History · changes between runs
From 2026-10-17 07:25 UTC to 2026-10-17 12:20 UTC
Each image in the two runs, before and after: its digest, its base, its verdict, and its findings by severity, and how it changed.
How the images changed
2
Rebased
5
Rebuilt
0
Base moved
0
New
0
Gone
2
Same image
0 images changed verdict and 6 images in both runs changed findings; 6 fixable high or critical findings were fixed and 0 were introduced, counted per image; and 7 images changed their package set. Rebased: a new digest from a rebase. Rebuilt: a new digest otherwise. Base moved: the same image, its base more or less current than before. A verdict or findings can change while the image stays the same, when the policy, the evidence, or the advisories do.
Who had findings, before and after
Per severity, the images that had findings in each run and, of the images in both, which have none now and which have some for the first time, each with how it changed. The fixable high and critical findings are named below; the history only counts the rest.
| Severity | Had some before | Have some after | Now none | Newly some | Unknown in one run |
|---|---|---|---|---|---|
| critical |
| none |
| none | none |
| high |
|
|
| none | none |
| medium |
|
|
| none | none |
| low |
|
|
| none | none |
| unknown |
|
|
| none | none |
An image with no vulnerability data in a run is unknown there, not clean.
Fixable findings, by ID
Each fixable high or critical finding either run lists: which images had it, which have it, and where it was fixed or introduced, with how each image changed. A finding gone from an image was fixed, or a VEX statement now covers it.
| Finding | Had it before | Has it after | Fixed in | New in |
|---|---|---|---|---|
| GHSA-6j4f-fj2g-mc7p |
|
| none | none |
| GHSA-mwp4-54f8-5fhr |
|
| none | none |
| GHSA-qhr7-859c-m2p7 |
|
| none | none |
| GHSA-rfgv-xxqx-mfg5 |
|
| none | none |
| GHSA-rgw5-rvv9-x895 |
|
| none | none |
| CVE-2026-14456 |
| none |
| none |
Image by image
| Image | How | Digest | Base | Verdict | Findings | Packages |
|---|---|---|---|---|---|---|
| checkout:latest | Rebased A new digest from a rebase: its layers were moved onto a newer base without a rebuild. from ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:e67531bdf7d6a0f77f8c07c32efabc60c7733023c0a49923d979e64fb11e5143 | sha256:e67531bdf7d6 → sha256:2bde717bdacf | sha256:48499cde6a17 → sha256:f6a0ee0f0f63 Current | Verified |
Fixed: CVE-2026-14456 | changed |
| storefront:latest | Rebased A new digest from a rebase: its layers were moved onto a newer base without a rebuild. from ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99 | sha256:8b1d4730bb6a → sha256:cd946e7df5b0 | sha256:f12bc0c8f6b0 → sha256:e3620169865a Current | Verified |
Fixed: CVE-2026-14456 | changed |
| build-python:3.14 | Rebuilt, same base A new digest on the same base: its own layers changed. | sha256:6d1af765e4a7 → sha256:59b29c2b0346 | sha256:030e45cb3718 Current | Verified |
| changed |
| catalog:latest | Rebuilt on a new base A new digest, built on another version of its base. | sha256:b5944261ebe6 → sha256:53c76ac7c0e9 | sha256:4844ef0efd83 → sha256:daf68a5f8a3b Current | Verified |
Fixed: CVE-2026-14456 | changed |
| run-go:1 | Rebuilt, same base A new digest on the same base: its own layers changed. | sha256:48499cde6a17 → sha256:f6a0ee0f0f63 | sha256:030e45cb3718 Current | Verified |
Fixed: CVE-2026-14456 | changed |
| run-node:24 | Rebuilt, same base A new digest on the same base: its own layers changed. | sha256:f12bc0c8f6b0 → sha256:e3620169865a | sha256:030e45cb3718 Current | Verified |
Fixed: CVE-2026-14456 | changed |
| run-python:3.14 | Rebuilt, same base A new digest on the same base: its own layers changed. | sha256:4844ef0efd83 → sha256:daf68a5f8a3b | sha256:030e45cb3718 Current | Verified |
Fixed: CVE-2026-14456 | changed |
2 images unchanged
The same digest, base currency, verdict, and findings in both runs, and the same package set where both runs read it: build-go:1, build-node:24.
? means unknown: the run had no vulnerability data for that image. The history names an image's fixable high and critical findings and counts the rest, so only those are listed as fixed or new. It identifies the package set by a digest, so "changed" says the set differs, not which packages; the latest run's image pages list them. Packages are unknown for an image whose package set wasn't read in one of the runs.