kadet-hub
Image security report: umami recipe
umami: grade D, 60 findings, one per advisory and package, in the 1 image of version 1.0.1: CRITICAL 0, HIGH 8, MEDIUM 7, LOW 45, UNKNOWN 0. Scanned 2026-11-07 11:47 UTC.
Trivy 0.76.1 scanned the images with the vulnerability database of 2026-11-07. A finding is one advisory in one package of one image, so an advisory in two packages counts twice. The grade is Artifact Hub's: F with a CRITICAL finding, D with HIGH, C with MEDIUM, B with LOW, - with UNKNOWN findings only, A without findings. It rates known vulnerabilities in third-party images, not the recipe itself.
ghcr.io/umami-software/umami:3.4.1@sha256:e69d1a7932e9dab0fc523edc7be1f3a53f3c261f57856fc2167ae74a8fc022e8
CRITICAL 0, HIGH 8, MEDIUM 7, LOW 45, UNKNOWN 0
| ID | Severity | Package | Version | Fixed in |
|---|---|---|---|---|
| CVE-2026-109383 | HIGH | undici | 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-109869 | HIGH | undici | 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-19534 | HIGH | undici | 6.28.0 | 6.28.1, 7.29.1, 8.10.2 |
| CVE-2026-40345 | HIGH | deepmerge-ts | 7.1.5 | 8.0.0 |
| CVE-2026-87018 | HIGH | undici | 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-92392 | HIGH | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92392 | HIGH | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| GHSA-3f6p-5ww8-9rcr | HIGH | mysql2 | 3.15.3 | 3.22.0 |
| CVE-2026-109924 | MEDIUM | undici | 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-109932 | MEDIUM | undici | 6.28.0 | 6.29.1, 7.30.1, 8.12.2 |
| CVE-2026-4738 | MEDIUM | zlib | 1.3.2-r1 | 1.4-r0 |
| CVE-2026-85024 | MEDIUM | undici | 6.28.0 | 6.28.1, 7.29.1, 8.10.2 |
| CVE-2026-92388 | MEDIUM | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92388 | MEDIUM | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| GHSA-rgwj-5xj2-c3m3 | MEDIUM | mysql2 | 3.15.3 | 3.23.1 |
| CVE-2026-107928 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-107928 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-107929 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-107929 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-18540 | LOW | undici | 6.28.0 | 6.28.1, 7.29.1, 8.10.2 |
| CVE-2026-86409 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86409 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86410 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86410 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86411 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86411 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86412 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86412 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86413 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86413 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86414 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86414 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86415 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-86415 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87861 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87861 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87862 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87862 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87863 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87863 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87864 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87864 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87865 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87865 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87866 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-87866 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92386 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92386 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92387 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92387 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92389 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92389 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92390 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92390 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92391 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-92391 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-94265 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-94265 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-94266 | LOW | curl | 8.22.0-r0 | 8.23.0-r0 |
| CVE-2026-94266 | LOW | libcurl | 8.22.0-r0 | 8.23.0-r0 |