Every advisory from the Alpine secdb feed — covering the aports source-package world for Alpine 3.18, 3.19, 3.20, 3.21, and edge — plus the same packages shipped across four container registries: Docker Hub's Official Alpine, Chainguard hardened, Wolfi undistro, and Red Hat hardened. Same upstream package, different vulnerability footprint per registry. Enriched live with Vulnetix VDB exploit intelligence. Latest month: June 2026 — Alpine Security Advisories · 57 advisories.
Alpine packages are pulled from Docker Hub, Chainguard, Wolfi, and the Red Hat hardened registry. Each shows a different vulnerability footprint for the same upstream source.
Upstream Alpine Linux maintainers' official image, distributed via Docker Hub. The canonical "alpine:<version>" reference most projects pin against.
$ docker pull docker.io/library/alpineOpen registry →
Chainguard hardened distroless / minimal images built on the Wolfi undistro. Alpine workloads frequently rebased here for reduced CVE footprint.
$ docker pull cgr.dev/chainguard/wolfi-baseOpen registry →
Wolfi is a community Linux undistro from Chainguard, glibc-based but designed in the spirit of Alpine. Frequent destination when migrating off musl-Alpine.
$ docker pull cgr.dev/chainguard/wolfi-baseOpen registry →
Red Hat Container Catalog hardened images. Includes Universal Base Image (UBI) variants suited for Alpine-style minimal workloads under Red Hat support.
$ docker pull registry.access.redhat.com/ubi9-minimalOpen registry →
The same upstream Alpine package can have a different vulnerability footprint on every registry that ships it. Vulnetix VDB indexes all four.