apache/airflow:3.4.0rc2-python3.12

by apache ← project: Airflow

RODEO

score 0

Pull →

Rebuilt 13d ago46 critical CVEs2 archsNon-rootOCI labels

docker pull apache/airflow:3.4.0rc2-python3.12

Image metadata

PULL COUNT

1.7B

repository-level (not per-tag)

SIZE (COMPRESSED)

662 MB

ARCHITECTURES

RUNS AS

non-root

image config.User

LAST PUSHED

13d ago

2026-10-31 20:46:50

MANIFEST DIGEST

sha256:31237368f9e6…

from registry manifest

Latest scan

2026-11-05 05:28:45 UTC · 9d ago

OPEN CVES BY SEVERITY

CRITICAL

251

HIGH

154

MEDIUM

LOW/NEG

Grype DB 2026-11-04T06:20:59.000Z · rubric cerodeo-v2

RUBRIC BREAKDOWN (9 signals that moved the score)

-90 · High CVEs (fixable) -51 · Medium CVEs (fixable) -368 · Critical CVEs (no fix) -891 · High CVEs (no fix) -316 · medium_unfixable +10 · Runs as non-root +10 · Rebuilt in last 90 days +3 · OCI standard labels (≥4) +2 · Multi-arch

Raw data

Every signal above decomposes to arithmetic from inputs you can verify. Nothing in these downloads is derived or massaged — they're the raw grype matches and the raw snapshot history exactly as our scanner wrote them.

Latest scan JSON (CVE matches) Syft SBOM JSON (feeds grype) Full scan history JSON (6 snapshots)

Reproduce this score yourself

We don't use judgement to score — every signal is deterministic from the image, the manifest, and a pinned CVE DB. Run the script below on any host with skopeo, syft, grype, cosign, and jq installed — it fetches the versioned rubric spec, computes the same breakdown, and prints the same grade. Pin the Grype DB with --grype-db to reproduce bit-for-bit identical results.

curl -fsSLO https://ce.rodeo/verify-score.sh && chmod +x verify-score.sh
./verify-score.sh apache/airflow:3.4.0rc2-python3.12 \
  --rubric cerodeo-v2 \
  --grype-db 2026-11-04T06:20:59.000Z

verify-score.sh rubric spec (cerodeo-v2.json)

All open CVEs (500)

sorted by severity, then CVSS score

CVE ID SEV CVSS PACKAGE FIX

CVE-2026-85746 CRITICAL 9.9 mariadb-client 1:11.8.9+maria~deb13 no fix available

CVE-2026-85746 CRITICAL 9.9 libmariadb3 1:11.8.9+maria~deb13 no fix available

CVE-2026-85746 CRITICAL 9.9 libmariadb3-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-85746 CRITICAL 9.9 mysql-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-85746 CRITICAL 9.9 mariadb-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-85746 CRITICAL 9.9 mariadb-client-core 1:11.8.9+maria~deb13 no fix available

CVE-2026-85746 CRITICAL 9.9 mariadb-client-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-92262 CRITICAL 9.9 mysql-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-92262 CRITICAL 9.9 libmariadb3 1:11.8.9+maria~deb13 no fix available

CVE-2026-92262 CRITICAL 9.9 libmariadb3-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-92262 CRITICAL 9.9 mariadb-client 1:11.8.9+maria~deb13 no fix available

CVE-2026-92262 CRITICAL 9.9 mariadb-client-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-92262 CRITICAL 9.9 mariadb-client-core 1:11.8.9+maria~deb13 no fix available

CVE-2026-92262 CRITICAL 9.9 mariadb-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-10536 CRITICAL 9.8 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-10536 CRITICAL 9.8 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-11856 CRITICAL 9.8 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-11856 CRITICAL 9.8 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-19931 CRITICAL 9.8 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-19931 CRITICAL 9.8 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-49261 CRITICAL 9.8 mariadb-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-49261 CRITICAL 9.8 libmariadb3 1:11.8.9+maria~deb13 no fix available

CVE-2026-49261 CRITICAL 9.8 libmariadb3-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-49261 CRITICAL 9.8 mariadb-client 1:11.8.9+maria~deb13 no fix available

CVE-2026-49261 CRITICAL 9.8 mariadb-client-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-49261 CRITICAL 9.8 mariadb-client-core 1:11.8.9+maria~deb13 no fix available

CVE-2026-49261 CRITICAL 9.8 mysql-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-6653 CRITICAL 9.8 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3+dhi3 no fix available

