6 critical · 28 high · 11 medium · 1 low · 47 total (deduped by CVE) · 14 reviewed not-affected
Image datagrok/jkg_python:1.1.1 · digest sha256:4e19c8793eafb7a1db78dc55d86cdba34aabcda5bee8ed3288a78ec5a407df07
OpenVEX status affected (an upstream fix exists — the action is to
apply it) or under_investigation (no upstream fix is available yet; a version match
alone does not establish exploitability).
| Vulnerability | Status | Severity | Package | Installed | Fixed in | CVSS | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-18924 | affected | CRITICAL | curl | 8.21.0-r0 | 8.22.0-r0 | 9.1 | CVE-2026-18924 |
| CVE-2026-19931 | affected | CRITICAL | curl | 8.21.0-r0 | 8.22.0-r0 | 9.8 | CVE-2026-19931 |
| CVE-2026-63073 | affected | CRITICAL | openssl | 3.5.7-r0 | 3.5.8-r0 | 9.8 | CVE-2026-63073 |
| CVE-2026-75803 | affected | CRITICAL | openssl | 3.5.7-r0 | 3.5.8-r0 | 9.1 | CVE-2026-75803 |
| CVE-2026-79657 | affected | CRITICAL | nltk | 3.10.2 | 3.10.3 | 9.3 | CVE-2026-79657 |
| CVE-2026-79675 | affected | CRITICAL | nltk | 3.10.2 | 3.10.3 | 9.3 | CVE-2026-79675 |
| CVE-2026-13608 | affected | HIGH | curl | 8.21.0-r0 | 8.22.0-r0 | 7.4 | CVE-2026-13608 |
| CVE-2026-14456 | affected | HIGH | openssl | 3.5.7-r0 | 3.5.8-r0 | 7.5 | CVE-2026-14456 |
| CVE-2026-14457 | affected | HIGH | openssl | 3.5.7-r0 | 3.5.8-r0 | 7.5 | CVE-2026-14457 |
| CVE-2026-18798 | affected | HIGH | openssl | 3.5.7-r0 | 3.5.8-r0 | 7.5 | CVE-2026-18798 |
| CVE-2026-54284 | affected | HIGH | sqlparse | 0.5.5 | 0.6 | 8.7 | CVE-2026-54284 |
| CVE-2026-54874 | affected | HIGH | openssl | 3.5.7-r0 | 3.5.8-r0 | 7.5 | CVE-2026-54874 |
| CVE-2026-59893 | affected | HIGH | sqlparse | 0.5.5 | 0.6 | 7.5 | CVE-2026-59893 |
| CVE-2026-63072 | affected | HIGH | openssl | 3.5.7-r0 | 3.5.8-r0 | 7.5 | CVE-2026-63072 |
| CVE-2026-63075 | affected | HIGH | openssl | 3.5.7-r0 | 3.5.8-r0 | 7.5 | CVE-2026-63075 |
| CVE-2026-63076 | affected | HIGH | openssl | 3.5.7-r0 | 3.5.8-r0 | 7.5 | CVE-2026-63076 |
| CVE-2026-69247 | affected | HIGH | cryptography | 48.0.1 | 50 | 8.2 | CVE-2026-69247 |
| CVE-2026-69249 | affected | HIGH | cryptography | 48.0.1 | 49 | 8.7 | CVE-2026-69249 |
| CVE-2026-71211 | under_investigation | HIGH | mlflow | 3.15.1 | — | CVE-2026-71211 | |
| CVE-2026-71491 | affected | HIGH | sqlparse | 0.5.5 | 0.6 | 8.7 | CVE-2026-71491 |
| CVE-2026-71513 | affected | HIGH | nltk | 3.10.2 | 3.10.3 | 8.7 | CVE-2026-71513 |
| CVE-2026-78680 | affected | HIGH | nltk | 3.10.2 | 3.10.3 | 8.5 | CVE-2026-78680 |
