This page tracks CVEs that cannot be fixed locally — they require upstream image maintainers to rebuild.
Status: Waiting for upstream rebuild
Fix available: libgnutls30t64 3.8.9-3+deb13u4 (Debian)
Affected images: defectdojo-django, wikijs, roundcube, forgejo
Action when fixed: docker pull <image>:latest then swap container
Last checked: 2026-05-24
Status: Waiting for upstream rebuild
Fix available: Go stdlib 1.24.13+
Affected images: All Alpine-based images
Risk: Low — gosu only runs at container entrypoint, not used for TLS
Last checked: 2026-05-24
Status: Fix available (bind9 1:9.20.23-1~deb13u1) but defectdojo needs rebuild
Affected images: defectdojo/defectdojo-django:latest
Last checked: 2026-05-24
Weekly Trivy scans run every Sunday at 3am. Results feed the Security Dashboard at security.veripath.co.uk/dashboard/
To check if an upstream fix has landed:
docker pull <image>:latest
trivy image <image>:latest --severity CRITICAL --no-progress
If criticals drop, run the standard container swap procedure.