ghcr.io/docling-project/docling-serve-cpu:v1.30.0 linux/amd64

ghcr.io/docling-project/docling-serve-cpu:v1.30.0 - Trivy安全扫描结果扫描时间: 2026-08-20 10:29

全部漏洞信息

低危漏洞:5

中危漏洞:23

高危漏洞:6

严重漏洞:0

系统OS: centos-stream 9 扫描引擎: Trivy 扫描时间: 2026-08-20 10:29

Java (jar)

低危漏洞:0

中危漏洞:9

高危漏洞:4

严重漏洞:0

软件包	漏洞	安全状态	安装版本	修复版本	漏洞信息
com.fasterxml.jackson.core:jackson-core	GHSA-r7wm-3cxj-wff9	高危	2.18.6	2.18.8, 2.21.4	jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq) 漏洞详情: https://github.com/advisories/GHSA-r7wm-3cxj-wff9 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-07-21 21:58 修改: 2026-08-03 20:30
com.fasterxml.jackson.core:jackson-databind	CVE-2026-54512	高危	2.18.6	2.18.8, 3.1.4, 2.21.4	jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54512 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-23 21:17 修改: 2026-06-27 21:01
com.fasterxml.jackson.core:jackson-databind	CVE-2026-54513	高危	2.18.6	2.18.8, 2.21.4, 3.1.4	jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54513 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-23 21:17 修改: 2026-08-14 13:19
org.apache.httpcomponents.core5:httpcore5	CVE-2026-54399	高危	5.0.2	5.4.3, 5.5-beta2	org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54399 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-07-01 17:16 修改: 2026-07-24 20:04
com.fasterxml.jackson.core:jackson-databind	CVE-2026-54515	中危	2.18.6	3.1.4, 2.18.9, 2.21.5, 2.22.1	jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54515 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-23 21:17 修改: 2026-06-29 13:38
com.fasterxml.jackson.core:jackson-databind	CVE-2026-59888	中危	2.18.6	2.18.8, 2.21.4	com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59888 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-07-14 17:17 修改: 2026-07-15 20:18
com.fasterxml.jackson.core:jackson-databind	CVE-2026-59889	中危	2.18.6	2.21.5, 2.18.9, 2.22.1	jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59889 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-07-14 21:17 修改: 2026-07-16 16:19
com.fasterxml.jackson.core:jackson-databind	GHSA-mhm7-754m-9p8w	中危	2.18.6	2.18.9, 2.21.5	jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)` 漏洞详情: https://github.com/advisories/GHSA-mhm7-754m-9p8w 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-07-21 19:40 修改: 2026-07-21 19:40
com.fasterxml.jackson.core:jackson-databind	CVE-2026-54514	中危	2.18.6	2.18.8, 2.21.4, 3.1.4	jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54514 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-23 21:17 修改: 2026-06-27 20:55
org.apache.logging.log4j:log4j-api	CVE-2026-49844	中危	2.25.3	2.25.5, 2.26.1	org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-49844 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-07-10 22:16 修改: 2026-07-14 20:03
org.apache.logging.log4j:log4j-core	CVE-2026-34477	中危	2.25.3	2.25.4	org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-34477 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-04-10 16:16 修改: 2026-06-17 10:39
org.apache.logging.log4j:log4j-core	CVE-2026-34478	中危	2.25.3	2.25.4	org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-34478 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-04-10 16:16 修改: 2026-06-17 10:39
org.apache.logging.log4j:log4j-core	CVE-2026-34480	中危	2.25.3	2.25.4	org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-34480 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-04-10 16:16 修改: 2026-06-17 10:39

Node.js (node-pkg)

低危漏洞:0

中危漏洞:0

高危漏洞:0

严重漏洞:0

软件包	漏洞	安全状态	安装版本	修复版本	漏洞信息

Python (python-pkg)

