Scanner: Docker Scout
Critical vulnerabilities: 5
High vulnerabilities: 17
Medium vulnerabilities: 13
Critical
| CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|
| GHSA-6q48-6c7w-9gw2 | certifi | 2026.6.17 | 2026.10.19 | GHSA-6q48-6c7w-9gw2: Improper Certificate Validation |
| GHSA-6q48-6c7w-9gw2 | certifi | 2026.6.17 | 2026.10.19 | GHSA-6q48-6c7w-9gw2: Improper Certificate Validation |
| CVE-2026-112393 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112393: Heap-based Buffer Overflow |
| CVE-2026-112403 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112403: Heap-based Buffer Overflow |
| CVE-2026-112900 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112900: Improper Neutralization of Special Elements used in an OS Command ('OS Command Inje... |
High
| CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|
| CVE-2025-47273 | setuptools | 70.3.0 | 78.1.1 | CVE-2025-47273: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| CVE-2026-112390 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112390: Loop with Unreachable Exit Condition ('Infinite Loop') |
| CVE-2026-112392 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112392: NULL Pointer Dereference |
| CVE-2026-112893 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112893: Use of Uninitialized Variable |
| CVE-2026-112397 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112397: Out-of-bounds Write |
| CVE-2026-112399 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112399: Memory Allocation with Excessive Size Value |
| CVE-2026-112400 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112400: Uncontrolled Resource Consumption |
| CVE-2026-112402 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112402: Use After Free |
| CVE-2026-112405 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112405: NULL Pointer Dereference |
| CVE-2026-112406 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112406: Loop with Unreachable Exit Condition ('Infinite Loop') |
| CVE-2026-112892 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112892: Improper Handling of Highly Compressed Data (Data Amplification) |
| CVE-2026-112894 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112894: Inefficient Algorithmic Complexity |
| CVE-2026-112895 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112895: Uncontrolled Recursion |
| CVE-2026-112897 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112897: Use of Uninitialized Resource |
| CVE-2026-112404 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112404: Out-of-bounds Read |
| CVE-2026-112896 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112896: Out-of-bounds Read |
| CVE-2026-112902 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112902: Function Call With Incorrect Argument Type |
Medium
| CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|
| CVE-2023-49092 | rsa | 0.9.10 | not fixed | CVE-2023-49092 |
| CVE-2026-112396 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112396: Use After Free |
| CVE-2026-59890 | setuptools | 70.3.0 | 83.0.0 | CVE-2026-59890: Improper Handling of Unicode Encoding |
| CVE-2026-112391 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112391: Loop with Unreachable Exit Condition ('Infinite Loop') |
| CVE-2026-112394 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112394: Buffer Over-read |
| CVE-2026-81871 | otlploggrpc | 0.20.0 | 0.21.0 | CVE-2026-81871: Improper Certificate Validation |
| CVE-2026-81872 | log | 0.20.0 | 0.21.0 | CVE-2026-81872: Uncontrolled Resource Consumption |
| CVE-2026-112395 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112395: Heap-based Buffer Overflow |
| CVE-2026-112401 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112401: Inefficient Algorithmic Complexity |
| CVE-2026-112891 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112891: Inefficient Algorithmic Complexity |
| CVE-2026-112898 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112898: Use of Uninitialized Variable |
| CVE-2026-112899 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112899: Allocation of Resources Without Limits or Throttling |
| CVE-2026-112901 | pillow | 12.3.0 | 13.0.0 | CVE-2026-112901: Inefficient Regular Expression Complexity |