CVE-2026-9079 CRITICAL 9.8 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-9079 CRITICAL 9.8 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-60002 CRITICAL 9.4 openssh-client 1:10.0p1-7+deb13u4+dhi1 no fix available

CVE-2026-18924 CRITICAL 9.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-18924 CRITICAL 9.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-44172 CRITICAL 9.1 mariadb-client 1:11.8.9+maria~deb13 no fix available

CVE-2026-44172 CRITICAL 9.1 mariadb-client-core 1:11.8.9+maria~deb13 no fix available

CVE-2026-44172 CRITICAL 9.1 libmariadb3 1:11.8.9+maria~deb13 no fix available

CVE-2026-44172 CRITICAL 9.1 libmariadb3-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-44172 CRITICAL 9.1 mariadb-client-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-44172 CRITICAL 9.1 mysql-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-44172 CRITICAL 9.1 mariadb-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-86414 CRITICAL 9.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-86414 CRITICAL 9.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-8926 CRITICAL 9.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-8926 CRITICAL 9.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-92388 CRITICAL 9.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-92388 CRITICAL 9.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-97380 HIGH 8.8 mariadb-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-97380 HIGH 8.8 mariadb-client-core 1:11.8.9+maria~deb13 no fix available

CVE-2026-97380 HIGH 8.8 mysql-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-97380 HIGH 8.8 mariadb-client-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-97380 HIGH 8.8 mariadb-client 1:11.8.9+maria~deb13 no fix available

CVE-2026-97380 HIGH 8.8 libmariadb3-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-97380 HIGH 8.8 libmariadb3 1:11.8.9+maria~deb13 no fix available

CVE-2026-115506 HIGH 8.7 libexpat1-dev 2.9.0-1~deb13u1+dhi1 no fix available

CVE-2026-115506 HIGH 8.7 libexpat1 2.9.0-1~deb13u1+dhi1 no fix available

CVE-2026-58469 HIGH 8.7 wget 1.25.0-2+dhi2 no fix available

CVE-2026-107815 HIGH 8.5 mariadb-client-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-107815 HIGH 8.5 mysql-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-107815 HIGH 8.5 mariadb-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-107815 HIGH 8.5 mariadb-client-core 1:11.8.9+maria~deb13 no fix available

CVE-2026-107815 HIGH 8.5 libmariadb3-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-107815 HIGH 8.5 mariadb-client 1:11.8.9+maria~deb13 no fix available

CVE-2026-107815 HIGH 8.5 libmariadb3 1:11.8.9+maria~deb13 no fix available

CVE-2026-74860 HIGH 8.5 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3+dhi3 no fix available

CVE-2026-76642 HIGH 8.5 libblkid1 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-76642 HIGH 8.5 util-linux 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-76642 HIGH 8.5 libblkid1 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-76642 HIGH 8.5 liblastlog2-2 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-76642 HIGH 8.5 libmount1 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-76642 HIGH 8.5 libsmartcols1 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-76642 HIGH 8.5 libuuid1 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-76642 HIGH 8.5 util-linux 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-76642 HIGH 8.5 libsmartcols1 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-76642 HIGH 8.5 libuuid1 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-107818 HIGH 8.4 mariadb-client-core 1:11.8.9+maria~deb13 no fix available

CVE-2026-107818 HIGH 8.4 mariadb-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-107818 HIGH 8.4 mariadb-client 1:11.8.9+maria~deb13 no fix available

CVE-2026-107818 HIGH 8.4 mysql-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-107818 HIGH 8.4 mariadb-client-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-107818 HIGH 8.4 libmariadb3 1:11.8.9+maria~deb13 no fix available

CVE-2026-107818 HIGH 8.4 libmariadb3-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-85091 HIGH 8.3 zlib1g-dev 1:1.3.dfsg+really1.3.1-1+deb13u0+dhi4 no fix available

CVE-2026-85091 HIGH 8.3 zlib1g 1:1.3.dfsg+really1.3.1-1+deb13u0+dhi4 no fix available

CVE-2026-85091 HIGH 8.3 zlib1g-dev 1:1.3.dfsg+really1.3.1-1+deb13u0+dhi4 no fix available

CVE-2026-118370 HIGH 8.2 libexpat1-dev 2.9.0-1~deb13u1+dhi1 no fix available

CVE-2026-118370 HIGH 8.2 libexpat1 2.9.0-1~deb13u1+dhi1 no fix available

CVE-2026-118370 HIGH 8.2 libexpat1-dev 2.9.0-1~deb13u1+dhi1 no fix available

CVE-2026-82209 HIGH 8.2 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-82209 HIGH 8.2 curl 8.14.1-2+deb13u7+dhi0 no fix available

