Vulnerability Reportzabbix/zabbix-server-pgsql:latest

zabbix/zabbix-server-pgsql:latestzabbix/zabbix-server-pgsql:7.4-alpine-latestzabbix/zabbix-server-pgsql:alpine-7.4-latest

digestsha256:03ea7dab367cfe82aa7798394bb9f6a85ed60b8645d8846c88703b1ddcb796c5

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreSAFE• The scan found no vulnerabilities reachable from the network in normal operation, and the threat score falls in the lowest tier.• The 48 findings in the image only matter after an attacker has already gained control of the container, and the highest of them carries a low severity score of 2.92.• No findings are flagged as actively exploited in the wild.• The publisher is verified as zabbix and the image is pinned by digest, which supports a stable and traceable supply chain (reputation verdict: TRUSTED).• The container runs as a non-root user (1997) and exposes only the Zabbix server port 10051/tcp.

0/100SAFE

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. The scan found 48 vulnerabilities, but none are reachable from the network in normal operation, and the highest severity among them is low (2.92). They would only matter if an attacker had already compromised the container, so they do not change the verdict. Keeping the image updated with future Zabbix releases is still good practice.

Already in good shape · 3 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

48 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-92392	LOW2.92	curl 8.22.0-r0 fixed in 8.23.0-r0	1.3% Low-Moderate Risk	Post-Exploit
CVE-2026-92392	LOW2.92	libcurl 8.22.0-r0 fixed in 8.23.0-r0	1.3% Low-Moderate Risk	Post-Exploit
CVE-2026-86410	LOW2.45	curl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-86410	LOW2.45	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-92388	LOW2.34	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-86414	LOW2.34	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-92390	LOW2.34	curl 8.22.0-r0 fixed in 8.23.0-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-92388	LOW2.34	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-86414	LOW2.34	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-92390	LOW2.34	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-86411	LOW2.12	curl 8.22.0-r0 fixed in 8.23.0-r0	0.4% Theoretical Threat	Post-Exploit
CVE-2026-86411	LOW2.12	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.4% Theoretical Threat	Post-Exploit
CVE-2026-86409	LOW1.91	curl 8.22.0-r0 fixed in 8.23.0-r0	1.1% Low-Moderate Risk	Post-Exploit
CVE-2026-86412	LOW1.91	curl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-86413	LOW1.91	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-86409	LOW1.91	libcurl 8.22.0-r0 fixed in 8.23.0-r0	1.1% Low-Moderate Risk	Post-Exploit
CVE-2026-86412	LOW1.91	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-86413	LOW1.91	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-107928	LOW1.73	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-107928	LOW1.73	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-92386	LOW1.55	curl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-92386	LOW1.55	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-107929	LOW1.33	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-86415	LOW1.33	curl 8.22.0-r0 fixed in 8.23.0-r0	0.4% Theoretical Threat	Post-Exploit
CVE-2026-87861	LOW1.33	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-87862	LOW1.33	curl 8.22.0-r0 fixed in 8.23.0-r0	1.0% Theoretical Threat	Post-Exploit
CVE-2026-87863	LOW1.33	curl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-87864	LOW1.33	curl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-87865	LOW1.33	curl 8.22.0-r0 fixed in 8.23.0-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-87866	LOW1.33	curl 8.22.0-r0 fixed in 8.23.0-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-92387	LOW1.33	curl 8.22.0-r0 fixed in 8.23.0-r0	1.0% Low-Moderate Risk	Post-Exploit
CVE-2026-92389	LOW1.33	curl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-92391	LOW1.33	curl 8.22.0-r0 fixed in 8.23.0-r0	1.2% Low-Moderate Risk	Post-Exploit
CVE-2026-107929	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-86415	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.4% Theoretical Threat	Post-Exploit
CVE-2026-87861	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-87862	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	1.0% Theoretical Threat	Post-Exploit
CVE-2026-87863	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-87864	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-87865	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-87866	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-92387	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	1.0% Low-Moderate Risk	Post-Exploit
CVE-2026-92389	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-92391	LOW1.33	libcurl 8.22.0-r0 fixed in 8.23.0-r0	1.2% Low-Moderate Risk	Post-Exploit
CVE-2026-94266	LOW1.19	curl 8.22.0-r0 fixed in 8.23.0-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-94266	LOW1.19	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-94265	LOW1.12	curl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit
CVE-2026-94265	LOW1.12	libcurl 8.22.0-r0 fixed in 8.23.0-r0	0.8% Theoretical Threat	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.