StackRadar

rekor 1.8.6 Helm chart

sigstoreVerified publisher

Not scored yet

Part of the sigstore project, Rekor is a timestamping server and transparency log for storing signatures, as well as an API based server for validation

Version 1.8.6 todayapp version 1.5.4 4Artifact Hub

rekor 1.8.6 deploys 9 container images: gcr.io/trillian-opensource-ci/db_server, library/busybox, ghcr.io/sigstore/scaffolding/trillian_log_server, ghcr.io/sigstore/scaffolding/trillian_log_signer and 5 more. The highest contribution is ALPINE-CVE-2025-15467 in openssl 3.3.3-r0, fixed in 3.3.6-r0.

Radar Score

Not yet scored

The daily scoring run has not folded the 9 images into a score yet.

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

9 images
ImageTagVulnerabilitiesRadar Score
gcr.io/trillian-opensource-ci/db_serverdigest-pinned0371531,608
library/busybox×2digest-pinned00000
ghcr.io/sigstore/scaffolding/trillian_log_serverdigest-pinned00151372
ghcr.io/sigstore/scaffolding/trillian_log_signerdigest-pinned00151372
library/redisdigest-pinned01111241,288
curlimages/curldigest-pinned011934753
ghcr.io/sigstore/rekor/rekor-serverv1.5.400018124
ghcr.io/sigstore/scaffolding/createdbdigest-pinned00057387
ghcr.io/sigstore/scaffolding/createtreedigest-pinned00161443

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

256 distinct across the version’s images
SeverityAdvisoryPackageFixed in
LowGHSA-qw9x-cqr3-wc7rgithub.com/opencontainers/runc@v1.1.01.2.8
LowGHSA-cgrx-mc8f-2prmgithub.com/opencontainers/runc@v1.1.01.2.8
LowALPINE-CVE-2026-42766openssl@3.5.4-r03.5.7-r0
LowGO-2022-0969stdlib@go1.18.21.18.6
LowALPINE-CVE-2026-63075openssl@3.5.4-r03.5.8-r0
LowALPINE-CVE-2026-22184zlib@1.3.1-r21.3.2-r0
LowGO-2023-2185stdlib@go1.18.21.20.11
LowALPINE-CVE-2026-75803openssl@3.5.4-r03.5.8-r0
LowALPINE-CVE-2025-15468openssl@3.3.3-r03.3.6-r0
LowGO-2022-0537stdlib@go1.18.21.17.13
LowGHSA-vpvm-3wq2-2wvmgithub.com/opencontainers/runc@v1.1.01.1.5
LowALPINE-CVE-2026-7598libssh2@1.11.1-r01.11.1-r1
LowGHSA-wg65-39gg-5wfjgithub.com/prometheus/prometheus@v0.51.00.311.3
LowGO-2023-1703stdlib@go1.18.21.19.8
LowGO-2022-0521stdlib@go1.18.21.17.12
LowDSA-5650-1util-linux@2.36.1-8+deb11u12.36.1-8+deb11u2
LowGO-2022-0477stdlib@go1.18.21.17.11
LowGO-2026-4341stdlib@go1.25.01.24.12
LowGO-2022-0533stdlib@go1.18.21.17.11
LowGO-2022-0523stdlib@go1.18.21.17.12
LowGO-2024-2887stdlib@go1.18.21.21.11
LowGO-2022-0522stdlib@go1.18.21.17.12
LowGO-2022-0527stdlib@go1.18.21.17.12
LowGO-2022-0524stdlib@go1.18.21.17.12
LowGO-2023-1704stdlib@go1.18.21.19.8
LowALPINE-CVE-2026-2673openssl@3.5.4-r03.5.6-r0
LowDSA-5726-1krb5@1.18.3-6+deb11u41.18.3-6+deb11u5
LowDLA-3893-1expat@2.2.10-2+deb11u52.2.10-2+deb11u6
LowALPINE-CVE-2026-42767openssl@3.5.4-r03.5.7-r0
LowGO-2022-0526stdlib@go1.18.21.17.12
LowDSA-5587-1curl@7.74.0-1.3+deb11u107.74.0-1.3+deb11u11
LowGO-2023-1568stdlib@go1.18.21.19.6
LowGO-2022-1037stdlib@go1.18.21.18.7
LowALPINE-CVE-2026-63074openssl@3.5.4-r03.5.8-r0
LowGO-2023-1987stdlib@go1.18.21.19.12
LowGO-2023-1752stdlib@go1.18.21.19.9
LowDLA-4321-1openssl@1.1.1w-0+deb11u11.1.1w-0+deb11u4
LowDLA-3926-1perl@5.32.1-4+deb11u25.32.1-4+deb11u4
LowALPINE-CVE-2026-34181openssl@3.5.4-r03.5.7-r0
LowGO-2023-1705stdlib@go1.18.21.19.8
LowGO-2023-1878stdlib@go1.18.21.19.11
LowGHSA-fw7p-63qq-7hprfilippo.io/edwards25519@v1.1.01.1.1
LowGO-2022-1039stdlib@go1.18.21.18.7
LowGO-2024-2963stdlib@go1.18.21.21.12
LowGO-2023-1702stdlib@go1.18.21.19.8
LowGHSA-5cv4-jp36-h3mwgolang.org/x/net@v0.46.00.55.0
LowDLA-4432-1curl@7.74.0-1.3+deb11u107.74.0-1.3+deb11u16
LowDLA-3910-1e2fsprogs@1.46.2-21.46.2-2+deb11u1
LowALPINE-CVE-2026-40200musl@1.2.5-r91.2.5-r11
LowGO-2022-0525stdlib@go1.18.21.17.12

Indexed versions

VersionPublishedApp versionVulnerabilitiesRadar Score
1.8.6latesttoday1.5.4
1.8.513 days ago1.5.406405505,416

The latest version and the previous major, as selected nightly from the repository’s index.

README badge
[![Radar Score](https://charts.stackradar.io/badge/sigstore/rekor.svg)](https://charts.stackradar.io/charts/sigstore/rekor)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.

helm v3.16.4 · syft 1.42.1 · rendered 16 Sept 2026 · scanned 15 Sept 2026 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.