Scanner: Docker Scout
Critical vulnerabilities: 5
High vulnerabilities: 30
Medium vulnerabilities: 12
Critical
| CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|
| CVE-2026-78663 | net | 0.57.0 | 0.60.0 | CVE-2026-78663 |
| CVE-2026-78663 | net | 0.57.0 | 0.60.0 | CVE-2026-78663 |
| CVE-2026-45833 | chromadb | 0.5.20 | not fixed | CVE-2026-45833: Improper Control of Generation of Code ('Code Injection') |
| CVE-2026-39821 | stdlib | 1.26.5 | 1.26.6 | CVE-2026-39821 |
| CVE-2026-56857 | stdlib | 1.26.5 | 1.26.9 | CVE-2026-56857 |
High
| CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|
| CVE-2026-114613 | msgpack | 1.1.2 | 1.2.3 | CVE-2026-114613: Missing Release of Memory after Effective Lifetime |
| CVE-2026-33818 | stdlib | 1.26.5 | 1.26.6 | CVE-2026-33818 |
| CVE-2026-46600 | stdlib | 1.26.5 | 1.26.6 | CVE-2026-46600 |
| CVE-2026-56853 | stdlib | 1.26.5 | 1.26.6 | CVE-2026-56853 |
| CVE-2026-56855 | crypto | 0.55.0 | 0.56.0 | CVE-2026-56855 |
| CVE-2026-56859 | stdlib | 1.26.5 | 1.26.6 | CVE-2026-56859 |
| CVE-2026-56862 | stdlib | 1.26.5 | 1.26.6 | CVE-2026-56862 |
| CVE-2026-56866 | stdlib | 1.26.5 | 1.26.9 | CVE-2026-56866 |
| CVE-2026-57585 | msgpack | 1.1.2 | 1.2.1 | CVE-2026-57585 |
| CVE-2026-78659 | net | 0.57.0 | 1.26.9 | CVE-2026-78659 |
| CVE-2026-78659 | net | 0.57.0 | 1.26.9 | CVE-2026-78659 |
| CVE-2026-78660 | net | 0.57.0 | 0.60.0 | CVE-2026-78660 |
| CVE-2026-78660 | net | 0.57.0 | 0.60.0 | CVE-2026-78660 |
| CVE-2026-78662 | crypto | 0.55.0 | 0.56.0 | CVE-2026-78662 |
| CVE-2026-78667 | stdlib | 1.26.5 | 1.26.9 | CVE-2026-78667 |
| CVE-2026-78669 | net | 0.57.0 | 0.60.0 | CVE-2026-78669 |
| CVE-2026-78669 | net | 0.57.0 | 0.60.0 | CVE-2026-78669 |
| CVE-2026-94439 | stdlib | 1.26.5 | 1.26.9 | CVE-2026-94439 |
| CVE-2026-94440 | stdlib | 1.26.5 | 1.26.9 | CVE-2026-94440 |
| CVE-2026-97031 | stdlib | 1.26.5 | 1.26.9 | CVE-2026-97031 |
| CVE-2026-97032 | net | 0.57.0 | 1.26.9 | CVE-2026-97032 |
| CVE-2026-97032 | net | 0.57.0 | 1.26.9 | CVE-2026-97032 |
| GHSA-6v7p-g79w-8964 | msgpack | 1.1.2 | 1.2.1 | GHSA-6v7p-g79w-8964: Use After Free |
| CVE-2026-97687 | urllib3 | 2.7.0 | 2.8.0 | CVE-2026-97687: Improper Certificate Validation |
| CVE-2025-47273 | setuptools | 70.3.0 | 78.1.1 | CVE-2025-47273: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| CVE-2026-84304 | grpc | 1.83.0 | 1.83.1 | CVE-2026-84304: Uncontrolled Resource Consumption |
| CVE-2026-84445 | grpc | 1.83.0 | 1.83.2 | CVE-2026-84445: Improper Validation of Array Index |
| CVE-2026-45830 | chromadb | 0.5.20 | not fixed | CVE-2026-45830: Incorrect Privilege Assignment |
| CVE-2026-45831 | chromadb | 0.5.20 | not fixed | CVE-2026-45831: Incorrect Authorization |
| CVE-2026-97689 | urllib3 | 2.7.0 | 2.8.0 | CVE-2026-97689: Allocation of Resources Without Limits or Throttling |
Medium
| CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|
| CVE-2026-112910 | filelock | 3.20.3 | 4.2.1 | CVE-2026-112910: Incorrect Permission Assignment for Critical Resource |
| CVE-2026-114603 | opentelemetry-api | 1.44.0 | 1.45.1 | CVE-2026-114603: Inefficient Regular Expression Complexity |
| CVE-2023-49092 | rsa | 0.9.10 | not fixed | CVE-2023-49092 |
| CVE-2026-56860 | stdlib | 1.26.5 | 1.26.6 | CVE-2026-56860 |
| CVE-2026-112909 | filelock | 3.20.3 | 4.2.1 | CVE-2026-112909: Use of Incorrectly-Resolved Name or Reference |
| CVE-2026-56858 | stdlib | 1.26.5 | 1.26.6 | CVE-2026-56858 |
| CVE-2026-59890 | setuptools | 70.3.0 | 83.0.0 | CVE-2026-59890: Improper Handling of Unicode Encoding |
| CVE-2026-94448 | stdlib | 1.26.5 | 1.26.9 | CVE-2026-94448 |
| CVE-2026-97030 | stdlib | 1.26.5 | 1.26.9 | CVE-2026-97030 |
| CVE-2026-114386 | pydantic-ai-harness | 0.20.0 | 0.59.0 | CVE-2026-114386: Allocation of Resources Without Limits or Throttling |
| CVE-2026-84303 | grpc | 1.83.0 | 1.83.1 | CVE-2026-84303: Improper Handling of Case Sensitivity |
| CVE-2026-97688 | urllib3 | 2.7.0 | 2.8.0 | CVE-2026-97688: Loop with Unreachable Exit Condition ('Infinite Loop') |