registry.rancher.com/rancher/nginx-ingress-controller:v1.15.1-prime11 image scan · 61 findings
⚠ 59 findings to act on — 3 critical, 37 high, 16 medium, 3 low
AFFECTED(59) — vulnerable code is present and can be loaded Severity Advisory Package Version Location Fixed in EPSS Method ▸ CRITICAL CVE-2025-1974 k8s.io/ingress-nginx (devel) /dbg 1.12.1 99.9% advisory CVE-2025-1974 (also GHSA-mgvx-rpfc-9mpv ) from golang severity CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H fixed in 1.12.1 (also fixed in 1.11.5) epss 99.9% 99.9% percentile (epss 0.99525) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ CRITICAL CVE-2025-1974 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.12.1 99.9% advisory CVE-2025-1974 (also GHSA-mgvx-rpfc-9mpv ) from golang severity CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H fixed in 1.12.1 (also fixed in 1.11.5) epss 99.9% 99.9% percentile (epss 0.99525) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ CRITICAL CVE-2025-1974 k8s.io/ingress-nginx (devel) /wait-shutdown 1.12.1 99.9% advisory CVE-2025-1974 (also GHSA-mgvx-rpfc-9mpv ) from golang severity CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H fixed in 1.12.1 (also fixed in 1.11.5) epss 99.9% 99.9% percentile (epss 0.99525) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2025-1098 k8s.io/ingress-nginx (devel) /dbg 1.12.1 99.7% advisory CVE-2025-1098 (also GHSA-vg63-w3p9-jc9m ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.12.1 (also fixed in 1.11.5) epss 99.7% 99.7% percentile (epss 0.83498) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2025-1098 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.12.1 99.7% advisory CVE-2025-1098 (also GHSA-vg63-w3p9-jc9m ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.12.1 (also fixed in 1.11.5) epss 99.7% 99.7% percentile (epss 0.83498) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2025-1098 k8s.io/ingress-nginx (devel) /wait-shutdown 1.12.1 99.7% advisory CVE-2025-1098 (also GHSA-vg63-w3p9-jc9m ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.12.1 (also fixed in 1.11.5) epss 99.7% 99.7% percentile (epss 0.83498) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2023-5044 k8s.io/ingress-nginx (devel) /dbg 1.9.0 99.0% advisory CVE-2023-5044 (also GHSA-fp9f-44c2-cw27 ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L fixed in 1.9.0 epss 99.0% 99.0% percentile (epss 0.56605) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2023-5044 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.9.0 99.0% advisory CVE-2023-5044 (also GHSA-fp9f-44c2-cw27 ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L fixed in 1.9.0 epss 99.0% 99.0% percentile (epss 0.56605) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2023-5044 k8s.io/ingress-nginx (devel) /wait-shutdown 1.9.0 99.0% advisory CVE-2023-5044 (also GHSA-fp9f-44c2-cw27 ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L fixed in 1.9.0 epss 99.0% 99.0% percentile (epss 0.56605) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2025-1097 k8s.io/ingress-nginx (devel) /dbg 1.12.1 98.4% advisory CVE-2025-1097 (also GHSA-823x-fv5p-h7hw ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.12.1 (also fixed in 1.11.5) epss 98.4% 98.4% percentile (epss 0.35534) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2025-1097 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.12.1 98.4% advisory CVE-2025-1097 (also GHSA-823x-fv5p-h7hw ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.12.1 (also fixed in 1.11.5) epss 98.4% 98.4% percentile (epss 0.35534) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2025-1097 k8s.io/ingress-nginx (devel) /wait-shutdown 1.12.1 98.4% advisory CVE-2025-1097 (also GHSA-823x-fv5p-h7hw ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.12.1 (also fixed in 1.11.5) epss 98.4% 98.4% percentile (epss 0.35534) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2025-24514 k8s.io/ingress-nginx (devel) /dbg 1.12.1 98.2% advisory CVE-2025-24514 (also GHSA-fwwp-xcxw-39vq ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.12.1 (also fixed in 1.11.5) epss 98.2% 98.2% percentile (epss 0.32618) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2025-24514 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.12.1 98.2% advisory CVE-2025-24514 (also GHSA-fwwp-xcxw-39vq ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.12.1 (also fixed in 1.11.5) epss 98.2% 98.2% percentile (epss 0.32618) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2025-24514 k8s.io/ingress-nginx (devel) /wait-shutdown 1.12.1 98.2% advisory CVE-2025-24514 (also GHSA-fwwp-xcxw-39vq ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.12.1 (also fixed in 1.11.5) epss 98.2% 98.2% percentile (epss 0.32618) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ MEDIUM CVE-2025-24513 k8s.io/ingress-nginx (devel) /dbg 1.12.1 88.6% advisory CVE-2025-24513 (also GHSA-242m-6h72-7hgp ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L fixed in 1.12.1 (also fixed in 1.11.5) epss 88.6% 88.6% percentile (epss 0.03535) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ MEDIUM CVE-2025-24513 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.12.1 88.6% advisory CVE-2025-24513 (also GHSA-242m-6h72-7hgp ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L fixed in 1.12.1 (also fixed in 1.11.5) epss 88.6% 88.6% percentile (epss 0.03535) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ MEDIUM CVE-2025-24513 k8s.io/ingress-nginx (devel) /wait-shutdown 1.12.1 88.6% advisory CVE-2025-24513 (also GHSA-242m-6h72-7hgp ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L fixed in 1.12.1 (also fixed in 1.11.5) epss 88.6% 88.6% percentile (epss 0.03535) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2023-5043 k8s.io/ingress-nginx (devel) /dbg 1.9.0 81.8% advisory CVE-2023-5043 (also GHSA-5wj4-wffq-3378 ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L fixed in 1.9.0 epss 81.8% 81.8% percentile (epss 0.02234) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2023-5043 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.9.0 81.8% advisory CVE-2023-5043 (also GHSA-5wj4-wffq-3378 ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L fixed in 1.9.0 epss 81.8% 81.8% percentile (epss 0.02234) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2023-5043 k8s.io/ingress-nginx (devel) /wait-shutdown 1.9.0 81.8% advisory CVE-2023-5043 (also GHSA-5wj4-wffq-3378 ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L fixed in 1.9.0 epss 81.8% 81.8% percentile (epss 0.02234) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2022-4886 k8s.io/ingress-nginx (devel) /dbg 1.8.0 73.7% advisory CVE-2022-4886 (also GHSA-gvrm-w2f9-f77q ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.8.0 epss 73.7% 73.7% percentile (epss 0.01554) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2022-4886 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.8.0 73.7% advisory CVE-2022-4886 (also GHSA-gvrm-w2f9-f77q ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.8.0 epss 73.7% 73.7% percentile (epss 0.01554) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2022-4886 k8s.io/ingress-nginx (devel) /wait-shutdown 1.8.0 73.7% advisory CVE-2022-4886 (also GHSA-gvrm-w2f9-f77q ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.8.0 epss 73.7% 73.7% percentile (epss 0.01554) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2026-4342 k8s.io/ingress-nginx (devel) /dbg 0.0.0-20260319175635-5183b7d86137 72.7% advisory CVE-2026-4342 (also GHSA-f53h-mxv9-cp98 ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 0.0.0-20260319175635-5183b7d86137 epss 72.7% 72.7% percentile (epss 0.01494) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2026-4342 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 0.0.0-20260319175635-5183b7d86137 72.7% advisory CVE-2026-4342 (also GHSA-f53h-mxv9-cp98 ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 0.0.0-20260319175635-5183b7d86137 epss 72.7% 72.7% percentile (epss 0.01494) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2026-4342 k8s.io/ingress-nginx (devel) /wait-shutdown 0.0.0-20260319175635-5183b7d86137 72.7% advisory