低危漏洞:5

中危漏洞:14

高危漏洞:2

严重漏洞:0

软件包	漏洞	安全状态	安装版本	修复版本	漏洞信息
aiohttp	CVE-2026-69244	高危	3.13.5	3.14.3	aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-69244 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-08-03 21:16 修改: 2026-08-04 15:16
ray	CVE-2026-57516	高危	2.55.1	2.56.0	ray: Ray: Remote code execution via unsafe deserialization in WebDataset reader 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-57516 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-07-01 17:16 修改: 2026-07-14 22:17
aiohttp	CVE-2026-47265	中危	3.13.5	3.14.0	python-aiohttp: AIOHTTP: Information disclosure via improper handling of cookies during cross-origin redirects 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-47265 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-02 20:16 修改: 2026-07-21 19:10
aiohttp	CVE-2026-54273	中危	3.13.5	3.14.1	aiohttp: AIOHTTP: Denial of Service via excessive pipelined requests 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54273 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-22 18:16 修改: 2026-06-26 19:37
aiohttp	CVE-2026-54274	中危	3.13.5	3.14.1	aiohttp: aiohttp: Denial of Service via incomplete websocket frame payloads 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54274 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-22 18:16 修改: 2026-06-26 19:37
aiohttp	CVE-2026-54276	中危	3.13.5	3.14.1	aiohttp: aiohttp: Information disclosure via DigestAuthMiddleware after cross-origin redirect 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54276 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-22 18:16 修改: 2026-06-30 18:18
aiohttp	CVE-2026-54277	中危	3.13.5	3.14.1	aiohttp: aiohttp: Denial of Service via oversized HTTP request lines bypassing max_line_size check 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54277 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-22 18:16 修改: 2026-06-30 18:11
aiohttp	CVE-2026-54278	中危	3.13.5	3.14.1	aiohttp: aiohttp: Denial of Service due to excessive memory consumption from compressed request body 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54278 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-22 18:16 修改: 2026-06-26 19:27
aiohttp	CVE-2026-59881	中危	3.13.5	3.14.2	aiohttp: AIOHTTP: Denial of Service via unnegotiated WebSocket compression 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-59881 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-07-30 19:18 修改: 2026-07-30 20:03
aiohttp	CVE-2026-69243	中危	3.13.5	3.14.2	aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-69243 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-08-03 21:16 修改: 2026-08-05 16:17
idna	CVE-2026-45409	中危	3.11	3.15	python-idna: idna: Denial of Service via specially crafted long inputs 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-45409 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-05 23:16 修改: 2026-07-23 07:10
pip	CVE-2025-8869	中危	24.2	25.3	pip: pip missing checks on symbolic link extraction 漏洞详情: https://avd.aquasec.com/nvd/cve-2025-8869 镜像层: sha256:0c8f6052c6f24cd7565b60baea5f6ab70efa4b4a3ca903d8b50c72f52c90a003 发布日期: 2025-09-24 15:15 修改: 2026-06-17 10:07
pip	CVE-2026-3219	中危	24.2	26.1	pip: pip: Incorrect file installation due to improper archive handling 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-3219 镜像层: sha256:0c8f6052c6f24cd7565b60baea5f6ab70efa4b4a3ca903d8b50c72f52c90a003 发布日期: 2026-04-20 16:16 修改: 2026-06-17 10:43
pip	CVE-2026-6357	中危	24.2	26.1	pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-6357 镜像层: sha256:0c8f6052c6f24cd7565b60baea5f6ab70efa4b4a3ca903d8b50c72f52c90a003 发布日期: 2026-04-27 15:16 修改: 2026-06-17 11:00
pip	CVE-2026-8643	中危	24.2	26.1.2	python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-8643 镜像层: sha256:0c8f6052c6f24cd7565b60baea5f6ab70efa4b4a3ca903d8b50c72f52c90a003 发布日期: 2026-06-01 17:17 修改: 2026-08-18 12:19
aiohttp	CVE-2026-34993	中危	3.13.5	3.14.0	aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-34993 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-02 20:16 修改: 2026-08-14 13:18
aiohttp	CVE-2026-54279	低危	3.13.5	3.14.1	aiohttp: AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54279 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-22 18:16 修改: 2026-06-26 19:36
aiohttp	CVE-2026-54280	低危	3.13.5	3.14.1	AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ... 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54280 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-22 18:16 修改: 2026-06-26 19:35
aiohttp	CVE-2026-50269	低危	3.13.5	3.14.0	aiohttp: AIOHTTP: CRLF injection in multipart headers 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-50269 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-22 18:16 修改: 2026-06-26 19:39
pip	CVE-2026-1703	低危	24.2	26.0	pip: pip: Information disclosure via path traversal when installing crafted wheel archives 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-1703 镜像层: sha256:0c8f6052c6f24cd7565b60baea5f6ab70efa4b4a3ca903d8b50c72f52c90a003 发布日期: 2026-02-02 15:16 修改: 2026-06-17 10:16
aiohttp	CVE-2026-54275	低危	3.13.5	3.14.1	aiohttp: AIOHTTP: TLS SNI check bypass via connection reuse 漏洞详情: https://avd.aquasec.com/nvd/cve-2026-54275 镜像层: sha256:fce4b53f1133b9d9a87f7ee7d9ec3c436d2e096fe8b4d7a3c34047dbd8421dd0 发布日期: 2026-06-22 18:16 修改: 2026-06-26 19:36

/opt/app-root/lib/python3.12/site-packages/skimage/data/_fetchers.py ()

低危漏洞:0

中危漏洞:0

高危漏洞:0

严重漏洞:0

软件包	漏洞	安全状态	安装版本	修复版本	漏洞信息