GHSA-5wr8-gcqf-gqf3 HIGH 8.2 aiohttp 3.14.3 fixed in 3.14.4

GHSA-9xw5-w5jj-pvcg HIGH 8.2 aiohttp 3.14.3 fixed in 3.14.4

CVE-2026-107928 HIGH 8.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-107928 HIGH 8.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-107929 HIGH 8.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-107929 HIGH 8.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-86409 HIGH 8.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-86409 HIGH 8.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-86410 HIGH 8.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-86410 HIGH 8.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-87862 HIGH 8.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-87862 HIGH 8.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-87863 HIGH 8.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-87863 HIGH 8.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-87864 HIGH 8.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-87864 HIGH 8.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-92386 HIGH 8.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-92386 HIGH 8.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-92387 HIGH 8.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-92387 HIGH 8.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-92389 HIGH 8.1 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-92389 HIGH 8.1 curl 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-107821 HIGH 8.0 mariadb-client 1:11.8.9+maria~deb13 no fix available

CVE-2026-107821 HIGH 8.0 libmariadb3 1:11.8.9+maria~deb13 no fix available

CVE-2026-107821 HIGH 8.0 mariadb-client-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-107821 HIGH 8.0 mariadb-client-core 1:11.8.9+maria~deb13 no fix available

CVE-2026-107821 HIGH 8.0 mariadb-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-107821 HIGH 8.0 mysql-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-107821 HIGH 8.0 libmariadb3-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-44168 HIGH 8.0 mariadb-client-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-44168 HIGH 8.0 libmariadb3 1:11.8.9+maria~deb13 no fix available

CVE-2026-44168 HIGH 8.0 libmariadb3-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-44168 HIGH 8.0 mariadb-client 1:11.8.9+maria~deb13 no fix available

CVE-2026-44168 HIGH 8.0 mariadb-client-core 1:11.8.9+maria~deb13 no fix available

CVE-2026-44168 HIGH 8.0 mariadb-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-44168 HIGH 8.0 mysql-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-78408 HIGH 7.9 libmount1 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-78408 HIGH 7.9 liblastlog2-2 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-78408 HIGH 7.9 libblkid1 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-78408 HIGH 7.9 util-linux 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-78408 HIGH 7.9 libuuid1 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2026-78408 HIGH 7.9 libsmartcols1 2.41.5-0+deb13u1+dhi3 no fix available

CVE-2025-69720 HIGH 7.8 libncursesw6 6.5+20250216-2+deb13u0+dhi5 no fix available

CVE-2025-69720 HIGH 7.8 ncurses-bin 6.5+20250216-2+deb13u0+dhi5 no fix available

CVE-2025-69720 HIGH 7.8 ncurses-base 6.5+20250216-2+deb13u0+dhi5 no fix available

CVE-2025-69720 HIGH 7.8 libncursesw6 6.5+20250216-2+deb13u0+dhi5 no fix available

CVE-2025-69720 HIGH 7.8 libtinfo6 6.5+20250216-2+deb13u0+dhi5 no fix available

CVE-2025-69720 HIGH 7.8 libncurses6 6.5+20250216-2+deb13u0+dhi5 no fix available

CVE-2025-69720 HIGH 7.8 ncurses-base 6.5+20250216-2+deb13u0+dhi5 no fix available

