ITRS Analytics Security Updates

This page provides a point-in-time record of security scan results for ITRS Analytics installation packages. It identifies known Common Vulnerabilities and Exposures (CVEs) detected in third-party libraries, container images, and dependencies included in each package release at the time of assessment.

You may use this page to:

• Identify known CVEs recorded for a specific ITRS Analytics version.
• Understand which images or components are affected.
• Support upgrade planning and remediation discussions.

How ITRS manages CVEs Copied

ITRS applies a risk-based approach to vulnerability management across the ITRS Analytics platform. The objective is to identify, assess, and reduce security risk arising from known vulnerabilities while maintaining system stability, reliability, and service continuity. Vulnerability management activities form part of ITRS’s broader security governance framework and are subject to ongoing review and improvement.

ITRS monitors publicly disclosed CVEs that may affect ITRS Analytics and the third-party and open source components used within the platform. This includes supply chain and dependency management controls together with vulnerability monitoring across the software development, build, and release process. Where CVEs are identified, they are assessed in context, taking into account factors such as severity, exploitability, deployment configuration, and relevance to the operating environment.

CVEs assessed as relevant are typically addressed in the next scheduled product release. Where a vulnerability is assessed as critical and presents a material security risk, ITRS may apply remediation or mitigation measures outside the standard release cycle, which may include corrective action as appropriate. ITRS also applies security controls across the software delivery lifecycle, including source code management, build pipelines, container images, and deployment processes, to reduce the likelihood and impact of vulnerabilities entering the production environment.

How to interpret these results Copied

• CVE listings reflect the results of the latest scan for each installation package at the time shown.
• The published CVE results reflect the state of the product at the time of the release scan. CVE databases, scanner rules, and vendor classifications may change after release, so additional findings may appear even where no changes have been made to the deployed software.
• Results from customer scanning tools may differ because of variations in scan date, scanner vendor, data source, detection logic, dependency resolution, and deployment configuration.
• Results should be interpreted in the context of the release scan date, affected component, severity, and whether the relevant vulnerable code is present and reachable in the deployed environment.
• The presence of a CVE does not necessarily mean that a system is exploitable or that all customer environments are affected.
• CVE assessment and remediation decisions are based on risk, context, and practical impact rather than on CVE presence alone.

Note

The tables below list the images or libraries affected by CVEs identified in the latest security scan for each installation package. This information is reviewed and updated with each new packaging release.

Installation package 2.18.2+p2.18.5 Copied

Scan date: 11 June 2026

Note

The docker.itrsgroup.com/iax/loki:2.18.5 image is included only to support migrations from ITRS Analytics 2.17.x to 2.18.x when logs collection is enabled. If logs collection is not currently enabled, Loki is not installed. It is a temporary migration component and is not part of the long-term deployment. It will be removed once the ITRS Analytics 2.18.x installation is complete.

Expand table

Installation package 2.18.1+p2.18.3 Copied

Scan date: 21 May 2026

Note

The docker.itrsgroup.com/iax/loki:2.18.3 image is included only to support migrations from ITRS Analytics 2.17.x to 2.18.x when logs collection is enabled. If logs collection is not currently enabled, Loki is not installed. It is a temporary migration component and is not part of the long-term deployment. It will be removed once the ITRS Analytics 2.18.x installation is complete.

Expand table

Installation package 2.18.0+p2.18.3 Copied

Scan date: 6 May 2026

Note

The docker.itrsgroup.com/iax/loki:2.18.3 image is included only to support migrations from ITRS Analytics 2.17.x to 2.18.x when logs collection is enabled. If logs collection is not currently enabled, Loki is not installed. It is a temporary migration component and is not part of the long-term deployment. It will be removed once the ITRS Analytics 2.18.x installation is complete.

Expand table

Installation package 2.17.12 Copied

Scan date: 29 April 2026

Expand table

Installation package 2.17.11 Copied

Scan date: 1 April 2026

Expand table

Installation package 2.17.10 Copied

Scan date: 25 March 2026

Expand table

Installation package 2.17.9 Copied

Scan date: 17 March 2026

Expand table

Installation package 2.17.8 Copied

Scan date: 4 March 2026

Expand table

Installation package 2.17.7 Copied

Scan date: 25 February 2026

Expand table

Installation package 2.17.6 Copied

Scan date: 10 February 2026

Expand table

Installation package 2.17.5 Copied

Scan date: 4 February 2026

Expand table

Installation package 2.17.4 Copied

Scan date: 29 January 2026

Expand table

Installation package 2.17.3 Copied

Scan date: 26 January 2026

Expand table

Installation package 2.17.2 Copied

Scan date: 18 December 2025

Expand table

Installation package 2.17.1 Copied

Scan date: 3 December 2025

Expand table

Installation package 2.17.0 Copied

Scan date: 2 December 2025

Expand table

Installation package 2.16.4 Copied

Scan date: 21 November 2025

Expand table

Installation package 2.16.3 Copied

Scan date: 14 November 2025

Expand table

Installation package 2.16.2 Copied

Scan date: 12 November 2025

Expand table

Installation package 2.16.1 Copied

Scan date: 5 November 2025

Expand table

Installation package 2.16.0 Copied

Scan date: 30 October 2025

Expand table

Disclaimer

The information contained in this document is for general information and guidance on our products, services, and other matters. It is only for information purposes and is not intended as advice which should be relied upon. We try to ensure that the content of this document is accurate and up-to-date, but this cannot be guaranteed. Changes may be made to our products, services, and other matters which are not noted or recorded herein. All liability for loss and damage arising from reliance on this document is excluded (except where death or personal injury arises from our negligence or loss or damage arises from any fraud on our part).