matomo 12.0.26 Helm chart

Name: matomo Helm chart 12.0.26: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

digitalist-open-cloud-matomo

Scored 24 Oct 2026

A Helm chart for Matomo

Version 12.0.26app version 5.12.0 1Artifact Hub

matomo 12.0.26 deploys 3 container images: digitalist/matomo, hipages/php-fpm_exporter and digitalist/nginx. Across them, 270 findings — 1 critical, 6 high. The highest contribution is GO-2024-2687 in stdlib go1.17.10, fixed in 1.21.9.

Radar Score

3,7661673190

270 findings over 3 of 3 images measured

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

3 images

Image	Tag	Vulnerabilities	Radar Score
digitalist/matomo×14	5.12.0	0220101	1,450
hipages/php-fpm_exporter×2	2.2.0	145383	2,281
digitalist/nginx×2	1.31.6-5	0006	35

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

190 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	ALPINE-CVE-2026-82209	curl@8.21.0-r0	8.22.0-r0
Low	GO-2023-1840	stdlib@go1.17.10	1.19.10
Low	ALPINE-CVE-2026-85091	zlib@1.3.2-r0	1.3.2-r1
Low	ALPINE-CVE-2026-80255	curl@8.21.0-r0	8.22.0-r0
Low	GO-2026-5970	golang.org/x/text@v0.3.7	0.39.0
Low	ALPINE-CVE-2026-13608	curl@8.21.0-r0	8.22.0-r0
Low	GO-2025-4155	stdlib@go1.17.10	1.24.11
Low	ALPINE-CVE-2026-53789	rsync@3.4.3-r1	3.5.0-r0
Low	GO-2025-4014	stdlib@go1.17.10	1.24.8
Low	GO-2023-2382	stdlib@go1.17.10	1.20.12
Low	GO-2026-6617	stdlib@go1.17.10	1.26.9
Low	ALPINE-CVE-2026-19553	python3@3.14.5-r0	3.14.8-r0
Low	ALPINE-CVE-2026-75803	openssl@3.5.7-r0	3.5.8-r0
Low	GO-2024-3105	stdlib@go1.17.10	1.22.7
Low	ALPINE-CVE-2026-82208	curl@8.21.0-r0	8.22.0-r0
Low	GO-2025-4007	stdlib@go1.17.10	1.24.9
Low	GO-2026-6608	stdlib@go1.17.10	1.26.9
Low	ALPINE-CVE-2026-53794	rsync@3.4.3-r1	3.5.0-r0
Low	GO-2026-6607	stdlib@go1.17.10	1.26.9
Low	GO-2025-3420	stdlib@go1.17.10	1.22.11
Low	ALPINE-CVE-2026-70462	rsync@3.4.3-r1	3.5.0-r0
Low	GO-2025-4013	stdlib@go1.17.10	1.24.8
Low	GO-2026-6609	stdlib@go1.17.10	1.26.9
Low	ALPINE-CVE-2026-17084	python3@3.14.5-r0	3.14.8-r0
Low	ALPINE-CVE-2026-53801	rsync@3.4.3-r1	3.5.0-r0
Low	ALPINE-CVE-2026-80230	curl@8.21.0-r0	8.22.0-r0
Low	GO-2022-0515	stdlib@go1.17.10	1.17.12
Low	GO-2025-3956	stdlib@go1.17.10	1.23.12
Low	GO-2026-4946	stdlib@go1.17.10	1.25.9
Low	ALPINE-CVE-2026-53795	rsync@3.4.3-r1	3.5.0-r0
Low	GHSA-3qpq-r242-jqj7	phpseclib/phpseclib@3.0.36	3.0.52
Low	GHSA-38cx-cq6f-5755	symfony/http-foundation@v6.4.34	6.4.41
Low	GO-2026-6629	golang.org/x/text@v0.3.7	0.41.0
Low	ALPINE-CVE-2026-53784	rsync@3.4.3-r1	3.5.0-r0
Low	ALPINE-CVE-2026-53802	rsync@3.4.3-r1	3.5.0-r0
Low	ALPINE-CVE-2026-53803	rsync@3.4.3-r1	3.5.0-r0
Low	ALPINE-CVE-2026-53798	rsync@3.4.3-r1	3.5.0-r0
Low	GHSA-v5mv-p594-2x33	guzzlehttp/guzzle@7.10.0	7.15.2
Low	GO-2024-2598	stdlib@go1.17.10	1.21.8
Low	GO-2023-2186	stdlib@go1.17.10	1.20.11
Low	GO-2026-6613	stdlib@go1.17.10	1.26.9
Low	GO-2025-3849	stdlib@go1.17.10	1.23.12
Low	ALPINE-CVE-2026-53786	rsync@3.4.3-r1	3.5.0-r0
Low	GO-2026-6605	stdlib@go1.17.10	1.26.9
Low	GHSA-p2gh-cfq4-4wjc	google/protobuf@v4.33.5	4.33.6
Low	GO-2026-6610	stdlib@go1.17.10	1.26.9
Low	GO-2023-1621	stdlib@go1.17.10	1.19.7
Low	ALPINE-CVE-2026-3276	python3@3.14.5-r0	3.14.7-r0
Low	ALPINE-CVE-2026-76956	expat@2.8.2-r0	2.8.4-r0
Low	ALPINE-CVE-2026-63074	openssl@3.5.7-r0	3.5.8-r0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
12.0.27latest	—	5.12.0	1673190	3,766
12.0.26	—	5.12.0	1673190	3,766
12.0.21	—	5.12.0	1673190	3,764
12.0.20	—	5.12.0	21589185	4,749

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/digitalist-open-cloud-matomo/matomo.svg)](https://charts.stackradar.io/charts/digitalist-open-cloud-matomo/matomo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.