kadet-hub
Image security report: netbox recipe
netbox: grade D, 108 findings, one per advisory and package, in the 3 images of version 1.0.1: CRITICAL 0, HIGH 25, MEDIUM 74, LOW 8, UNKNOWN 1. Scanned 2026-11-07 11:47 UTC.
Trivy 0.76.1 scanned the images with the vulnerability database of 2026-11-07. A finding is one advisory in one package of one image, so an advisory in two packages counts twice. The grade is Artifact Hub's: F with a CRITICAL finding, D with HIGH, C with MEDIUM, B with LOW, - with UNKNOWN findings only, A without findings. It rates known vulnerabilities in third-party images, not the recipe itself.
docker.io/busybox:1.38.0@sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4
CRITICAL 0, HIGH 0, MEDIUM 0, LOW 0, UNKNOWN 0
No vulnerabilities found.
docker.io/rancher/kubectl:v1.36.2@sha256:06c7a7a9772737494ae1e0c3af90f1b5385630c147e47c1c7cea92f4bed55fbe
CRITICAL 0, HIGH 22, MEDIUM 18, LOW 1, UNKNOWN 1
| ID | Severity | Package | Version | Fixed in |
|---|---|---|---|---|
| CVE-2026-111943 | HIGH | stdlib | v1.26.4 | 1.26.10, 1.27.3 |
| CVE-2026-25681 | HIGH | golang.org/x/net | v0.49.0 | 0.55.0 |
| CVE-2026-27136 | HIGH | golang.org/x/net | v0.49.0 | 0.55.0 |
| CVE-2026-33814 | HIGH | golang.org/x/net | v0.49.0 | 0.53.0 |
| CVE-2026-33818 | HIGH | stdlib | v1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-39821 | HIGH | golang.org/x/net | v0.49.0 | 0.55.0 |
| CVE-2026-39821 | HIGH | stdlib | v1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-39822 | HIGH | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 |
| CVE-2026-46600 | HIGH | golang.org/x/net | v0.49.0 | 0.56.0 |
| CVE-2026-46600 | HIGH | stdlib | v1.26.4 | 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56851 | HIGH | golang.org/x/text | v0.33.0 | 0.41.0 |
| CVE-2026-56852 | HIGH | golang.org/x/text | v0.33.0 | 0.39.0 |
| CVE-2026-56853 | HIGH | stdlib | v1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56858 | HIGH | stdlib | v1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56859 | HIGH | stdlib | v1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56860 | HIGH | stdlib | v1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-56862 | HIGH | stdlib | v1.26.4 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| CVE-2026-78661 | HIGH | golang.org/x/net | v0.49.0 | 0.62.0 |
| CVE-2026-78667 | HIGH | stdlib | v1.26.4 | 1.26.9, 1.27.2 |
| CVE-2026-78669 | HIGH | golang.org/x/net | v0.49.0 | 0.60.0 |
| CVE-2026-78669 | HIGH | stdlib | v1.26.4 | 1.26.9, 1.27.2 |
| CVE-2026-97031 | HIGH | stdlib | v1.26.4 | 1.26.9, 1.27.2 |
| CVE-2026-25680 | MEDIUM | golang.org/x/net | v0.49.0 | 0.55.0 |
| CVE-2026-42502 | MEDIUM | golang.org/x/net | v0.49.0 | 0.55.0 |
| CVE-2026-42505 | MEDIUM | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 |
