Last scanned:
This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker could smuggle requests past access rules on the admin port 8080 and bypass authentication, and because the container runs as root by default, the consequences of a compromise are amplified. Note: CVE-2026-10050 only applies if HTTP Digest authentication is configured on the admin server. Its official-image provenance does not change the exposed-surface findings that drive this verdict.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-2332 | CRITICAL9.1 | org.eclipse.jetty:jetty-http 9.4.58.v20250814 fixed in 12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60 | 1.3% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-10050 | HIGH7.28 | org.eclipse.jetty:jetty-security 9.4.58.v20250814 fixed in 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-45416 | MEDIUM6 | io.netty:netty-handler 4.1.130.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75596 | MEDIUM6 | io.netty:netty-handler 4.1.130.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-66382 | MEDIUM5.5 | libexpat1 2.4.7-1ubuntu0.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95512 | MEDIUM5.5 | libfreetype6 2.11.1+dfsg-1ubuntu0.3 fixed in 2.11.1+dfsg-1ubuntu0.4 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-77420 | MEDIUM5.5 | org.jline:jline-reader 3.25.1 fixed in 4.3.1, 3.30.15 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-75595 | MEDIUM5.46 | io.netty:netty-handler 4.1.130.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-11226 | MEDIUM5.44 | ch.qos.logback:logback-core 1.3.15 fixed in 1.5.19, 1.3.16 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-1225 | MEDIUM5 | ch.qos.logback:logback-core 1.3.15 fixed in 1.5.25 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc-bin 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-54512 | MEDIUM4.86 | com.fasterxml.jackson.core:jackson-databind 2.15.2 fixed in 2.18.8, 3.1.4, 2.21.4 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-54513 | MEDIUM4.86 | com.fasterxml.jackson.core:jackson-databind 2.15.2 fixed in 2.18.8, 2.21.4, 3.1.4 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-44249 | MEDIUM4.86 | io.netty:netty-handler 4.1.130.Final fixed in 4.2.15.Final, 4.1.135.Final | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-111497 | MEDIUM4.76 | libbrotli1 1.0.9-2build6 fixed in 1.0.9-2ubuntu0.1 | 36.0% High Exploitation Risk | Directly Exposed |
| CVE-2026-68494 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.15.2 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.15.2 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68497 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.15.2 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.15.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.15.2 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42583 | MEDIUM4.5 | io.netty:netty-codec 4.1.130.Final fixed in 4.1.133.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59901 | MEDIUM4.5 | io.netty:netty-codec 4.1.130.Final fixed in 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-50010 | MEDIUM4.5 | io.netty:netty-handler 4.1.130.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-77422 | MEDIUM4.5 | org.jline:jline-builtins 3.25.1 fixed in 4.3.1, 3.30.15 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-56740 | MEDIUM4.5 | org.jline:jline-remote-telnet 3.25.1 fixed in 4.2.1, 4.0.16, 3.30.14 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-56741 | MEDIUM4.5 | org.jline:jline-remote-telnet 3.25.1 fixed in 4.2.1, 4.0.16, 3.30.14 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2024-6763 | MEDIUM4.5 | org.eclipse.jetty:jetty-http 9.4.58.v20250814 fixed in 12.0.12 | 1.0% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-84782 | MEDIUM4.44 | libssl3 3.0.2-0ubuntu1.29 fixed in 3.0.2-0ubuntu1.30 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc-bin 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88647 | MEDIUM4.14 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88648 | MEDIUM4.14 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-2 2.1.27+dfsg2-3ubuntu1.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-modules-db 2.1.27+dfsg2-3ubuntu1.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45536 | MEDIUM4 | io.netty:netty-transport-native-epoll 4.1.130.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-89158 | LOW3.9 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-59888 | LOW3.9 | com.fasterxml.jackson.core:jackson-databind 2.15.2 fixed in 2.18.8, 2.21.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59889 | LOW3.9 | com.fasterxml.jackson.core:jackson-databind 2.15.2 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-77421 | LOW3.9 | org.jline:jline-builtins 3.25.1 fixed in 4.3.1, 3.30.15 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54872 | LOW3.9 | libssl3 3.0.2-0ubuntu1.29 fixed in 3.0.2-0ubuntu1.30 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | LOW3.9 | libssl3 3.0.2-0ubuntu1.29 fixed in 3.0.2-0ubuntu1.30 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | LOW3.9 | libssl3 3.0.2-0ubuntu1.29 fixed in 3.0.2-0ubuntu1.30 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-77696 | LOW3.9 | libssl3 3.0.2-0ubuntu1.29 fixed in 3.0.2-0ubuntu1.30 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2022-4899 | LOW3.9 | libzstd1 1.4.8+dfsg-3build1 No fix yet | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-35189 | LOW3.7 | libssl3 3.0.2-0ubuntu1.29 fixed in 3.0.2-0ubuntu1.30 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-67693 | LOW3.54 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-46675 | LOW3.54 | libpng16-16 1.6.37-3ubuntu0.6 fixed in 1.6.37-3ubuntu0.7 | — | Directly Exposed |
