Is there a Jenkins Docker image without security vulnerabilities?

[MarkEWaite (Mark Waite)]

@ohbei

To confirm, is the only way to validate that a vulnerability (e.g., in snakeyaml) does not affect Jenkins is to check that there is no advisory for it?

Yes, that is correct. The Jenkins security officer has said:

Instead of announcing a continuous flow of non-impacting vulnerabilities, our approach is to publish information only for those that we consider interesting, like critical score, widely spread, etc.
For them you will find an article in our blog, like: Log4Shell or SpringShell.