CVE-2026-4342 (also GHSA-f53h-mxv9-cp98 ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 0.0.0-20260319175635-5183b7d86137 epss 72.7% 72.7% percentile (epss 0.01494) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2021-25745 k8s.io/ingress-nginx (devel) /dbg 1.2.0 65.5% advisory CVE-2021-25745 (also GHSA-pvmg-xgmx-9mxh ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L fixed in 1.2.0 epss 65.5% 65.5% percentile (epss 0.01164) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) [prefer-vendor] SUSE Security Team rates this HIGH (preferred vendor score) ▸ HIGH CVE-2021-25745 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.2.0 65.5% advisory CVE-2021-25745 (also GHSA-pvmg-xgmx-9mxh ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L fixed in 1.2.0 epss 65.5% 65.5% percentile (epss 0.01164) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) [prefer-vendor] SUSE Security Team rates this HIGH (preferred vendor score) ▸ HIGH CVE-2021-25745 k8s.io/ingress-nginx (devel) /wait-shutdown 1.2.0 65.5% advisory CVE-2021-25745 (also GHSA-pvmg-xgmx-9mxh ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L fixed in 1.2.0 epss 65.5% 65.5% percentile (epss 0.01164) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) [prefer-vendor] SUSE Security Team rates this HIGH (preferred vendor score) ▸ MEDIUM CVE-2018-1002104 k8s.io/ingress-nginx (devel) /dbg 1.5 64.8% advisory CVE-2018-1002104 (also GHSA-p3x5-5xpx-9phm ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N fixed in 1.5 epss 64.8% 64.8% percentile (epss 0.01138) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ MEDIUM CVE-2018-1002104 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.5 64.8% advisory CVE-2018-1002104 (also GHSA-p3x5-5xpx-9phm ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N fixed in 1.5 epss 64.8% 64.8% percentile (epss 0.01138) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ MEDIUM CVE-2018-1002104 k8s.io/ingress-nginx (devel) /wait-shutdown 1.5 64.8% advisory CVE-2018-1002104 (also GHSA-p3x5-5xpx-9phm ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N fixed in 1.5 epss 64.8% 64.8% percentile (epss 0.01138) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ MEDIUM CVE-2020-8553 k8s.io/ingress-nginx (devel) /dbg 0.28.0 57.5% advisory CVE-2020-8553 (also GHSA-hhpm-74pm-hf35 ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N fixed in 0.28.0 epss 57.5% 57.5% percentile (epss 0.00894) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ MEDIUM CVE-2020-8553 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 0.28.0 57.5% advisory CVE-2020-8553 (also GHSA-hhpm-74pm-hf35 ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N fixed in 0.28.0 epss 57.5% 57.5% percentile (epss 0.00894) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ MEDIUM CVE-2020-8553 k8s.io/ingress-nginx (devel) /wait-shutdown 0.28.0 57.5% advisory CVE-2020-8553 (also GHSA-hhpm-74pm-hf35 ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N fixed in 0.28.0 epss 57.5% 57.5% percentile (epss 0.00894) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH SUSE-SU-2026:23303-1 libpython3_13-1_0 0:3.13.14-160000.1.1 no fix 53.0% elf-needed-closure advisory SUSE-SU-2026:23303-1 fixes CVE-2025-15366, CVE-2025-15367, CVE-2026-0864, CVE-2026-11940, CVE-2026-11972 (+3 more) from os severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N epss 53.0% 53.0% percentile (epss 0.00750) for CVE-2026-11940, highest of 8 purl pkg:rpm/sles/libpython3_13-1_0@0:3.13.14-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure] libpython3_13-1_0 installs 1 ELF object (/usr/lib64/libpython3.13.so.1.0) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure] blocking /nginx-ingress-controller is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure] blocking /usr/bin/catatonit is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure] blocking /usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure] blocking /usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure] blocking /usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure] blocking /usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor] SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) ▸ MEDIUM CVE-2021-25748 k8s.io/ingress-nginx (devel) /dbg 1.2.1 51.0% advisory CVE-2021-25748 (also GHSA-863x-868h-968x ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N fixed in 1.2.1 epss 51.0% 51.0% percentile (epss 0.00694) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ MEDIUM CVE-2021-25748 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.2.1 51.0% advisory CVE-2021-25748 (also GHSA-863x-868h-968x ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N fixed in 1.2.1 epss 51.0% 51.0% percentile (epss 0.00694) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ MEDIUM CVE-2021-25748 k8s.io/ingress-nginx (devel) /wait-shutdown 1.2.1 51.0% advisory CVE-2021-25748 (also GHSA-863x-868h-968x ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N fixed in 1.2.1 epss 51.0% 51.0% percentile (epss 0.00694) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2026-39821 stdlib 1.25.12 /usr/bin/container-suseconnect 1.25.13 50.9% advisory CVE-2026-39821 (also GO-2026-5026 ) from golang severity HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 50.9% 50.9% percentile (epss 0.00692) purl pkg:golang/stdlib@1.25.12 binary /usr/bin/container-suseconnect (stripped) packages net/http, net/http/internal/http2 (package) [prefer-vendor] SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) ▸ HIGH CVE-2026-33818 stdlib 1.25.12 /usr/bin/container-suseconnect 1.25.13 45.3% advisory CVE-2026-33818 (also GO-2026-5972 ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 45.3% 45.3% percentile (epss 0.00568) purl pkg:golang/stdlib@1.25.12 binary /usr/bin/container-suseconnect (stripped) packages encoding/asn1 (package) [prefer-vendor] SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) ▸ HIGH CVE-2026-56853 stdlib 1.25.12 /usr/bin/container-suseconnect 1.25.13 45.3% advisory CVE-2026-56853 (also GO-2026-6089 ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 45.3% 45.3% percentile (epss 0.00568) purl pkg:golang/stdlib@1.25.12 binary /usr/bin/container-suseconnect (stripped) packages net/http (package) [prefer-vendor] SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) ▸ HIGH CVE-2026-56859 stdlib 1.25.12 /usr/bin/container-suseconnect 1.25.13 45.3% advisory CVE-2026-56859 (also GO-2026-6088 ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 45.3% 45.3% percentile (epss 0.00568) purl pkg:golang/stdlib@1.25.12 binary /usr/bin/container-suseconnect (stripped) packages encoding/xml (package) [prefer-vendor] SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) ▸ HIGH CVE-2026-56862 stdlib 1.25.12 /usr/bin/container-suseconnect 1.25.13 45.3% advisory CVE-2026-56862 (also GO-2026-6090 ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 45.3% 45.3% percentile (epss 0.00568) purl pkg:golang/stdlib@1.25.12 binary /usr/bin/container-suseconnect (stripped) packages crypto/tls (package) [prefer-vendor] SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) ▸ MEDIUM CVE-2026-56860 stdlib 1.25.12 /usr/bin/container-suseconnect 1.25.13 42.5% advisory CVE-2026-56860 (also GO-2026-6218 ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 42.5% 42.5% percentile (epss 0.00518) purl pkg:golang/stdlib@1.25.12 binary /usr/bin/container-suseconnect (stripped) packages net/url (package) [prefer-vendor] SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score) ▸ HIGH CVE-2026-24512 k8s.io/ingress-nginx (devel) /dbg 1.14.3 41.9% advisory CVE-2026-24512 (also GHSA-jx8c-56mg-h6vp ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.14.3 (also fixed in 1.13.7) epss 41.9% 41.9% percentile (epss 0.00510) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2026-24512 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.14.3 41.9% advisory CVE-2026-24512 (also GHSA-jx8c-56mg-h6vp ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.14.3 (also fixed in 1.13.7) epss 41.9% 41.9% percentile (epss 0.00510) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2026-24512 