| CVE-2026-42506 | MEDIUM | golang.org/x/net | v0.49.0 | 0.55.0 |
| CVE-2026-56866 | MEDIUM | stdlib | v1.26.4 | 1.26.9, 1.27.2 |
| CVE-2026-78659 | MEDIUM | golang.org/x/net | v0.49.0 | 0.60.0 |
| CVE-2026-78659 | MEDIUM | stdlib | v1.26.4 | 1.26.9, 1.27.2 |
| CVE-2026-78660 | MEDIUM | golang.org/x/net | v0.49.0 | 0.60.0 |
| CVE-2026-78660 | MEDIUM | stdlib | v1.26.4 | 1.26.9, 1.27.2 |
| CVE-2026-78663 | MEDIUM | golang.org/x/net | v0.49.0 | 0.60.0 |
| CVE-2026-78663 | MEDIUM | stdlib | v1.26.4 | 1.26.9, 1.27.2 |
| CVE-2026-94439 | MEDIUM | stdlib | v1.26.4 | 1.26.9, 1.27.2 |
| CVE-2026-94440 | MEDIUM | stdlib | v1.26.4 | 1.26.9, 1.27.2 |
| CVE-2026-94448 | MEDIUM | stdlib | v1.26.4 | 1.26.9, 1.27.2 |
| CVE-2026-97030 | MEDIUM | stdlib | v1.26.4 | 1.26.9, 1.27.2 |
| CVE-2026-97032 | MEDIUM | golang.org/x/net | v0.49.0 | 0.60.0 |
| CVE-2026-97032 | MEDIUM | stdlib | v1.26.4 | 1.26.9, 1.27.2 |
| CVE-2026-97045 | MEDIUM | golang.org/x/net | v0.49.0 | 0.62.0 |
| CVE-2026-56857 | LOW | stdlib | v1.26.4 | 1.26.9, 1.27.2 |
| CVE-2026-39824 | UNKNOWN | golang.org/x/sys | v0.40.0 | 0.44.0 |
ghcr.io/netbox-community/netbox:v4.7.4@sha256:69cd72d0b0e4928a90940a7011954aaa7060c75fddd8dc6cea2f19407bae45b1
CRITICAL 0, HIGH 3, MEDIUM 56, LOW 7, UNKNOWN 0
| ID | Severity | Package | Version | Fixed in |
|---|---|---|---|---|
| CVE-2026-109518 | HIGH | apt | 3.2.0 | 3.2.1ubuntu0.1 |
| CVE-2026-109518 | HIGH | libapt-pkg7.0 | 3.2.0 | 3.2.1ubuntu0.1 |
| CVE-2026-49272 | HIGH | oauthlib | 4.0.0 | 4.0.1 |
| CVE-2025-66382 | MEDIUM | libexpat1 | 2.7.4-1ubuntu0.2 | |
| CVE-2025-7425 | MEDIUM | libxslt1.1 | 1.1.45-0.1 | |
| CVE-2026-102473 | MEDIUM | dash | 0.5.12-12ubuntu3 | |
| CVE-2026-102474 | MEDIUM | dash | 0.5.12-12ubuntu3 | |
| CVE-2026-103111 | MEDIUM | libpcre2-8-0 | 10.46-1build1 | 10.46-1ubuntu0.1 |
| CVE-2026-107161 | MEDIUM | libsasl2-2 | 2.1.28+dfsg1-9ubuntu3 | |
| CVE-2026-107161 | MEDIUM | libsasl2-modules-db | 2.1.28+dfsg1-9ubuntu3 | |
| CVE-2026-110928 | MEDIUM | openssh-client | 1:10.2p1-2ubuntu3.8 | |
| CVE-2026-115910 | MEDIUM | social-auth-core | 5.2.0 | 6.2.0 |
| CVE-2026-13757 | MEDIUM | libp11-kit0 | 0.26.2-2 | |
| CVE-2026-18374 | MEDIUM | libc-bin | 2.43-2ubuntu2.4 | |
| CVE-2026-18374 | MEDIUM | libc-gconv-modules-extra | 2.43-2ubuntu2.4 | |
| CVE-2026-18374 | MEDIUM | libc6 | 2.43-2ubuntu2.4 | |
| CVE-2026-18477 | MEDIUM | tar | 1.35+dfsg-4ubuntu0.4 | |
| CVE-2026-18508 | MEDIUM | tar | 1.35+dfsg-4ubuntu0.4 | |
