Scanner: Docker Scout
Critical vulnerabilities: 5
High vulnerabilities: 25
Medium vulnerabilities: 19
Critical
| CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|
| GHSA-6q48-6c7w-9gw2 | certifi | 2025.11.12 | 2026.10.19 | GHSA-6q48-6c7w-9gw2: Improper Certificate Validation |
| GHSA-6q48-6c7w-9gw2 | certifi | 2025.11.12 | 2026.10.19 | GHSA-6q48-6c7w-9gw2: Improper Certificate Validation |
| CVE-2026-112393 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112393: Heap-based Buffer Overflow |
| CVE-2026-112403 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112403: Heap-based Buffer Overflow |
| CVE-2026-112900 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112900: Improper Neutralization of Special Elements used in an OS Command ('OS Command Inje... |
High
| CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|
| CVE-2026-57585 | msgpack | 1.1.2 | 1.2.1 | CVE-2026-57585 |
| GHSA-6v7p-g79w-8964 | msgpack | 1.1.2 | 1.2.1 | GHSA-6v7p-g79w-8964: Use After Free |
| CVE-2026-97687 | urllib3 | 2.7.0 | 2.8.0 | CVE-2026-97687: Improper Certificate Validation |
| CVE-2025-47273 | setuptools | 70.3.0 | 78.1.1 | CVE-2025-47273: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| CVE-2026-111064 | aiohttp | 3.14.3 | 3.14.4 | CVE-2026-111064: Allocation of Resources Without Limits or Throttling |
| CVE-2026-111066 | aiohttp | 3.14.3 | 3.14.4 | CVE-2026-111066: Uncontrolled Resource Consumption |
| CVE-2026-112390 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112390: Loop with Unreachable Exit Condition ('Infinite Loop') |
| CVE-2026-112392 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112392: NULL Pointer Dereference |
| CVE-2026-112893 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112893: Use of Uninitialized Variable |
| CVE-2026-81726 | nltk | 3.10.3 | not fixed | CVE-2026-81726: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| CVE-2026-112397 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112397: Out-of-bounds Write |
| CVE-2026-112399 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112399: Memory Allocation with Excessive Size Value |
| CVE-2026-112400 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112400: Uncontrolled Resource Consumption |
| CVE-2026-112402 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112402: Use After Free |
| CVE-2026-112405 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112405: NULL Pointer Dereference |
| CVE-2026-112406 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112406: Loop with Unreachable Exit Condition ('Infinite Loop') |
| CVE-2026-112892 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112892: Improper Handling of Highly Compressed Data (Data Amplification) |
| CVE-2026-112894 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112894: Inefficient Algorithmic Complexity |
| CVE-2026-112895 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112895: Uncontrolled Recursion |
| CVE-2026-112897 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112897: Use of Uninitialized Resource |
| GHSA-2g87-pp6c-29x5 | aiohttp | 3.14.3 | 3.14.4 | GHSA-2g87-pp6c-29x5: Allocation of Resources Without Limits or Throttling |
| CVE-2026-112404 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112404: Out-of-bounds Read |
| CVE-2026-112896 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112896: Out-of-bounds Read |
| CVE-2026-112902 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112902: Function Call With Incorrect Argument Type |
| CVE-2026-97689 | urllib3 | 2.7.0 | 2.8.0 | CVE-2026-97689: Allocation of Resources Without Limits or Throttling |
Medium
| CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|
| CVE-2023-49092 | rsa | 0.9.10 | not fixed | CVE-2023-49092 |
| CVE-2026-112396 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112396: Use After Free |
| CVE-2026-113792 | pypdf | 6.19.0 | 6.20.1 | CVE-2026-113792: Loop with Unreachable Exit Condition ('Infinite Loop') |
| CVE-2026-113793 | pypdf | 6.19.0 | 6.20.1 | CVE-2026-113793: Loop with Unreachable Exit Condition ('Infinite Loop') |
| CVE-2026-113794 | pypdf | 6.19.0 | 6.20.0 | CVE-2026-113794: Loop with Unreachable Exit Condition ('Infinite Loop') |
| CVE-2026-113795 | pypdf | 6.19.0 | 6.20.0 | CVE-2026-113795: Uncontrolled Resource Consumption |
| CVE-2026-59890 | setuptools | 70.3.0 | 83.0.0 | CVE-2026-59890: Improper Handling of Unicode Encoding |
| CVE-2026-111748 | aiohttp | 3.14.3 | 3.14.4 | CVE-2026-111748: Reliance on Untrusted Inputs in a Security Decision |
| CVE-2026-111750 | aiohttp | 3.14.3 | 3.14.4 | CVE-2026-111750: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
| CVE-2026-112391 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112391: Loop with Unreachable Exit Condition ('Infinite Loop') |
| CVE-2026-112394 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112394: Buffer Over-read |
| CVE-2026-112395 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112395: Heap-based Buffer Overflow |
| CVE-2026-111065 | aiohttp | 3.14.3 | 3.14.4 | CVE-2026-111065: Allocation of Resources Without Limits or Throttling |
| CVE-2026-112401 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112401: Inefficient Algorithmic Complexity |
| CVE-2026-112891 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112891: Inefficient Algorithmic Complexity |
| CVE-2026-112898 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112898: Use of Uninitialized Variable |
| CVE-2026-112899 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112899: Allocation of Resources Without Limits or Throttling |
| CVE-2026-112901 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112901: Inefficient Regular Expression Complexity |
| CVE-2026-97688 | urllib3 | 2.7.0 | 2.8.0 | CVE-2026-97688: Loop with Unreachable Exit Condition ('Infinite Loop') |