k8s.io/ingress-nginx (devel) /wait-shutdown 1.14.3 41.9% advisory CVE-2026-24512 (also GHSA-jx8c-56mg-h6vp ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.14.3 (also fixed in 1.13.7) epss 41.9% 41.9% percentile (epss 0.00510) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2026-1580 k8s.io/ingress-nginx (devel) /dbg 1.14.3 40.9% advisory CVE-2026-1580 (also GHSA-9h3p-52vh-959w ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.14.3 (also fixed in 1.13.7) epss 40.9% 40.9% percentile (epss 0.00493) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2026-1580 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.14.3 40.9% advisory CVE-2026-1580 (also GHSA-9h3p-52vh-959w ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.14.3 (also fixed in 1.13.7) epss 40.9% 40.9% percentile (epss 0.00493) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH CVE-2026-1580 k8s.io/ingress-nginx (devel) /wait-shutdown 1.14.3 40.9% advisory CVE-2026-1580 (also GHSA-9h3p-52vh-959w ) from golang severity HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H fixed in 1.14.3 (also fixed in 1.13.7) epss 40.9% 40.9% percentile (epss 0.00493) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ MEDIUM CVE-2026-24514 k8s.io/ingress-nginx (devel) /dbg 1.14.3 39.9% advisory CVE-2026-24514 (also GHSA-2pf9-vr92-6h3v ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H fixed in 1.14.3 (also fixed in 1.13.7) epss 39.9% 39.9% percentile (epss 0.00478) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ MEDIUM CVE-2026-24514 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.14.3 39.9% advisory CVE-2026-24514 (also GHSA-2pf9-vr92-6h3v ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H fixed in 1.14.3 (also fixed in 1.13.7) epss 39.9% 39.9% percentile (epss 0.00478) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ MEDIUM CVE-2026-24514 k8s.io/ingress-nginx (devel) /wait-shutdown 1.14.3 39.9% advisory CVE-2026-24514 (also GHSA-2pf9-vr92-6h3v ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H fixed in 1.14.3 (also fixed in 1.13.7) epss 39.9% 39.9% percentile (epss 0.00478) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module) ▸ HIGH SUSE-SU-2026:23326-1 wget 0:1.25.0-160000.2.2 1.25.0-160000.3.1 28.4% elf-needed-closure advisory SUSE-SU-2026:23326-1 fixes CVE-2026-15146, CVE-2026-58469, CVE-2026-58470, CVE-2026-58471, CVE-2026-58472 from os severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H fixed in 1.25.0-160000.3.1 epss 28.4% 28.4% percentile (epss 0.00351) for CVE-2026-58469, highest of 5 purl pkg:rpm/sles/wget@0:1.25.0-160000.2.2?arch=x86_64 method elf-needed-closure [elf-needed-closure] wget installs 1 ELF object (/usr/bin/wget) and the closure reaches none of them, but this image cannot be closed over [elf-needed-closure] blocking /nginx-ingress-controller is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure] blocking /usr/bin/catatonit is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure] blocking /usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure] blocking /usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure] blocking /usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure] blocking /usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor] SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) ▸ LOW CVE-2026-24513 k8s.io/ingress-nginx (devel) /dbg 1.14.3 23.9% advisory CVE-2026-24513 (also GHSA-4g2f-xcph-2335 ) from golang severity LOW CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N fixed in 1.14.3 (also fixed in 1.13.7) epss 23.9% 23.9% percentile (epss 0.00312) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /dbg (stripped) packages k8s.io/ingress-nginx (module) ▸ LOW CVE-2026-24513 k8s.io/ingress-nginx (devel) /nginx-ingress-controller 1.14.3 23.9% advisory CVE-2026-24513 (also GHSA-4g2f-xcph-2335 ) from golang severity LOW CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N fixed in 1.14.3 (also fixed in 1.13.7) epss 23.9% 23.9% percentile (epss 0.00312) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /nginx-ingress-controller (stripped) packages k8s.io/ingress-nginx (module) ▸ LOW CVE-2026-24513 k8s.io/ingress-nginx (devel) /wait-shutdown 1.14.3 23.9% advisory CVE-2026-24513 (also GHSA-4g2f-xcph-2335 ) from golang severity LOW CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N fixed in 1.14.3 (also fixed in 1.13.7) epss 23.9% 23.9% percentile (epss 0.00312) purl pkg:golang/k8s.io%2Fingress-nginx@(devel) binary /wait-shutdown (stripped) packages k8s.io/ingress-nginx (module)
