kadet-hub
Image security report: mattermost recipe
mattermost: grade D, 58 findings, one per advisory and package, in the 2 images of version 1.0.0: CRITICAL 0, HIGH 5, MEDIUM 33, LOW 14, UNKNOWN 6. Scanned 2026-11-07 11:47 UTC.
Trivy 0.76.1 scanned the images with the vulnerability database of 2026-11-07. A finding is one advisory in one package of one image, so an advisory in two packages counts twice. The grade is Artifact Hub's: F with a CRITICAL finding, D with HIGH, C with MEDIUM, B with LOW, - with UNKNOWN findings only, A without findings. It rates known vulnerabilities in third-party images, not the recipe itself.
docker.io/curlimages/curl:8.23.0@sha256:3fb7e13e5d179a845c97d78204f3f1064d1907037f26a3ebf91710571151fd93
CRITICAL 0, HIGH 0, MEDIUM 1, LOW 0, UNKNOWN 0
| ID | Severity | Package | Version | Fixed in |
|---|---|---|---|---|
| CVE-2026-4738 | MEDIUM | zlib | 1.3.2-r1 | 1.4-r0 |
docker.io/mattermost/mattermost-team-edition:12.0.2@sha256:0e435f3397390c36797d0c09b6fcfd73841ebf89bb292d6c6e109082a21ad7b6
CRITICAL 0, HIGH 5, MEDIUM 32, LOW 14, UNKNOWN 6
| ID | Severity | Package | Version | Fixed in |
|---|---|---|---|---|
| CVE-2026-78661 | HIGH | golang.org/x/net | v0.58.0 | 0.62.0 |
| CVE-2026-78661 | HIGH | golang.org/x/net | v0.58.0 | 0.62.0 |
| CVE-2026-78669 | HIGH | golang.org/x/net | v0.58.0 | 0.60.0 |
| CVE-2026-78669 | HIGH | golang.org/x/net | v0.58.0 | 0.60.0 |
| CVE-2026-84782 | HIGH | libssl3 | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u2 |
| CVE-2026-18374 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-19499 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-19542 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-5435 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-5450 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-54872 | MEDIUM | libssl3 | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u2 |
| CVE-2026-5928 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-6238 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-63072 | MEDIUM | libssl3 | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u1 |
| CVE-2026-63076 | MEDIUM | libssl3 | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u1 |
| CVE-2026-6368 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-6791 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-75805 | MEDIUM | libssl3 | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u2 |
| CVE-2026-75806 | MEDIUM | libssl3 | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u2 |
| CVE-2026-77117 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-77696 | MEDIUM | libssl3 | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u2 |
| CVE-2026-78659 | MEDIUM | golang.org/x/net | v0.58.0 | 0.60.0 |
| CVE-2026-78659 | MEDIUM | golang.org/x/net | v0.58.0 | 0.60.0 |
| CVE-2026-78660 | MEDIUM | golang.org/x/net | v0.58.0 | 0.60.0 |
| CVE-2026-78660 | MEDIUM | golang.org/x/net | v0.58.0 | 0.60.0 |
| CVE-2026-78663 | MEDIUM | golang.org/x/net | v0.58.0 | 0.60.0 |
| CVE-2026-78663 | MEDIUM | golang.org/x/net | v0.58.0 | 0.60.0 |
| CVE-2026-80489 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-84243 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-8674 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-86805 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-89092 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-95818 | MEDIUM | libc6 | 2.36-9+deb12u14 | |
| CVE-2026-97032 | MEDIUM | golang.org/x/net | v0.58.0 | 0.60.0 |
| CVE-2026-97032 | MEDIUM | golang.org/x/net | v0.58.0 | 0.60.0 |
| CVE-2026-97045 | MEDIUM | golang.org/x/net | v0.58.0 | 0.62.0 |
| CVE-2026-97045 | MEDIUM | golang.org/x/net | v0.58.0 | 0.62.0 |
| CVE-2010-4756 | LOW | libc6 | 2.36-9+deb12u14 | |
| CVE-2018-20796 | LOW | libc6 | 2.36-9+deb12u14 | |
| CVE-2019-1010022 | LOW | libc6 | 2.36-9+deb12u14 | |
| CVE-2019-1010023 | LOW | libc6 | 2.36-9+deb12u14 | |
| CVE-2019-1010024 | LOW | libc6 | 2.36-9+deb12u14 | |
| CVE-2019-1010025 | LOW | libc6 | 2.36-9+deb12u14 | |
| CVE-2019-9192 | LOW | libc6 | 2.36-9+deb12u14 | |
| CVE-2025-27587 | LOW | libssl3 | 3.0.20-1~deb12u2 | |
| CVE-2026-35189 | LOW | libssl3 | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u2 |
| CVE-2026-42767 | LOW | libssl3 | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u1 |
| CVE-2026-54874 | LOW | libssl3 | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u1 |
| CVE-2026-63074 | LOW | libssl3 | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u1 |
| CVE-2026-75803 | LOW | libssl3 | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u1 |
| CVE-2026-97399 | LOW | libc6 | 2.36-9+deb12u14 | |
| DLA-4792-1 | UNKNOWN | tzdata | 2026b-0+deb12u1 | 2026c-0+deb12u1 |
| DLA-4845-1 | UNKNOWN | ca-certificates | 20250419~deb12u1 | 20250419~deb12u2 |
| DLA-4854-1 | UNKNOWN | tzdata | 2026b-0+deb12u1 | 2026e-0+deb12u1 |
| DLA-4867-1 | UNKNOWN | tzdata | 2026b-0+deb12u1 | 2026f-0+deb12u1 |
| GO-2026-5932 | UNKNOWN | golang.org/x/crypto | v0.57.0 | 0.58.1-0.20261009181718-2f1f834330b2 |
| GO-2026-5932 | UNKNOWN | golang.org/x/crypto | v0.57.0 | 0.58.1-0.20261009181718-2f1f834330b2 |