Vulnerability Reportubuntu:noble-20260917

ubuntu:noble-20260917

digestsha256:534baea6a22c03a63003dbc8dbe78fe34bc0d7e595d9a9dc9834884ff530eb55

Executive Summary

Last scanned: Oct 22, 2026

Threat ScoreSAFE• Threat score 0 falls in the SAFE band (0-24).• Docker Official image, pinned by digest, with trust verdict TRUSTED and score 100.• Vulnerability stats show exposed_total 10 and post_total 21, but exposed_count_ge6 is 0 and post_count_ge6 is 0.• Maximum exposed severity is 4.17 and maximum post-exploit severity is 2.8, indicating only low-severity findings.• No CVE IDs appear in INPUT 4 or INPUT 5, so no specific CVE can be cited as a production blocker.

0/100SAFE

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This base/runtime image is a clean foundation for building production images. It is an official, digest-pinned base image with a trusted reputation score. The provided vulnerability stats show 10 exposed findings and 21 post-exploit-only findings, but none reach severity 6.0; the maximum exposed severity is 4.17 and the maximum post-exploit severity is 2.8. Because the pre-calculated threat score is 0, these low-severity inherited items do not change the SAFE verdict for images built on top. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.

Vulnerabilities

Vulnerability Log

31 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-18374	MEDIUM4.17	libc-bin 2.39-0ubuntu8.9 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-18374	MEDIUM4.17	libc6 2.39-0ubuntu8.9 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-89092	LOW3.57	libc-bin 2.39-0ubuntu8.9 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-89092	LOW3.57	libc6 2.39-0ubuntu8.9 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-35189	LOW3.15	libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16	0.3% Theoretical Threat	Directly Exposed
CVE-2026-102473	LOW2.8	dash 0.5.12-6ubuntu5 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-40228	LOW2.8	libsystemd0 255.4-1ubuntu8.17 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-40228	LOW2.8	libudev1 255.4-1ubuntu8.17 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-86145	LOW2.51	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2026-89161	LOW2.39	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-103111	LOW2.33	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-88647	LOW2.26	libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-89157	LOW2.26	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.3% Theoretical Threat	Post-Exploit
CVE-2026-84782	LOW2.26	libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16	0.4% Theoretical Threat	Post-Exploit
CVE-2026-18477	LOW2.24	tar 1.35+dfsg-3ubuntu0.4 No fix yet	<0.1% Theoretical Threat	Post-Exploit
CVE-2026-18508	LOW2.24	tar 1.35+dfsg-3ubuntu0.4 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-102474	LOW2.04	dash 0.5.12-6ubuntu5 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-89158	LOW1.99	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-89160	LOW1.99	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.3% Theoretical Threat	Post-Exploit
CVE-2024-56433	LOW1.84	login 1:4.13+dfsg1-4ubuntu3.2 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2024-56433	LOW1.84	passwd 1:4.13+dfsg1-4ubuntu3.2 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2026-67693	LOW1.81	libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-89156	LOW1.81	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.3% Theoretical Threat	Post-Exploit
CVE-2026-54872	LOW1.81	libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16	0.3% Theoretical Threat	Post-Exploit
CVE-2026-75805	LOW1.81	libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16	0.2% Theoretical Threat	Post-Exploit
CVE-2026-77696	LOW1.81	libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16	0.2% Theoretical Threat	Post-Exploit
CVE-2026-95184	LOW1.62	libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-75806	LOW1.62	libssl3t64 3.0.13-0ubuntu3.15 fixed in 3.0.13-0ubuntu3.16	0.4% Theoretical Threat	Post-Exploit
CVE-2026-95209	NONE0	libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet	0.2% Theoretical Threat	Not Applicable
CVE-2026-95210	NONE0	libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet	0.2% Theoretical Threat	Not Applicable
CVE-2026-85091	NONE0	zlib1g 1:1.3.dfsg-3.1ubuntu2.2 No fix yet	0.4% Theoretical Threat	Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.