ALREADY VEXED(1) — a published statement answers these; vexscan's own verdict is unchanged Severity Advisory Package Version EPSS Vendor Reason ▸ HIGH SUSE-SU-2026:23303-1 python313-base 0:3.13.14-160000.1.1 53.0% not_affected vulnerable_code_not_in_execute_path advisory SUSE-SU-2026:23303-1 fixes CVE-2025-15366, CVE-2025-15367, CVE-2026-0864, CVE-2026-11940, CVE-2026-11972 (+3 more) from os severity HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N epss 53.0% 53.0% percentile (epss 0.00750) for CVE-2026-11940, highest of 8 purl pkg:rpm/sles/python313-base@0:3.13.14-160000.1.1?arch=x86_64 method elf-needed-closure [elf-needed-closure] /usr/lib64/python3.13/lib-dynload/_asyncio.cpython-313-x86_64-linux-gnu.so is Python extension module, loaded by import [elf-needed-closure] /usr/lib64/python3.13/lib-dynload/_bisect.cpython-313-x86_64-linux-gnu.so is Python extension module, loaded by import [elf-needed-closure] /usr/lib64/python3.13/lib-dynload/_blake2.cpython-313-x86_64-linux-gnu.so is Python extension module, loaded by import [elf-needed-closure] blocking /nginx-ingress-controller is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure] blocking /usr/bin/catatonit is statically linked, so the libraries it uses are inside it and not on disk [elf-needed-closure] blocking /usr/lib64/libcrypto.so.3.5.0 calls dlopen, so what it loads is decided at runtime [elf-needed-closure] blocking /usr/lib64/libpam.so.0.85.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure] blocking /usr/lib64/libselinux.so.1 calls dlopen, so what it loads is decided at runtime [elf-needed-closure] blocking /usr/lib64/python3.13/lib-dynload/_ctypes.cpython-313-x86_64-linux-gnu.so calls dlopen, so what it loads is decided at runtime [prefer-vendor] SUSE Security Team rates this HIGH, used instead of UNKNOWN (preferred vendor score) [vendor-vex] Rancher Security team published not_affected for pkg:oci/nginx-ingress-controller?repository_url=registry.rancher.com/rancher/nginx-ingress-controller (vulnerable_code_not_in_execute_path); statement names pkg:rpm/suse/python313-base; component is pkg:rpm/sles/python313-base@0:3.13.14-160000.1.1?arch=x86_64 Rancher Security team says not_affected (vulnerable_code_not_in_execute_path)
Python is not used at runtime in this container; it is an incidental SLES base-image dependency
product pkg:oci/nginx-ingress-controller?repository_url=registry.rancher.com/rancher/nginx-ingress-controller · published 2026-09-12T01:06:17Z · from https://github.com/rancher/vexhub
matched loosely: statement names pkg:rpm/suse/python313-base; component is pkg:rpm/sles/python313-base@0:3.13.14-160000.1.1?arch=x86_64
RULED OUT(1) — the vulnerable code is not present or cannot run Severity Advisory Package Version Location Fixed in EPSS Method ▸ MEDIUM CVE-2026-56858 stdlib 1.25.12 /usr/bin/container-suseconnect 1.25.13 23.6% pclntab advisory CVE-2026-56858 (also GO-2026-6091 ) from golang severity MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N fixed in 1.25.13 (also fixed in 1.26.6, 1.27.0-rc.3) epss 23.6% 23.6% percentile (epss 0.00310) purl pkg:golang/stdlib@1.25.12 binary /usr/bin/container-suseconnect (stripped) packages html/template (package) vex vulnerable_code_not_present [pclntab] [prefer-vendor] SUSE Security Team rates this MEDIUM, used instead of UNKNOWN (preferred vendor score)
Scan coverage# Ecosystem Components Affected Vexed Undetermined Ruled out Status golang86 57 0 0 1 ok os183 2 1 0 0 ok pypi0 0 0 0 0 ok
VEX hubs# Triage: scored 61, 0 known exploited. Feeds as of EPSS 2026-09-14; KEV 2026.09.14.