kadet-hub
Image security report: gotify recipe
gotify: grade F, 71 findings, one per advisory and package, in the 1 image of version 1.0.0: CRITICAL 2, HIGH 33, MEDIUM 29, LOW 5, UNKNOWN 2. Scanned 2026-11-14 12:09 UTC.
Trivy 0.76.1 scanned the images with the vulnerability database of 2026-11-14. A finding is one advisory in one package of one image, so an advisory in two packages counts twice. The grade is Artifact Hub's: F with a CRITICAL finding, D with HIGH, C with MEDIUM, B with LOW, - with UNKNOWN findings only, A without findings. It rates known vulnerabilities in third-party images, not the recipe itself.
docker.io/gotify/server:3.1.1@sha256:44fc5bbd1c0618878e33073d38c2c13126b48f245c3fe12236b1da48eb203b86
CRITICAL 2, HIGH 33, MEDIUM 29, LOW 5, UNKNOWN 2
| ID | Severity | Package | Version | Fixed in |
|---|---|---|---|---|
| CVE-2026-33815 | CRITICAL | github.com/jackc/pgx/v5 | v5.7.6 | 5.9.0 |
| CVE-2026-33816 | CRITICAL | github.com/jackc/pgx/v5 | v5.7.6 | 5.9.0 |
| CVE-2026-111943 | HIGH | stdlib | v1.26.0 | 1.26.10, 1.27.3 |
| CVE-2026-116587 | HIGH | github.com/go-jose/go-jose/v4 | v4.1.4 | 4.1.6 |
| CVE-2026-25679 | HIGH | stdlib | v1.26.0 | 1.25.8, 1.26.1 |
| CVE-2026-27137 | HIGH | stdlib | v1.26.0 | 1.26.1 |
| CVE-2026-27145 | HIGH | stdlib | v1.26.0 | 1.25.11, 1.26.4 |
| CVE-2026-32280 | HIGH | stdlib | v1.26.0 | 1.25.9, 1.26.2 |
| CVE-2026-32281 | HIGH | stdlib | v1.26.0 | 1.25.9, 1.26.2 |
| CVE-2026-32283 | HIGH | stdlib | v1.26.0 | 1.25.9, 1.26.2 |
| CVE-2026-33810 | HIGH | stdlib | v1.26.0 | 1.26.2 |
| CVE-2026-33811 | HIGH | stdlib | v1.26.0 | 1.25.10, 1.26.3 |
| CVE-2026-33814 | HIGH | stdlib | v1.26.0 | 1.25.10, 1.26.3 |
| CVE-2026-33818 | HIGH | stdlib | v1.26.0 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-39820 | HIGH | stdlib | v1.26.0 | 1.25.10, 1.26.3 |
| CVE-2026-39821 | HIGH | stdlib | v1.26.0 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-39822 | HIGH | stdlib | v1.26.0 | 1.25.12, 1.26.5, 1.27.0-rc.2 |
| CVE-2026-39836 | HIGH | stdlib | v1.26.0 | 1.25.10, 1.26.3 |
| CVE-2026-42499 | HIGH | stdlib | v1.26.0 | 1.25.10, 1.26.3 |
| CVE-2026-42504 | HIGH | stdlib | v1.26.0 | 1.25.11, 1.26.4 |
| CVE-2026-46600 | HIGH | golang.org/x/net | v0.55.0 | 0.56.0 |
| CVE-2026-46600 | HIGH | stdlib | v1.26.0 | 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56851 | HIGH | golang.org/x/text | v0.38.0 | 0.41.0 |
| CVE-2026-56852 | HIGH | golang.org/x/text | v0.38.0 | 0.39.0 |
| CVE-2026-56853 | HIGH | stdlib | v1.26.0 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56854 | HIGH | golang.org/x/crypto | v0.53.0 | 0.55.0 |
| CVE-2026-56858 | HIGH | stdlib | v1.26.0 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56859 | HIGH | stdlib | v1.26.0 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56860 | HIGH | stdlib | v1.26.0 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56862 | HIGH | stdlib | v1.26.0 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-78661 | HIGH | golang.org/x/net | v0.55.0 | 0.62.0 |
