kadet-hub
Image security report: navidrome recipe
navidrome: grade D, 77 findings, one per advisory and package, in the 1 image of version 1.0.0: CRITICAL 0, HIGH 28, MEDIUM 42, LOW 6, UNKNOWN 1. Scanned 2026-11-07 11:47 UTC.
Trivy 0.76.1 scanned the images with the vulnerability database of 2026-11-07. A finding is one advisory in one package of one image, so an advisory in two packages counts twice. The grade is Artifact Hub's: F with a CRITICAL finding, D with HIGH, C with MEDIUM, B with LOW, - with UNKNOWN findings only, A without findings. It rates known vulnerabilities in third-party images, not the recipe itself.
docker.io/deluan/navidrome:0.64.2@sha256:38dc2727bfcfd5ede290f8ada114fc90368146f265ae4701ddddbcbe2a44ee52
CRITICAL 0, HIGH 28, MEDIUM 42, LOW 6, UNKNOWN 1
| ID | Severity | Package | Version | Fixed in |
|---|---|---|---|---|
| CVE-2026-103111 | HIGH | pcre2 | 10.46-r0 | 10.46-r1 |
| CVE-2026-107891 | HIGH | musl | 1.2.5-r12 | 1.2.5-r13 |
| CVE-2026-107891 | HIGH | musl-utils | 1.2.5-r12 | 1.2.5-r13 |
| CVE-2026-111943 | HIGH | stdlib | v1.27.1 | 1.26.10, 1.27.3 |
| CVE-2026-113351 | HIGH | libexpat | 2.8.5-r0 | 2.10.0-r0 |
| CVE-2026-115506 | HIGH | libexpat | 2.8.5-r0 | 2.10.0-r0 |
| CVE-2026-117610 | HIGH | libexpat | 2.8.5-r0 | 2.10.0-r0 |
| CVE-2026-118370 | HIGH | libexpat | 2.8.5-r0 | 2.10.0-r0 |
| CVE-2026-5773 | HIGH | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-5773 | HIGH | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-6276 | HIGH | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-6276 | HIGH | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-77214 | HIGH | libexpat | 2.8.5-r0 | 2.9.0-r0 |
| CVE-2026-78661 | HIGH | golang.org/x/net | v0.59.0 | 0.62.0 |
| CVE-2026-78667 | HIGH | stdlib | v1.27.1 | 1.26.9, 1.27.2 |
| CVE-2026-78669 | HIGH | golang.org/x/net | v0.59.0 | 0.60.0 |
| CVE-2026-78669 | HIGH | stdlib | v1.27.1 | 1.26.9, 1.27.2 |
| CVE-2026-8286 | HIGH | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-8286 | HIGH | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-85091 | HIGH | zlib | 1.3.2-r0 | 1.3.2-r1 |
| CVE-2026-86145 | HIGH | pcre2 | 10.46-r0 | 10.46-r1 |
| CVE-2026-89157 | HIGH | pcre2 | 10.46-r0 | 10.46-r1 |
| CVE-2026-89161 | HIGH | pcre2 | 10.46-r0 | 10.46-r1 |
| CVE-2026-8927 | HIGH | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-8927 | HIGH | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-92392 | HIGH | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-92392 | HIGH | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-97031 | HIGH | stdlib | v1.27.1 | 1.26.9, 1.27.2 |
| CVE-2025-13034 | MEDIUM | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2025-13034 | MEDIUM | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-102633 | MEDIUM | libexpat | 2.8.5-r0 | 2.9.0-r0 |
| CVE-2026-114437 | MEDIUM | github.com/go-chi/chi/v5 | v5.3.2 | 5.4.0 |
| CVE-2026-1965 | MEDIUM | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-1965 | MEDIUM | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-3783 | MEDIUM | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-3783 | MEDIUM | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-3784 | MEDIUM | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-3784 | MEDIUM | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-3805 | MEDIUM | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-3805 | MEDIUM | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-40930 | MEDIUM | libpng | 1.6.57-r0 | 1.6.59-r0 |
| CVE-2026-46675 | MEDIUM | libpng | 1.6.57-r0 | 1.6.59-r0 |
| CVE-2026-4738 | MEDIUM | zlib | 1.3.2-r0 | 1.4-r0 |
| CVE-2026-4873 | MEDIUM | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-4873 | MEDIUM | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-56866 | MEDIUM | stdlib | v1.27.1 | 1.26.9, 1.27.2 |
| CVE-2026-6253 | MEDIUM | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-6253 | MEDIUM | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-6429 | MEDIUM | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-6429 | MEDIUM | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-7168 | MEDIUM | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-7168 | MEDIUM | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-78659 | MEDIUM | golang.org/x/net | v0.59.0 | 0.60.0 |
| CVE-2026-78659 | MEDIUM | stdlib | v1.27.1 | 1.26.9, 1.27.2 |
| CVE-2026-78660 | MEDIUM | golang.org/x/net | v0.59.0 | 0.60.0 |
| CVE-2026-78660 | MEDIUM | stdlib | v1.27.1 | 1.26.9, 1.27.2 |
| CVE-2026-78663 | MEDIUM | golang.org/x/net | v0.59.0 | 0.60.0 |
| CVE-2026-78663 | MEDIUM | stdlib | v1.27.1 | 1.26.9, 1.27.2 |
| CVE-2026-89156 | MEDIUM | pcre2 | 10.46-r0 | 10.46-r1 |
| CVE-2026-89158 | MEDIUM | pcre2 | 10.46-r0 | 10.46-r1 |
| CVE-2026-89160 | MEDIUM | pcre2 | 10.46-r0 | 10.46-r1 |
| CVE-2026-8924 | MEDIUM | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-8924 | MEDIUM | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-94439 | MEDIUM | stdlib | v1.27.1 | 1.26.9, 1.27.2 |
| CVE-2026-94440 | MEDIUM | stdlib | v1.27.1 | 1.26.9, 1.27.2 |
| CVE-2026-94448 | MEDIUM | stdlib | v1.27.1 | 1.26.9, 1.27.2 |
| CVE-2026-97030 | MEDIUM | stdlib | v1.27.1 | 1.26.9, 1.27.2 |
| CVE-2026-97032 | MEDIUM | golang.org/x/net | v0.59.0 | 0.60.0 |
| CVE-2026-97032 | MEDIUM | stdlib | v1.27.1 | 1.26.9, 1.27.2 |
| CVE-2026-97045 | MEDIUM | golang.org/x/net | v0.59.0 | 0.62.0 |
| CVE-2025-14524 | LOW | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2025-14524 | LOW | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2025-14819 | LOW | curl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2025-14819 | LOW | libcurl | 8.14.1-r3 | 8.14.1-r4 |
| CVE-2026-56857 | LOW | stdlib | v1.27.1 | 1.26.9, 1.27.2 |
| CVE-2026-89162 | LOW | pcre2 | 10.46-r0 | 10.46-r1 |
| GO-2026-5932 | UNKNOWN | golang.org/x/crypto | v0.57.0 | 0.58.1-0.20261009181718-2f1f834330b2 |