Scanner: Docker Scout
Critical vulnerabilities: 5
High vulnerabilities: 21
Medium vulnerabilities: 36
Critical
| CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|
| CVE-2026-33186 | grpc | 1.77.0 | 1.79.3 | CVE-2026-33186: Improper Authorization |
| CVE-2026-6100 | python3.11 | 3.11.2-6%2Bdeb12u6 | not fixed | CVE-2026-6100 |
| CVE-2026-35030 | litellm | 1.82.6 | 1.83.0 | CVE-2026-35030: Improper Authentication |
| CVE-2024-52338 | pyarrow | 14.0.2 | 17.0.0 | CVE-2024-52338 |
| CVE-2025-68121 | stdlib | 1.25.5 | 1.25.7 | CVE-2025-68121 |
High
| CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|
| CVE-2026-24051 | sdk | 1.38.0 | 1.40.0 | CVE-2026-24051: Untrusted Search Path |
| CVE-2026-4519 | python | 3.12.13 | 3.13.13 | CVE-2026-4519 |
| CVE-2025-55131 | nodejs | 22.21.0-1nodesource1 | not fixed | CVE-2025-55131 |
| CVE-2026-24049 | wheel | 0.45.1 | 0.46.2 | CVE-2026-24049: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| CVE-2026-39883 | sdk | 1.38.0 | 1.43.0 | CVE-2026-39883: Untrusted Search Path |
| CVE-2024-23342 | ecdsa | 0.19.1 | not fixed | CVE-2024-23342: Observable Discrepancy |
| CVE-2025-59465 | nodejs | 22.21.0-1nodesource1 | not fixed | CVE-2025-59465 |
| CVE-2025-59466 | nodejs | 22.21.0-1nodesource1 | not fixed | CVE-2025-59466 |
| CVE-2025-61726 | stdlib | 1.25.5 | 1.25.6 | CVE-2025-61726 |
| CVE-2026-21637 | nodejs | 22.21.0-1nodesource1 | not fixed | CVE-2026-21637 |
| CVE-2026-21710 | nodejs | 22.21.0-1nodesource1 | not fixed | CVE-2026-21710 |
| CVE-2026-25679 | stdlib | 1.25.5 | 1.25.8 | CVE-2026-25679 |
| CVE-2026-27135 | nghttp2 | 1.52.0-1%2Bdeb12u2 | not fixed | CVE-2026-27135 |
| CVE-2026-32280 | stdlib | 1.25.5 | 1.25.9 | CVE-2026-32280 |
| CVE-2026-32281 | stdlib | 1.25.5 | 1.25.9 | CVE-2026-32281 |
| CVE-2026-32283 | stdlib | 1.25.5 | 1.25.9 | CVE-2026-32283 |
| CVE-2026-33231 | nltk | 3.9.3 | not fixed | CVE-2026-33231: Missing Authentication for Critical Function |
| CVE-2026-26007 | cryptography | 44.0.3 | 46.0.5 | CVE-2026-26007: Insufficient Verification of Data Authenticity |
| GHSA-69x8-hrgq-fjj8 | litellm | 1.82.6 | 1.83.0 | GHSA-69x8-hrgq-fjj8: Exposure of Sensitive Information to an Unauthorized Actor |
| CVE-2026-35029 | litellm | 1.82.6 | 1.83.0 | CVE-2026-35029: Incorrect Authorization |
| CVE-2026-40192 | pillow | 12.1.1 | 12.2.0 | CVE-2026-40192: Allocation of Resources Without Limits or Throttling |
Medium
| CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|
| CVE-2025-45582 | tar | 1.34%2Bdfsg-1.2%2Bdeb12u1 | not fixed | CVE-2025-45582 |
| CVE-2026-25934 | v5 | 5.16.4 | 5.16.5 | CVE-2026-25934: Improper Validation of Integrity Check Value |
| CVE-2026-25645 | requests | 2.32.5 | 2.33.0 | CVE-2026-25645: Insecure Temporary File |