| CVE-2026-83557 | LOW3.36 | com.fasterxml.jackson.core:jackson-databind 2.15.2 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | gcc-12-base 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | libgcc-s1 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | libstdc++6 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-102473 | LOW3.3 | dash 0.5.11+git20210903+057cd650a4ed-3build1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW3.3 | libsystemd0 249.11-0ubuntu3.22 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW3.3 | libudev1 249.11-0ubuntu3.22 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95184 | LOW3.18 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18401 | LOW3.18 | com.fasterxml.jackson.core:jackson-core 2.15.2 fixed in 2.21.1, 2.18.6 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | LOW3.18 | com.fasterxml.jackson.core:jackson-databind 2.15.2 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-54514 | LOW3.18 | com.fasterxml.jackson.core:jackson-databind 2.15.2 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54515 | LOW3.18 | com.fasterxml.jackson.core:jackson-databind 2.15.2 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-77310 | LOW3.18 | com.fasterxml.jackson.core:jackson-databind 2.15.2 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-6790 | LOW3.18 | org.eclipse.jetty:jetty-server 9.4.58.v20250814 fixed in 12.0.35, 12.1.9 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-95209 | LOW3 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95210 | LOW3 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-10532 | LOW2.9 | ch.qos.logback:logback-core 1.3.15 fixed in 1.5.34 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18477 | LOW2.64 | tar 1.34+dfsg-1ubuntu0.1.22.04.6 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.64 | tar 1.34+dfsg-1ubuntu0.1.22.04.6 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-102474 | LOW2.4 | dash 0.5.11+git20210903+057cd650a4ed-3build1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-86409 | LOW2.34 | curl 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | curl 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | curl 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86409 | LOW2.34 | libcurl4 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl4 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl4 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | libncurses6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | libncursesw6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2022-41409 | LOW2.34 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2023-50495 | LOW2.34 | libtinfo6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | ncurses-base 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | ncurses-bin 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2026-87862 | LOW2.22 | curl 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-87864 | LOW2.22 | curl 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92389 | LOW2.22 | curl 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92391 | LOW2.22 | curl 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-87862 | LOW2.22 | libcurl4 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-87864 | LOW2.22 | libcurl4 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92389 | LOW2.22 | libcurl4 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-92391 | LOW2.22 | libcurl4 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2021-31879 | LOW2.2 | wget 1.21.2-2ubuntu1.5 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | curl 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | libcurl4 7.81.0-1ubuntu1.29 fixed in 7.81.0-1ubuntu1.30 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | login 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-29383 | LOW1.68 | login 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-29383 | LOW1.68 | passwd 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-9828 | LOW1.2 | ch.qos.logback:logback-core 1.3.15 fixed in 1.5.33 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | NONE0 | locales 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-89092 | NONE0 | locales 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.