| CVE-2026-78681 | affected | HIGH | nltk | 3.10.2 | 3.10.3 | 8.7 | CVE-2026-78681 |
| CVE-2026-78682 | affected | HIGH | nltk | 3.10.2 | 3.10.3 | 8.7 | CVE-2026-78682 |
| CVE-2026-79674 | affected | HIGH | nltk | 3.10.2 | 3.10.3 | 8.8 | CVE-2026-79674 |
| CVE-2026-79676 | affected | HIGH | nltk | 3.10.2 | 3.10.3 | 8.2 | CVE-2026-79676 |
| CVE-2026-80206 | affected | HIGH | nltk | 3.10.2 | 3.10.3 | 8.2 | CVE-2026-80206 |
| CVE-2026-80229 | affected | HIGH | curl | 8.21.0-r0 | 8.22.0-r0 | 7.5 | CVE-2026-80229 |
| CVE-2026-80230 | affected | HIGH | curl | 8.21.0-r0 | 8.22.0-r0 | 7.5 | CVE-2026-80230 |
| CVE-2026-80231 | affected | HIGH | curl | 8.21.0-r0 | 8.22.0-r0 | 7.5 | CVE-2026-80231 |
| CVE-2026-80255 | affected | HIGH | curl | 8.21.0-r0 | 8.22.0-r0 | 7.5 | CVE-2026-80255 |
| CVE-2026-81726 | under_investigation | HIGH | nltk | 3.10.2 | — | 8.3 | CVE-2026-81726 |
| CVE-2026-82208 | affected | HIGH | curl | 8.21.0-r0 | 8.22.0-r0 | 7.5 | CVE-2026-82208 |
| CVE-2026-82209 | affected | HIGH | curl | 8.21.0-r0 | 8.22.0-r0 | 8.2 | CVE-2026-82209 |
| CVE-2026-12570 | affected | MEDIUM | keras | 2.15 | 3.15 | CVE-2026-12570 | |
| CVE-2026-12876 | affected | MEDIUM | nltk | 3.10.2 | 3.10.3 | CVE-2026-12876 | |
| CVE-2026-59894 | affected | MEDIUM | sqlparse | 0.5.5 | 0.6 | 6.2 | CVE-2026-59894 |
| CVE-2026-63074 | affected | MEDIUM | openssl | 3.5.7-r0 | 3.5.8-r0 | 5.9 | CVE-2026-63074 |
| CVE-2026-69248 | affected | MEDIUM | cryptography | 48.0.1 | 49 | 6.9 | CVE-2026-69248 |
| CVE-2026-81722 | affected | MEDIUM | nltk | 3.10.2 | 3.10.3 | 8.7 | CVE-2026-81722 |
| CVE-2026-81723 | affected | MEDIUM | nltk | 3.10.2 | 3.10.3 | 6.3 | CVE-2026-81723 |
| CVE-2026-81724 | affected | MEDIUM | nltk | 3.10.2 | 3.10.3 | 6.9 | CVE-2026-81724 |
| CVE-2026-81725 | affected | MEDIUM | nltk | 3.10.2 | 3.10.3 | 6.3 | CVE-2026-81725 |
| CVE-2026-81727 | affected | MEDIUM | nltk | 3.10.2 | 3.10.3 | 6.9 | CVE-2026-81727 |
| CVE-2026-84305 | affected | MEDIUM | sqlparse | 0.5.5 | 0.6 | 5.1 | CVE-2026-84305 |
| CVE-2026-71514 | affected | LOW | nltk | 3.10.2 | 3.10.3 | 3.3 | CVE-2026-71514 |
| CVE-2026-80256 | affected | UNKNOWN | curl | 8.21.0-r0 | 8.22.0-r0 | CVE-2026-80256 |
Manually reviewed findings with OpenVEX status not_affected. Each row
carries the spec justification label and the evidence for why the vulnerable code does not affect
this image's functionality (and where that was verified). Excluded from the severity counts above;
present as full statements in the OpenVEX document.