| CVE-2026-33699 | pypdf | 6.9.1 | 6.9.2 | CVE-2026-33699: Loop with Unreachable Exit Condition ('Infinite Loop') |
| CVE-2026-34165 | v5 | 5.16.4 | 5.17.1 | CVE-2026-34165: Integer Underflow (Wrap or Wraparound) |
| CVE-2026-5704 | tar | 1.34%2Bdfsg-1.2%2Bdeb12u1 | not fixed | CVE-2026-5704 |
| GHSA-rf74-v2fm-23pw | nltk | 3.9.3 | not fixed | GHSA-rf74-v2fm-23pw: Uncontrolled Recursion |
| CVE-2025-69872 | diskcache | 5.6.3 | not fixed | CVE-2025-69872: Deserialization of Untrusted Data |
| CVE-2022-42969 | py | 1.11.0 | not fixed | CVE-2022-42969 |
| CVE-2025-61730 | stdlib | 1.25.5 | 1.25.6 | CVE-2025-61730 |
| CVE-2026-21714 | nodejs | 22.21.0-1nodesource1 | not fixed | CVE-2026-21714 |
| CVE-2026-33936 | ecdsa | 0.19.1 | 0.19.2 | CVE-2026-33936: Improper Handling of Length Parameter Inconsistency |
| CVE-2026-32288 | stdlib | 1.25.5 | 1.25.9 | CVE-2026-32288 |
| CVE-2026-1502 | python | 3.12.13 | not fixed | CVE-2026-1502 |
| CVE-2026-21713 | nodejs | 22.21.0-1nodesource1 | not fixed | CVE-2026-21713 |
| CVE-2026-21717 | nodejs | 22.21.0-1nodesource1 | not fixed | CVE-2026-21717 |
| GHSA-xmrv-pmrh-hhx2 | eventstream | 1.7.3 | 1.7.8 | GHSA-xmrv-pmrh-hhx2: Improper Input Validation |
| GHSA-xmrv-pmrh-hhx2 | eventstream | 1.7.3 | 1.7.8 | GHSA-xmrv-pmrh-hhx2: Improper Input Validation |
| CVE-2026-3446 | python | 3.12.13 | 3.13.13 | CVE-2026-3446 |
| CVE-2026-3644 | python3.11 | 3.11.2-6%2Bdeb12u6 | not fixed | CVE-2026-3644 |
| CVE-2026-3644 | python3.11 | 3.11.2-6%2Bdeb12u6 | not fixed | CVE-2026-3644 |
| CVE-2026-4224 | python3.11 | 3.11.2-6%2Bdeb12u6 | not fixed | CVE-2026-4224 |
| CVE-2026-4224 | python3.11 | 3.11.2-6%2Bdeb12u6 | not fixed | CVE-2026-4224 |
| CVE-2026-27142 | stdlib | 1.25.5 | 1.25.8 | CVE-2026-27142 |
| CVE-2026-32289 | stdlib | 1.25.5 | 1.25.9 | CVE-2026-32289 |
| CVE-2026-33230 | nltk | 3.9.3 | 3.9.4 | CVE-2026-33230: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| CVE-2025-12781 | python | 3.12.13 | 3.13.10 | CVE-2025-12781 |
| CVE-2026-34525 | aiohttp | 3.13.3 | 3.13.4 | CVE-2026-34525: Improper Input Validation |
| CVE-2026-32282 | stdlib | 1.25.5 | 1.25.9 | CVE-2026-32282 |
| CVE-2025-61728 | stdlib | 1.25.5 | 1.25.6 | CVE-2025-61728 |
| CVE-2026-34515 | aiohttp | 3.13.3 | 3.13.4 | CVE-2026-34515: Absolute Path Traversal |
| CVE-2026-34516 | aiohttp | 3.13.3 | 3.13.4 | CVE-2026-34516: Allocation of Resources Without Limits or Throttling |
| CVE-2025-71176 | pytest | 9.0.2 | 9.0.3 | CVE-2025-71176: Creation of Temporary File in Directory with Insecure Permissions |
| GHSA-pqhf-p39g-3x64 | uv | 0.8.9 | 0.9.6 | GHSA-pqhf-p39g-3x64: Improper Input Validation |
| CVE-2026-22815 | aiohttp | 3.13.3 | 3.13.4 | CVE-2026-22815: Uncontrolled Resource Consumption |
| CVE-2026-40260 | pypdf | 6.9.1 | 6.10.0 | CVE-2026-40260: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') |