library/sonarqube:8.9.2-community container image

Docker Hub

Scanned 14 Sept 2026

Deployed by 1 of 17,781 indexed charts (latest versions) at this tag.Docker Hub all tags of library/sonarqube

library/sonarqube:8.9.2-community resolved to 88cd63154d4b, scanned 14 Sept 2026: 162 findings, 6 critical, 2 on KEV; deployed by 1 chart, among them sonarqube-lts.

Radar Score

3,503667971

162 findings on digest 88cd63154d4b · scanned 14 Sept 2026

KEV ×2 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Digests

1 digest

Tag	Digest	Used by	Last seen	Vulnerabilities	Radar Score
8.9.2-communityresolves to	88cd63154d4b	1 chart	8 days ago	667971	3,503

Digests this tag resolved to in indexed charts’ default renders. A tag can move; the digest is what was scanned.

Medium findings

79 distinct on this digest

Medium: findings whose contribution to the Radar Score is 15–39. Show every band

Findings for digest 88cd63154d4b as scanned on 14 Sept 2026 with syft 1.42.1 for linux/amd64, advisories as of 14 Sept 2026. Other architectures may differ.

Severity	Advisory	Package	Fixed in
Medium	GHSA-4jrv-ppp4-jm57	gson@2.7	2.8.9
Medium	GHSA-mc84-pj99-q6hh	commons-compress@1.20	1.21
Medium	GHSA-3f7h-mf4q-vrm4	woodstox-core@5.2.0	5.4.0
Medium	GHSA-crv7-7245-f45f	commons-compress@1.20	1.21
Medium	GHSA-7hfm-57qf-j43q	commons-compress@1.20	1.21
Medium	GHSA-24rp-q3w6-vc56	postgresql@42.2.19	42.2.28
Medium	ALPINE-CVE-2022-25235	expat@2.2.9-r1	2.2.10-r2
Medium	ALPINE-CVE-2022-22822	expat@2.2.9-r1	2.2.10-r0
Medium	ALPINE-CVE-2022-25315	expat@2.2.9-r1	2.2.10-r2
Medium	GHSA-xqfj-vm6h-2x34	commons-compress@1.20	1.21
Medium	ALPINE-CVE-2022-23852	expat@2.2.9-r1	2.2.10-r1
Medium	ALPINE-CVE-2022-22823	expat@2.2.9-r1	2.2.10-r0
Medium	ALPINE-CVE-2022-22824	expat@2.2.9-r1	2.2.10-r0
Medium	GHSA-j8wc-gxx9-82hx	xmlsec@2.1.4	2.1.7
Medium	ALPINE-CVE-2021-45960	expat@2.2.9-r1	2.2.10-r0
Medium	GHSA-9vjp-v76f-g363	netty-codec@4.1.49.Final	4.1.68.Final
Medium	ALPINE-CVE-2022-27404	freetype@2.10.4-r0	2.10.4-r1
Medium	GHSA-grg4-wf29-r9vv	netty-codec@4.1.49.Final	4.1.68.Final
Medium	ALPINE-CVE-2022-28391	busybox@1.31.1-r20	1.31.1-r22
Medium	ALPINE-CVE-2021-39537	ncurses@6.2_p20200523-r0	6.2_p20200523-r1
Medium	GHSA-57j2-w4cx-62h2	jackson-databind@2.11.4	2.12.6.1
Medium	ALPINE-CVE-2022-25314	expat@2.2.9-r1	2.2.10-r2
Medium	ALPINE-CVE-2022-22826	expat@2.2.9-r1	2.2.10-r0
Medium	ALPINE-CVE-2022-22827	expat@2.2.9-r1	2.2.10-r0
Medium	ALPINE-CVE-2021-46143	expat@2.2.9-r1	2.2.10-r0
Medium	ALPINE-CVE-2022-22825	expat@2.2.9-r1	2.2.10-r0
Medium	ALPINE-CVE-2022-23990	expat@2.2.9-r1	2.2.10-r1
Medium	GHSA-3p86-9955-h393	org.eclipse.jgit@5.9.0.202009080501-r	5.13.3.202401111512-r
Medium	GHSA-7rpj-hg47-cx62	h2@1.4.199	2.0.202
Medium	ALPINE-CVE-2022-27406	freetype@2.10.4-r0	2.10.4-r2
Medium	GHSA-98qh-xjc8-98pq	postgresql@42.2.19	42.7.11
Medium	GHSA-xmc8-26q4-qjhx	jackson-dataformat-cbor@2.10.4	2.11.4
Medium	GHSA-668q-qrv7-99fm	logback-core@1.2.3	1.2.9
Medium	ALPINE-CVE-2022-27405	freetype@2.10.4-r0	2.10.4-r2
Medium	GHSA-jjjh-jjxp-wpff	jackson-databind@2.11.4	2.12.7.1
Medium	GHSA-rgv9-q543-rqg4	jackson-databind@2.11.4	2.12.7.1
Medium	GHSA-735f-pc8j-v9w8	protobuf-java@3.8.0	3.25.5
Medium	GHSA-3mc7-4q67-w48m	snakeyaml@1.26	1.31
Medium	ALPINE-CVE-2021-42380	busybox@1.31.1-r20	1.31.1-r21
Medium	ALPINE-CVE-2021-42379	busybox@1.31.1-r20	1.31.1-r21
Medium	ALPINE-CVE-2021-42381	busybox@1.31.1-r20	1.31.1-r21
Medium	ALPINE-CVE-2021-42385	busybox@1.31.1-r20	1.31.1-r21
Medium	GHSA-v7wg-cpwc-24m4	postgresql@42.2.19	42.2.25
Medium	ALPINE-CVE-2021-42378	busybox@1.31.1-r20	1.31.1-r21
Medium	ALPINE-CVE-2021-42382	busybox@1.31.1-r20	1.31.1-r21
Medium	ALPINE-CVE-2021-42384	busybox@1.31.1-r20	1.31.1-r21
Medium	ALPINE-CVE-2021-42386	busybox@1.31.1-r20	1.31.1-r21
Medium	ALPINE-CVE-2022-25313	expat@2.2.9-r1	2.2.10-r2
Medium	ALPINE-CVE-2021-42383	busybox@1.31.1-r20	1.31.1-r21
Medium	GHSA-c5hg-mr8r-f6jp	hazelcast@4.2	4.2.6

Used by

1 chart

Chart	Version	Tag	Containers
sonarqube-ltssonarqubeVerified publisher	1.0.16+98	8.9.2-community	1

Counts are over the indexed charts’ latest versions, rendered with default values, and say nothing about images outside the indexed set.