| CVE-2026-35341 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35344 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35345 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35348 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35350 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35351 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35352 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35354 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35357 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35359 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35360 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35363 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35364 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35367 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35368 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35370 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35371 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35373 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35374 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-35377 | MEDIUM | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 | |
| CVE-2026-67693 | MEDIUM | libgnutls30t64 | 3.8.12-2ubuntu1.1 | |
| CVE-2026-7210 | MEDIUM | libpython3.14-minimal | 3.14.4-1ubuntu0.2 | |
| CVE-2026-7210 | MEDIUM | libpython3.14-stdlib | 3.14.4-1ubuntu0.2 | |
| CVE-2026-7210 | MEDIUM | python3.14 | 3.14.4-1ubuntu0.2 | |
| CVE-2026-7210 | MEDIUM | python3.14-minimal | 3.14.4-1ubuntu0.2 | |
| CVE-2026-82560 | MEDIUM | perl-base | 5.40.1-7ubuntu0.3 | |
| CVE-2026-86145 | MEDIUM | libpcre2-8-0 | 10.46-1build1 | 10.46-1ubuntu0.1 |
| CVE-2026-88647 | MEDIUM | libgnutls30t64 | 3.8.12-2ubuntu1.1 | |
| CVE-2026-88648 | MEDIUM | libgnutls30t64 | 3.8.12-2ubuntu1.1 | |
| CVE-2026-89092 | MEDIUM | libc-bin | 2.43-2ubuntu2.4 | |
| CVE-2026-89092 | MEDIUM | libc-gconv-modules-extra | 2.43-2ubuntu2.4 | |
| CVE-2026-89092 | MEDIUM | libc6 | 2.43-2ubuntu2.4 | |
| CVE-2026-89156 | MEDIUM | libpcre2-8-0 | 10.46-1build1 | 10.46-1ubuntu0.1 |
| CVE-2026-89157 | MEDIUM | libpcre2-8-0 | 10.46-1build1 | 10.46-1ubuntu0.1 |
| CVE-2026-89158 | MEDIUM | libpcre2-8-0 | 10.46-1build1 | 10.46-1ubuntu0.1 |
| CVE-2026-89160 | MEDIUM | libpcre2-8-0 | 10.46-1build1 | 10.46-1ubuntu0.1 |
| CVE-2026-89161 | MEDIUM | libpcre2-8-0 | 10.46-1build1 | 10.46-1ubuntu0.1 |
| CVE-2026-89162 | MEDIUM | libpcre2-8-0 | 10.46-1build1 | 10.46-1ubuntu0.1 |
| CVE-2026-95184 | MEDIUM | libgnutls30t64 | 3.8.12-2ubuntu1.1 | |
| CVE-2026-95210 | MEDIUM | libgnutls30t64 | 3.8.12-2ubuntu1.1 | |
| GHSA-c8m5-c952-6cm4 | MEDIUM | rustls | 0.23.45 | 0.23.46, 0.24.0-dev.2 |
| CVE-2024-56433 | LOW | login.defs | 1:4.17.4-2ubuntu3 | |
| CVE-2024-56433 | LOW | passwd | 1:4.17.4-2ubuntu3 | |
| CVE-2026-40228 | LOW | libsystemd0 | 259.9-0ubuntu0.1 | |
| CVE-2026-40228 | LOW | libudev1 | 259.9-0ubuntu0.1 | |
| GHSA-h2v8-394m-p7vv | LOW | rustls | 0.23.45 | 0.23.46, 0.24.0-dev.2 |
| GHSA-vp88-798v-h67f | LOW | rustls | 0.23.45 | 0.23.46, 0.24.0-dev.2 |
| GHSA-w44r-93j7-qv28 | LOW | rustls | 0.23.45 | 0.23.46, 0.24.0-dev.2 |