ghcr.io/mcwarman/backstage-sample-app/backend:main container image

GitHub Container Registry

Scanned 14 Sept 2026

Deployed by 1 of 17,781 indexed charts (latest versions) at this tag.GitHub Container Registry all tags of ghcr.io/mcwarman/backstage-sample-app/backend

ghcr.io/mcwarman/backstage-sample-app/backend:main resolved to 07aba09a594f, scanned 14 Sept 2026: 516 findings, 0 critical; deployed by 1 chart, among them backstage.

Radar Score

5,7420583426

516 findings on digest 07aba09a594f · scanned 14 Sept 2026

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Digests

1 digest

Tag	Digest	Used by	Last seen	Vulnerabilities	Radar Score
mainresolves to	07aba09a594f	1 chart	8 days ago	0583426	5,742

Digests this tag resolved to in indexed charts’ default renders. A tag can move; the digest is what was scanned.

Low findings

426 distinct on this digest

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Findings for digest 07aba09a594f as scanned on 14 Sept 2026 with syft 1.42.1 for linux/amd64, advisories as of 14 Sept 2026. Other architectures may differ.

Severity	Advisory	Package	Fixed in
Low	DEBIAN-CVE-2025-69420	openssl@3.0.17-1~deb12u3	3.0.18-1~deb12u2
Low	DEBIAN-CVE-2026-57433	perl@5.36.0-7+deb12u3	no fix listed
Low	GHSA-vcc3-ghjq-m6fr	decode-uri-component@0.2.2	0.5.0
Low	GHSA-j3q9-mxjg-w52f	path-to-regexp@8.1.0	8.4.0
Low	GHSA-rhx6-c78j-4q9w	path-to-regexp@0.1.10	0.1.12
Low	GHSA-44fp-w29j-9vj5	multer@1.4.5-lts.1	2.0.0
Low	DEBIAN-CVE-2026-13221	perl@5.36.0-7+deb12u3	no fix listed
Low	DEBIAN-CVE-2026-42496	perl@5.36.0-7+deb12u3	no fix listed
Low	DEBIAN-CVE-2025-0840	binutils@2.40-2	no fix listed
Low	GHSA-62hf-57xw-28j9	axios@1.8.2	1.15.1
Low	GHSA-x6wf-f3px-wcqx	@xmldom/xmldom@0.8.10	0.8.13
Low	GHSA-34x7-hfp2-rc4v	tar@6.2.1	7.5.7
Low	DEBIAN-CVE-2026-9076	openssl@3.0.17-1~deb12u3	3.0.20-1~deb12u2
Low	DEBIAN-CVE-2026-4224	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u8
Low	GHSA-q8qp-cvcw-x6jj	axios@1.8.2	1.15.2
Low	GHSA-fjgf-rc76-4x9p	multer@1.4.5-lts.1	2.0.2
Low	GHSA-g5hg-p3ph-g8qg	multer@1.4.5-lts.1	2.0.1
Low	GHSA-3g43-6gmg-66jw	axios@1.8.2	1.15.2
Low	DEBIAN-CVE-2026-7210	python3.11@3.11.2-6+deb12u6	no fix listed
Low	GHSA-777c-7fjr-54vf	axios@1.8.2	1.16.0
Low	GHSA-hfxv-24rg-xrqf	axios@1.8.2	1.16.0
Low	DEBIAN-CVE-2026-12087	perl@5.36.0-7+deb12u3	no fix listed
Low	DEBIAN-CVE-2025-1153	binutils@2.40-2	no fix listed
Low	GHSA-j5f8-grm9-p9fc	axios@1.8.2	1.16.0
Low	DEBIAN-CVE-2018-20673	binutils@2.40-2	no fix listed
Low	DEBIAN-CVE-2025-8194	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7
Low	DEBIAN-CVE-2026-15308	python3.11@3.11.2-6+deb12u6	no fix listed
Low	GHSA-685m-2w69-288q	protobufjs@7.2.6	7.5.6
Low	GHSA-75px-5xx7-5xc7	protobufjs@7.2.6	7.5.6
Low	DEBIAN-CVE-2026-0915	glibc@2.36-9+deb12u13	2.36-9+deb12u14
Low	DEBIAN-CVE-2023-50495	ncurses@6.4-4	no fix listed
Low	GHSA-rgw5-rvv9-x895	brace-expansion@1.1.11	1.1.18
Low	GHSA-49j4-86m8-q2jw	mysql2@2.3.3	3.9.4
Low	GHSA-5375-pq7m-f5r2	@grpc/grpc-js@1.10.9	1.10.12
Low	DEBIAN-CVE-2026-63072	openssl@3.0.17-1~deb12u3	no fix listed
Low	DEBIAN-CVE-2026-40355	krb5@1.20.1-2+deb12u4	1.20.1-2+deb12u5
Low	GHSA-6jr7-99pf-8vgf	@backstage/plugin-techdocs-node@1.12.11	1.13.11
Low	GHSA-f5x3-32g6-xq36	tar@6.2.0	6.2.1
Low	DEBIAN-CVE-2026-40356	krb5@1.20.1-2+deb12u4	1.20.1-2+deb12u5
Low	DEBIAN-CVE-2026-45445	openssl@3.0.17-1~deb12u3	3.0.20-1~deb12u2
Low	DEBIAN-CVE-2026-85091	zlib@1:1.2.13.dfsg-1	no fix listed
Low	GHSA-5m6q-g25r-mvwx	node-forge@1.3.2	1.4.0
Low	GHSA-pmwg-cvhr-8vh7	axios@1.8.2	1.15.1
Low	DEBIAN-CVE-2023-1972	binutils@2.40-2	no fix listed
Low	DEBIAN-CVE-2026-11972	python3.11@3.11.2-6+deb12u6	no fix listed
Low	GHSA-8gc5-j5rx-235r	fast-xml-parser@4.2.5	4.5.5
Low	GHSA-qffp-2rhf-9h96	tar@6.2.1	7.5.10
Low	GHSA-j759-j44w-7fr8	@xmldom/xmldom@0.8.10	0.8.13
Low	DEBIAN-CVE-2025-1179	binutils@2.40-2	no fix listed
Low	DEBIAN-CVE-2025-69534	python3.11@3.11.2-6+deb12u6	no fix listed

Used by

1 chart

Chart	Version	Tag	Containers
backstagemcwarmanVerified publisher	0.10.10	main	1

Counts are over the indexed charts’ latest versions, rendered with default values, and say nothing about images outside the indexed set.