LOW2.48 | libgnutls30t64 3.8.12-2ubuntu1.1 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-88648 | LOW2.48 | libgnutls30t64 3.8.12-2ubuntu1.1 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-103111 | LOW2.48 | libpcre2-8-0 10.46-1build1 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86145 | LOW2.48 | libpcre2-8-0 10.46-1build1 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-89157 | LOW2.48 | libpcre2-8-0 10.46-1build1 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-89161 | LOW2.48 | libpcre2-8-0 10.46-1build1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-107161 | LOW2.48 | libsasl2-2 2.1.28+dfsg1-9ubuntu3 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-107161 | LOW2.48 | libsasl2-modules-db 2.1.28+dfsg1-9ubuntu3 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-35341 | LOW2.48 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-35352 | LOW2.48 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-35368 | LOW2.48 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-102474 | LOW2.4 | dash 0.5.12-12ubuntu3 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-35350 | LOW2.38 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-89158 | LOW2.34 | libpcre2-8-0 10.46-1build1 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-89160 | LOW2.34 | libpcre2-8-0 10.46-1build1 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-35360 | LOW2.27 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-35364 | LOW2.27 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-35374 | LOW2.27 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-13757 | LOW2.23 | libp11-kit0 0.26.2-2 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-13757 | LOW2.23 | p11-kit 0.26.2-2 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-13757 | LOW2.23 | p11-kit-modules 0.26.2-2 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2021-31879 | LOW2.2 | wget 1.25.0-2ubuntu4.4 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-67693 | LOW2.12 | libgnutls30t64 3.8.12-2ubuntu1.1 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-89156 | LOW2.12 | libpcre2-8-0 10.46-1build1 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-35363 | LOW2.02 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-35348 | LOW1.98 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-35373 | LOW1.98 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-95184 | LOW1.91 | libgnutls30t64 3.8.12-2ubuntu1.1 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-35345 | LOW1.91 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | login.defs 1:4.17.4-2ubuntu3 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.17.4-2ubuntu3 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-95209 | LOW1.8 | libgnutls30t64 3.8.12-2ubuntu1.1 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-95210 | LOW1.8 | libgnutls30t64 3.8.12-2ubuntu1.1 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-35354 | LOW1.69 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-35357 | LOW1.69 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-35359 | LOW1.69 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-35370 | LOW1.58 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-35351 | LOW1.51 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-89162 | LOW1.19 | libpcre2-8-0 10.46-1build1 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-35344 | LOW1.19 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-35367 | LOW1.19 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-35371 | LOW1.19 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-35377 | LOW1.19 | rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18374 | NONE0 | locales 2.43-2ubuntu2.4 No fix yet | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-89092 | NONE0 | locales 2.43-2ubuntu2.4 No fix yet | 0.2% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.