oncall Helm chart

Name: oncall Helm chart: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

grafana

Scored 14 Sept 2026

Developer-friendly incident response with brilliant Slack integration

Latest 1.16.5 1 year agoapp version v1.16.5 11Artifact Hub

oncall 1.16.5 deploys 12 container images: quay.io/jetstack/cert-manager-cainjector, quay.io/jetstack/cert-manager-controller, quay.io/jetstack/cert-manager-webhook, library/busybox and 8 more. Across the 9 measured, 1,490 findings — 0 critical, 30 high — 6 on CISA KEV. The highest contribution is ALPINE-CVE-2025-15467 in openssl 3.3.4-r0, fixed in 3.3.6-r0.

Radar Score

16,2510302011,259

1,490 findings over 9 of 12 images measured

KEV ×6 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

12 images

Image	Tag	Vulnerabilities	Radar Score
quay.io/jetstack/cert-manager-cainjector	v1.8.0	0324149	1,917
quay.io/jetstack/cert-manager-controller	v1.8.0	0327161	2,067
quay.io/jetstack/cert-manager-webhook	v1.8.0	0217138	1,598
library/busybox	1.31.1	0000	0
grafana/grafana	11.1.4	0221151	1,738
registry.k8s.io/ingress-nginx/controller	v1.2.1	01029140	2,311
grafana/oncall×5	v1.16.5	0437182	2,550
bitnami/mariadb	10.11.4-debian-11-r0	—	unmeasured
bitnami/rabbitmq	3.12.0-debian-11-r0	—	unmeasured
bitnami/redis×2	6.2.7-debian-11-r11	—	unmeasured
quay.io/jetstack/cert-manager-ctl	v1.8.0	0432200	2,525
registry.k8s.io/ingress-nginx/kube-webhook-certgen×2	v1.1.1	0214138	1,545

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

570 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Medium	ALPINE-CVE-2026-2004	postgresql17@17.6-r0	17.8-r0
Medium	GHSA-qw25-v68c-qjf3	django@4.2.22	4.2.26
Medium	ALPINE-CVE-2026-2006	postgresql17@17.6-r0	17.8-r0
Medium	GHSA-h86h-8ppg-mxmh	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7	0.0.0-20210428140749-89ef3d95e781
Medium	ALPINE-CVE-2022-2097	openssl@1.1.1o-r0	1.1.1q-r0
Medium	ALPINE-CVE-2026-6473	postgresql17@17.6-r0	17.10-r0
Medium	PYSEC-2026-2269	pyopenssl@25.1.0	26.0.0
Medium	ALPINE-CVE-2025-9230	openssl@3.1.4-r5	3.1.8-r1
Medium	GHSA-69ch-w2m2-3vjp	golang.org/x/text@v0.3.7	0.3.8
Medium	ALPINE-CVE-2023-23914	curl@7.79.1-r1	7.79.1-r5
Medium	GO-2022-0433	stdlib@go1.17.8	1.17.9
Medium	GHSA-gvg8-93h5-g6qq	django@4.2.22	4.2.28
Medium	ALPINE-CVE-2025-9231	openssl@3.3.4-r0	3.3.5-r0
Medium	PYSEC-2025-106	django@4.2.22	4.2.25
Medium	ALPINE-CVE-2025-49794	libxml2@2.13.4-r6	2.13.9-r0
Medium	GO-2026-4887	github.com/docker/docker@v20.10.12+incompatible	no fix listed
Medium	ALPINE-CVE-2025-6021	libxml2@2.13.4-r6	2.13.9-r0
Medium	GHSA-rcjv-mgp8-qvmr	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0	0.44.0
Medium	GHSA-ppp9-7jff-5vj2	golang.org/x/text@v0.3.6	0.3.7
Medium	ALPINE-CVE-2025-59375	expat@2.7.0-r0	2.7.2-r0
Medium	ALPINE-CVE-2024-9681	curl@8.9.0-r0	8.11.0-r0
Medium	GHSA-8r3f-844c-mc37	google.golang.org/protobuf@v1.27.1	1.33.0
Medium	ALPINE-CVE-2022-43552	curl@7.79.1-r1	7.79.1-r4
Medium	GHSA-x527-x647-q7gg	golang.org/x/crypto@v0.24.0	0.52.0
Medium	ALPINE-CVE-2025-0725	curl@8.9.0-r0	8.12.0-r0
Medium	GHSA-wf45-q9ch-q8gh	github.com/apache/thrift@v0.18.1	0.23.0
Medium	GHSA-2xpw-w6gg-jr37	urllib3@1.26.19	2.6.0
Medium	GHSA-gm62-xv2j-4w53	urllib3@1.26.19	2.6.0
Medium	ALPINE-CVE-2022-29458	ncurses@6.2_p20210612-r0	6.2_p20210612-r1
Medium	GHSA-gwc9-m7rh-j2ww	golang.org/x/crypto@v0.0.0-20211117183948-ae814b36b871	0.0.0-20211202192323-5770296d904e
Medium	GHSA-vgwf-h737-ff37	golang.org/x/crypto@v0.24.0	0.52.0
Medium	ALPINE-CVE-2023-23916	curl@7.79.1-r1	7.79.1-r5
Medium	ALPINE-CVE-2024-9143	openssl@3.1.4-r5	3.1.7-r1
Medium	ALPINE-CVE-2026-14669	postgresql17@17.6-r0	17.11-r0
Medium	GHSA-6wrf-mxfj-pf5p	github.com/docker/docker@v20.10.12+incompatible	20.10.24
Medium	GHSA-f5wc-c3c7-36mc	golang.org/x/crypto@v0.24.0	0.52.0
Medium	ALPINE-CVE-2025-0665	curl@8.9.0-r0	8.12.0-r0
Medium	GHSA-p782-xgp4-8hr8	golang.org/x/sys@v0.0.0-20211216021012-1d35b9e2eb4e	0.0.0-20220412211240-33da011f77ad
Medium	ALPINE-CVE-2026-6100	python3@3.12.11-r0	3.12.14-r0
Medium	PYSEC-2026-43	django@4.2.22	4.2.28
Medium	PYSEC-2026-45	django@4.2.22	4.2.28
Medium	ALPINE-CVE-2026-31790	openssl@3.3.4-r0	3.3.7-r0
Medium	GHSA-pc3f-x583-g7j2	github.com/moby/spdystream@v0.2.0	0.5.1
Medium	PYSEC-2026-52	django@4.2.22	4.2.30
Medium	GHSA-4f99-4q7p-p3gh	github.com/sirupsen/logrus@v1.8.1	1.8.3
Medium	PYSEC-2026-3717	django@4.2.22	5.2.17
Medium	ALPINE-CVE-2025-9232	openssl@3.1.4-r5	3.1.8-r1
Medium	GHSA-hqxw-f8mx-cpmw	github.com/docker/distribution@v2.8.1+incompatible	2.8.2-beta.1
Medium	GHSA-rm3j-f69w-wqmq	golang.org/x/crypto@v0.24.0	0.52.0
Medium	GHSA-r53h-jv2g-vpx6	helm.sh/helm/v3@v3.8.1	3.14.2

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.16.5latest	1 year ago	v1.16.5	0302011,259	16,251

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/grafana/oncall.svg)](https://charts.stackradar.io/charts/grafana/oncall)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.