| Vulnerability | Severity | Package | Installed | Justification | Evidence / where |
|---|---|---|---|---|---|
| CVE-2025-3000 | LOW | torch | 2.10 | vulnerable_code_cannot_be_controlled_by_adversary | torch: memory corruption in torch.jit.script (GHSA-rrmf-rvhw-rf47), patched in 2.13.0. The kernel is held at 2.10 because every conda-forge pytorch from 2.11 up declares 'setuptools <82', which cannot coexist with the setuptools>=83 floor that closes CVE-2026-59890 (MEDIUM 6.1) — the two are mutually exclusive on conda-forge, and this one is LOW (CVSS4 1.9) and local-only. Triggering it means running crafted code through torch.jit.script inside a kernel whose script author already executes arbitrary code in that process by design — same rationale as CVE-2024-55459. Drop this entry and raise the floor once pytorch lifts the setuptools cap. Verified 2026-08-25. |
| CVE-2024-55459 | MEDIUM | keras | 2.15 | vulnerable_code_cannot_be_controlled_by_adversary | keras 2.15 is the last Keras-2 release; every fix for this advisory is Keras-3-only, and the kernel keeps Keras 2 while efficientnet and tf.keras (Keras-2 API) user scripts depend on it. Exploitation requires the kernel to load an attacker-supplied model/config file — in this image the only actor able to do that is the script author, who already executes arbitrary code in the same kernel process by design (server-side scripting), so no privilege boundary is crossed. |
| CVE-2025-12058 | MEDIUM | keras | 2.15 | vulnerable_code_cannot_be_controlled_by_adversary | Keras-3-only fix; Keras 2 kept for efficientnet / tf.keras user scripts. Requires loading an attacker-supplied model into a kernel whose script author already executes arbitrary code by design — same rationale as CVE-2024-55459. |
| CVE-2025-12060 | HIGH | keras | 2.15 | vulnerable_code_cannot_be_controlled_by_adversary | Keras-3-only fix; Keras 2 kept for efficientnet / tf.keras user scripts. Requires loading an attacker-supplied model into a kernel whose script author already executes arbitrary code by design — same rationale as CVE-2024-55459. |
| CVE-2025-9906 | HIGH | keras | 2.15 | vulnerable_code_cannot_be_controlled_by_adversary | Keras-3-only fix; Keras 2 kept for efficientnet / tf.keras user scripts. Requires loading an attacker-supplied model into a kernel whose script author already executes arbitrary code by design — same rationale as CVE-2024-55459. |
| CVE-2026-11816 | HIGH | keras | 2.15 | vulnerable_code_cannot_be_controlled_by_adversary | Keras-3-only fix; Keras 2 kept for efficientnet / tf.keras user scripts. Requires loading an attacker-supplied model into a kernel whose script author already executes arbitrary code by design — same rationale as CVE-2024-55459. |
| CVE-2026-12479 | MEDIUM | keras | 2.15 | vulnerable_code_cannot_be_controlled_by_adversary | Keras-3-only fix; Keras 2 kept for efficientnet / tf.keras user scripts. Requires loading an attacker-supplied model into a kernel whose script author already executes arbitrary code by design — same rationale as CVE-2024-55459. |
| CVE-2026-12480 | MEDIUM | keras | 2.15 | vulnerable_code_cannot_be_controlled_by_adversary | Keras-3-only fix; Keras 2 kept for efficientnet / tf.keras user scripts. Requires loading an attacker-supplied model into a kernel whose script author already executes arbitrary code by design — same rationale as CVE-2024-55459. |
| CVE-2026-12481 | HIGH | keras | 2.15 | vulnerable_code_cannot_be_controlled_by_adversary | Keras-3-only fix; Keras 2 kept for efficientnet / tf.keras user scripts. Requires loading an attacker-supplied model into a kernel whose script author already executes arbitrary code by design — same rationale as CVE-2024-55459. |
| CVE-2026-12482 | LOW | keras | 2.15 | vulnerable_code_cannot_be_controlled_by_adversary | Keras-3-only fix; Keras 2 kept for efficientnet / tf.keras user scripts. Requires loading an attacker-supplied model into a kernel whose script author already executes arbitrary code by design — same rationale as CVE-2024-55459. |
| CVE-2026-12484 | HIGH | keras | 2.15 | vulnerable_code_cannot_be_controlled_by_adversary | Keras-3-only fix; Keras 2 kept for efficientnet / tf.keras user scripts. Requires loading an attacker-supplied model into a kernel whose script author already executes arbitrary code by design — same rationale as CVE-2024-55459. |
| CVE-2026-1462 | HIGH | keras | 2.15 | vulnerable_code_cannot_be_controlled_by_adversary | Keras-3-only fix; Keras 2 kept for efficientnet / tf.keras user scripts. Requires loading an attacker-supplied model into a kernel whose script author already executes arbitrary code by design — same rationale as CVE-2024-55459. |
| CVE-2026-9335 | MEDIUM | keras | 2.15 | vulnerable_code_cannot_be_controlled_by_adversary | Keras-3-only fix; Keras 2 kept for efficientnet / tf.keras user scripts. Requires loading an attacker-supplied model into a kernel whose script author already executes arbitrary code by design — same rationale as CVE-2024-55459. |
| CVE-2026-0994 | HIGH | protobuf | 4.25.9 | vulnerable_code_cannot_be_controlled_by_adversary | python-protobuf is capped <5 by tensorflow 2.15 (kept for the Keras-2 API). The parse-time resource exhaustion can only be triggered by input the script author feeds their own kernel process, which they can already terminate directly; no other principal parses protobuf here. |