CVE-2026-24882 HIGH 7.8 gpgsm 2.4.7-21+deb13u1+dhi4 no fix available

CVE-2026-24882 HIGH 7.8 gpg-agent 2.4.7-21+deb13u1+dhi4 no fix available

CVE-2026-24882 HIGH 7.8 gpg 2.4.7-21+deb13u1+dhi4 no fix available

CVE-2026-24882 HIGH 7.8 gnupg2 2.4.7-21+deb13u1 no fix available

CVE-2026-24882 HIGH 7.8 gnupg-l10n 2.4.7-21+deb13u1 no fix available

CVE-2026-24882 HIGH 7.8 dirmngr 2.4.7-21+deb13u1+dhi4 no fix available

CVE-2026-24882 HIGH 7.8 gnupg 2.4.7-21+deb13u1 no fix available

CVE-2026-24882 HIGH 7.8 gpgconf 2.4.7-21+deb13u1+dhi4 no fix available

CVE-2026-24882 HIGH 7.8 gpgv 2.4.7-21+deb13u1+dhi4 no fix available

CVE-2026-96512 HIGH 7.8 sudo 1.9.16p2-3+deb13u2+dhi3 no fix available

CVE-2026-19499 HIGH 7.7 libc6-dev 2.41-12+deb13u4+dhi1 no fix available

CVE-2026-19499 HIGH 7.7 libc-bin 2.41-12+deb13u4+dhi1 no fix available

CVE-2026-19499 HIGH 7.7 libc-dev-bin 2.41-12+deb13u4+dhi1 no fix available

CVE-2026-19499 HIGH 7.7 libc-l10n 2.41-12+deb13u4+dhi1 no fix available

CVE-2026-19499 HIGH 7.7 libc6 2.41-12+deb13u4+dhi1 no fix available

CVE-2026-19499 HIGH 7.7 libc6-dev 2.41-12+deb13u4+dhi1 no fix available

CVE-2026-19499 HIGH 7.7 locales 2.41-12+deb13u4+dhi1 no fix available

CVE-2026-86047 HIGH 7.7 mariadb-client-core 1:11.8.9+maria~deb13 no fix available

CVE-2026-86047 HIGH 7.7 mariadb-client-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-86047 HIGH 7.7 mariadb-client 1:11.8.9+maria~deb13 no fix available

CVE-2026-86047 HIGH 7.7 libmariadb3-compat 1:11.8.9+maria~deb13 no fix available

CVE-2026-86047 HIGH 7.7 libmariadb3 1:11.8.9+maria~deb13 no fix available

CVE-2026-86047 HIGH 7.7 mariadb-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-86047 HIGH 7.7 mysql-common 1:11.8.9+maria~deb13 no fix available

CVE-2026-95619 HIGH 7.7 libstdc++6 14.2.0-19+dhi5 no fix available

CVE-2026-95619 HIGH 7.7 libgcc-s1 14.2.0-19+dhi5 no fix available

CVE-2026-95619 HIGH 7.7 gcc-14-base 14.2.0-19+dhi5 no fix available

CVE-2026-95619 HIGH 7.7 libgcc-s1 14.2.0-19+dhi5 no fix available

CVE-2026-95619 HIGH 7.7 gcc-14-base 14.2.0-19+dhi5 no fix available

CVE-2026-107161 HIGH 7.5 sasl2-bin 2.1.28+dfsg1-9+dhi1 no fix available

CVE-2026-107161 HIGH 7.5 libsasl2-modules-db 2.1.28+dfsg1-9+dhi1 no fix available

CVE-2026-107161 HIGH 7.5 libsasl2-modules 2.1.28+dfsg1-9+dhi1 no fix available

CVE-2026-107161 HIGH 7.5 libsasl2-2 2.1.28+dfsg1-9+dhi1 no fix available

CVE-2026-113351 HIGH 7.5 libexpat1 2.9.0-1~deb13u1+dhi1 no fix available

CVE-2026-113351 HIGH 7.5 libexpat1-dev 2.9.0-1~deb13u1+dhi1 no fix available

CVE-2026-113351 HIGH 7.5 libexpat1 2.9.0-1~deb13u1+dhi1 no fix available

CVE-2026-117610 HIGH 7.5 libexpat1 2.9.0-1~deb13u1+dhi1 no fix available

CVE-2026-117610 HIGH 7.5 libexpat1-dev 2.9.0-1~deb13u1+dhi1 no fix available

CVE-2026-12064 HIGH 7.5 libcurl4t64 8.14.1-2+deb13u7+dhi0 no fix available

CVE-2026-12064 HIGH 7.5 curl 8.14.1-2+deb13u7+dhi0 no fix available

+ 300 more in the raw JSON

Scan history

6 total · first 13d ago

SCANNED AT GRADE SCORE CRIT HIGH MED GRYPE DB

9d ago F 0 46 306 333 2026-11-04T06:20:59.000Z

10d ago F 0 46 306 333 2026-11-04T06:20:59.000Z

10d ago F 0 46 306 333 2026-11-03T06:20:47.000Z

11d ago F 0 46 298 341 2026-11-02T06:26:52.000Z · (same SBOM)

12d ago F 0 46 298 341 2026-11-02T06:26:52.000Z

13d ago F 0 46 289 305 2026-10-31T06:18:17.000Z

Discussion

Mark as review

No comments yet. Be the first.