harbor 2.3.6 Helm chart
helm-harborVerified publisherScored 10 Oct 2026
An open source trusted cloud native registry that stores, signs, and scans content
Version 2.3.6app version 2.15.3 0Artifact Hub
harbor 2.3.6 deploys 8 container images: goharbor/harbor-core, goharbor/harbor-jobservice, goharbor/harbor-portal, goharbor/registry-photon and 4 more. Across the 7 measured, 152 findings — 1 critical, 0 high — 1 on CISA KEV. The highest contribution is GO-2026-4919 in github.com/aquasecurity/trivy v0.74.0+dirty, with no fix listed.
Radar Score
Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.
Container images
| Image | Tag | Vulnerabilities | Radar Score |
|---|---|---|---|
| goharbor/ | v2.15.3 | 00032 | 202 |
| goharbor/ | v2.15.3 | 00026 | 143 |
| goharbor/ | v2.15.3 | 0000 | 0 |
| goharbor/ | v2.15.3 | 00324 | 172 |
| goharbor/ | v2.15.3 | 00330 | 225 |
| goharbor/ | v2.15.3 | 0000 | 0 |
| goharbor/ | v2.15.3 | — | unmeasured |
| goharbor/ | v2.15.3 | 10231 | 308 |
Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.
Vulnerabilities
| Severity | Advisory | Package | Fixed in |
|---|---|---|---|
| Critical | GO-2026-4919KEV | github.com/ | no fix listed |
| Medium | GHSA-h62f-wm92-2cmw | github.com/ | 2.7.0-rc.0 |
| Medium | GHSA-44r7-7p62-q3fr | github.com/ | 1.1.25 |
| Medium | GHSA-2v4p-qf9q-27wj | google.golang.org/ | 1.82.2 |
| Medium | GHSA-vp52-pcj8-j9qc | google.golang.org/ | 1.83.1 |
| Medium | GHSA-hqxw-f8mx-cpmw | github.com/ | 2.8.2-beta.1 |
| Low | GHSA-f2g3-hh2r-cwgc | github.com/ | no fix listed |
| Low | GO-2026-5942 | golang.org/ | 0.56.0 |
| Low | GO-2025-3460 | github.com/ | no fix listed |
| Low | GHSA-pjcq-xvwq-hhpj | github.com/ | 0.1.1 |
| Low | GO-2026-6355 | golang.org/ | 0.56.0 |
| Low | GO-2026-5970 | golang.org/ | 0.39.0 |
| Low | GO-2026-6354 | golang.org/ | 0.56.0 |
| Low | GHSA-3p65-76g6-3w7r | github.com/ | no fix listed |
| Low | GO-2026-5841 | github.com/ | 1.18.7 |
| Low | GHSA-pg57-6jwg-q645 | github.com/ | 2.3.6 |
| Low | GHSA-rq77-p4h8-4crw | github.com/ | 1.7.3 |
| Low | GHSA-qc2q-p7wx-3px3 | google.golang.org/ | 1.83.1 |
| Low | GHSA-6pjf-3r9x-m592 | github.com/ | no fix listed |
| Low | GO-2022-0646 | github.com/ | no fix listed |
| Low | GHSA-82ff-hg59-8x73 | github.com/ | no fix listed |
| Low | GHSA-7jxh-36q5-gcqv | github.com/ | 2.3.5 |
| Low | GHSA-92cp-5422-2mw7 | github.com/ | 9.6.3 |
| Low | GHSA-hr2v-4r36-88hr | helm.sh/ | 3.20.2 |
| Low | GO-2026-5932 | golang.org/ | no fix listed |
| Low | GO-2026-6599 | stdlib | 1.26.9 |
| Low | GO-2026-6600 | stdlib | 1.26.9 |
| Low | GO-2026-6603 | golang.org/ | 0.60.0 |
| Low | GO-2026-6603 | stdlib | 1.26.9 |
| Low | GO-2026-6604 | stdlib | 1.26.9 |
| Low | GO-2026-6605 | stdlib | 1.26.9 |
| Low | GO-2026-6607 | stdlib | 1.26.9 |
| Low | GO-2026-6608 | stdlib | 1.26.9 |
| Low | GO-2026-6609 | stdlib | 1.26.9 |
| Low | GO-2026-6610 | golang.org/ | 0.60.0 |
| Low | GO-2026-6610 | stdlib | 1.26.9 |
| Low | GO-2026-6611 | stdlib | 1.26.9 |
| Low | GO-2026-6611 | golang.org/ | 0.60.0 |
| Low | GO-2026-6612 | golang.org/ | 0.60.0 |
| Low | GO-2026-6612 | stdlib | 1.26.9 |
| Low | GO-2026-6613 | stdlib | 1.26.9 |
| Low | GO-2026-6617 | stdlib | 1.26.9 |
| Low | GO-2026-6617 | golang.org/ | 0.60.0 |
| Low | GO-2022-0635 | github.com/ | no fix listed |
| Low | GHSA-qq97-vm5h-rrhg | github.com/ | 2.8.0 |
| Low | GHSA-8wmf-6v46-5gfg | go.opentelemetry.io/ | 1.45.0 |
| Low | GHSA-8wmf-6v46-5gfg | go.opentelemetry.io/ | 1.45.0 |
| Low | GHSA-8wmf-6v46-5gfg | go.opentelemetry.io/ | 1.45.0 |
| Low | GHSA-8wmf-6v46-5gfg | go.opentelemetry.io/ | 1.45.0 |
Indexed versions
| Version | Published | App version | Vulnerabilities | Radar Score |
|---|---|---|---|---|
| 2.3.7latest | — | 2.15.4 | 106133 | 1,192 |
| 2.3.6 | — | 2.15.3 | 108143 | 1,050 |
| 2.3.5 | — | 2.15.2 | 1038249 | 2,986 |
The latest version and the previous major, as selected nightly from the repository’s index.
README badge
Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.