| CVE-2026-78667 | HIGH | stdlib | v1.26.0 | 1.26.9, 1.27.2 |
| CVE-2026-78669 | HIGH | golang.org/x/net | v0.55.0 | 0.60.0 |
| CVE-2026-78669 | HIGH | stdlib | v1.26.0 | 1.26.9, 1.27.2 |
| CVE-2026-97031 | HIGH | stdlib | v1.26.0 | 1.26.9, 1.27.2 |
| CVE-2026-116585 | MEDIUM | github.com/go-jose/go-jose/v4 | v4.1.4 | 4.1.5 |
| CVE-2026-116586 | MEDIUM | github.com/go-jose/go-jose/v4 | v4.1.4 | 4.1.5 |
| CVE-2026-128085 | MEDIUM | go.opentelemetry.io/otel/trace | v1.43.0 | 1.47.0 |
| CVE-2026-27142 | MEDIUM | stdlib | v1.26.0 | 1.25.8, 1.26.1 |
| CVE-2026-32282 | MEDIUM | stdlib | v1.26.0 | 1.25.9, 1.26.2 |
| CVE-2026-32288 | MEDIUM | stdlib | v1.26.0 | 1.25.9, 1.26.2 |
| CVE-2026-32289 | MEDIUM | stdlib | v1.26.0 | 1.25.9, 1.26.2 |
| CVE-2026-39823 | MEDIUM | stdlib | v1.26.0 | 1.25.10, 1.26.3 |
| CVE-2026-39825 | MEDIUM | stdlib | v1.26.0 | 1.25.10, 1.26.3 |
| CVE-2026-39826 | MEDIUM | stdlib | v1.26.0 | 1.25.10, 1.26.3 |
| CVE-2026-40898 | MEDIUM | github.com/quic-go/quic-go | v0.59.0 | 0.59.1 |
| CVE-2026-42505 | MEDIUM | stdlib | v1.26.0 | 1.25.12, 1.26.5, 1.27.0-rc.2 |
| CVE-2026-42507 | MEDIUM | stdlib | v1.26.0 | 1.25.11, 1.26.4 |
| CVE-2026-56855 | MEDIUM | golang.org/x/crypto | v0.53.0 | 0.56.0 |
| CVE-2026-56866 | MEDIUM | stdlib | v1.26.0 | 1.26.9, 1.27.2 |
| CVE-2026-78659 | MEDIUM | golang.org/x/net | v0.55.0 | 0.60.0 |
| CVE-2026-78659 | MEDIUM | stdlib | v1.26.0 | 1.26.9, 1.27.2 |
| CVE-2026-78660 | MEDIUM | golang.org/x/net | v0.55.0 | 0.60.0 |
| CVE-2026-78660 | MEDIUM | stdlib | v1.26.0 | 1.26.9, 1.27.2 |
| CVE-2026-78662 | MEDIUM | golang.org/x/crypto | v0.53.0 | 0.56.0 |
| CVE-2026-78663 | MEDIUM | golang.org/x/net | v0.55.0 | 0.60.0 |
| CVE-2026-78663 | MEDIUM | stdlib | v1.26.0 | 1.26.9, 1.27.2 |
| CVE-2026-94439 | MEDIUM | stdlib | v1.26.0 | 1.26.9, 1.27.2 |
| CVE-2026-94440 | MEDIUM | stdlib | v1.26.0 | 1.26.9, 1.27.2 |
| CVE-2026-94448 | MEDIUM | stdlib | v1.26.0 | 1.26.9, 1.27.2 |
| CVE-2026-97030 | MEDIUM | stdlib | v1.26.0 | 1.26.9, 1.27.2 |
| CVE-2026-97032 | MEDIUM | golang.org/x/net | v0.55.0 | 0.60.0 |
| CVE-2026-97032 | MEDIUM | stdlib | v1.26.0 | 1.26.9, 1.27.2 |
| CVE-2026-97045 | MEDIUM | golang.org/x/net | v0.55.0 | 0.62.0 |
| CVE-2026-26958 | LOW | filippo.io/edwards25519 | v1.1.0 | 1.1.1 |
| CVE-2026-27138 | LOW | stdlib | v1.26.0 | 1.26.1 |
| CVE-2026-27139 | LOW | stdlib | v1.26.0 | 1.25.8, 1.26.1 |
| CVE-2026-41889 | LOW | github.com/jackc/pgx/v5 | v5.7.6 | 5.9.2 |
| CVE-2026-56857 | LOW | stdlib | v1.26.0 | 1.26.9, 1.27.2 |
| CVE-2026-97054 | UNKNOWN | stdlib | v1.26.0 | 1.26.11, 1.27.4 |
| GO-2026-5932 | UNKNOWN | golang.org/x/crypto | v0.53.0 | 0.58.1-0.20261009181718-2f1f834330b2 |