Generally the images will be built with dependencies that have known issues but not all cves are actual problems.

Just because Next cloud uses a package, it may not use the function that has the issue.