Live data · updated as images are scanned

Container image security, measured

What OCImend finds in popular public images: how many vulnerabilities, how severe, how many actually matter, and how many can be fixed today. Only scans made without credentials are counted.

• 24 of 35 popular container images OCImend tracks carry high or critical vulnerabilities right now.
• OCImend has measured 35 public container images; they carry 3,619 known vulnerabilities, 103 per image on average.
• 14% of those CVEs are in code the image's application actually loads; the rest sit in packages it never loads.
• 27% have a fixed package available today, and 0 are known to be actively exploited.
• The most vulnerable image measured is mcr.microsoft.com/oss/go/microsoft/golang with 569 known CVEs.
• Most common base systems: Debian (13), Alpine (7), Ubuntu (7), Red Hat (3).

Most vulnerable images

Based on the latest public scan of each image. Scans made with credentials are never included. Guides · All image reports · Scan an image