StackRadar

harbor 1.19.2 Helm chart

wener

Scored 16 Oct 2026

An open source trusted cloud native registry that stores, signs, and scans content

Version 1.19.2 2 months agoapp version 2.15.2 1Artifact Hub

harbor 1.19.2 deploys 8 container images: goharbor/harbor-core, goharbor/harbor-jobservice, goharbor/harbor-portal, goharbor/registry-photon and 4 more. Across them, 293 findings — 1 critical, 0 high — 1 on CISA KEV. The highest contribution is GO-2026-4919 in github.com/aquasecurity/trivy v0.72.0, with no fix listed.

Radar Score

3,4401053239

293 findings over 8 of 8 images measured

KEV confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

8 images
ImageTagVulnerabilitiesRadar Score
goharbor/harbor-corev2.15.200645563
goharbor/harbor-jobservicev2.15.200638492
goharbor/harbor-portalv2.15.200000
goharbor/registry-photonv2.15.2001742755
goharbor/harbor-registryctlv2.15.2001750819
goharbor/harbor-db×2v2.15.200000
goharbor/valkey-photonv2.15.200000
goharbor/trivy-adapter-photonv2.15.210764811

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

82 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

SeverityAdvisoryPackageFixed in
LowGHSA-f2g3-hh2r-cwgcgithub.com/distribution/distribution@v2.8.2+incompatibleno fix listed
LowGO-2026-6603stdlib@go1.26.41.26.9
LowGO-2026-6603golang.org/x/net@v0.55.00.60.0
LowGO-2026-5972stdlib@go1.26.41.25.13
LowGO-2026-6088stdlib@go1.26.41.25.13
LowGO-2026-6089stdlib@go1.26.41.25.13
LowGO-2026-6090stdlib@go1.26.41.25.13
LowGO-2026-6611stdlib@go1.26.41.26.9
LowGO-2026-6611golang.org/x/net@v0.55.00.60.0
LowGO-2025-3460github.com/distribution/distribution@v2.8.2+incompatibleno fix listed
LowGO-2026-6218stdlib@go1.26.41.25.13
LowGO-2026-5942golang.org/x/net@v0.55.00.56.0
LowGO-2026-5942stdlib@go1.26.41.26.6
LowGHSA-pjcq-xvwq-hhpjgithub.com/Azure/go-ntlmssp@v0.1.00.1.1
LowGO-2026-6355golang.org/x/crypto@v0.52.00.56.0
LowGO-2026-5970golang.org/x/text@v0.37.00.39.0
LowGO-2026-6303golang.org/x/crypto@v0.52.00.55.0
LowGO-2026-6354golang.org/x/crypto@v0.52.00.56.0
LowGO-2026-6608stdlib@go1.26.41.26.9
LowGHSA-8xwf-rjm4-xvhvoras.land/oras-go/v2@v2.6.02.6.1
LowGO-2026-6607stdlib@go1.26.41.26.9
LowGHSA-3p65-76g6-3w7rgithub.com/distribution/distribution@v2.8.2+incompatibleno fix listed
LowGO-2026-5774github.com/go-chi/chi/v5@v5.2.55.3.0
LowGHSA-jxpm-75mh-9fp7oras.land/oras-go/v2@v2.6.02.6.1
LowGO-2026-6609stdlib@go1.26.41.26.9
LowGO-2026-5841github.com/klauspost/compress@v1.18.01.18.7
LowGHSA-9c54-x2g4-v92jgithub.com/sigstore/timestamp-authority/v2@v2.0.62.1.0
LowGO-2026-6613stdlib@go1.26.41.26.9
LowGO-2026-6605stdlib@go1.26.41.26.9
LowGO-2026-6610golang.org/x/net@v0.55.00.60.0
LowGO-2026-6610stdlib@go1.26.41.26.9
LowGHSA-hc8v-wwc9-vgxmgithub.com/go-git/go-git/v5@v5.19.15.19.2
LowGHSA-5cv4-jp36-h3mwgolang.org/x/net@v0.54.00.55.0
LowGO-2026-6180golang.org/x/mod@v0.36.00.40.0
LowGHSA-fxhp-mv3v-67qporas.land/oras-go/v2@v2.6.02.6.2
LowGHSA-pg57-6jwg-q645github.com/containerd/containerd/v2@v2.3.22.3.6
LowGO-2026-4970stdlib@go1.26.41.25.12
LowGHSA-qgq7-7hm3-q39jgithub.com/go-git/go-git/v5@v5.19.15.19.2
LowGO-2026-5777github.com/go-chi/chi/v5@v5.2.55.3.0
LowGO-2026-5775github.com/go-chi/chi/v5@v5.2.55.3.0
LowGHSA-rq77-p4h8-4crwgithub.com/gorilla/csrf@v1.7.21.7.3
LowGHSA-qc2q-p7wx-3px3google.golang.org/grpc@v1.81.11.83.1
LowGO-2026-6179golang.org/x/mod@v0.36.00.40.0
LowGO-2026-5025golang.org/x/net@v0.54.00.55.0
LowGHSA-6pjf-3r9x-m592github.com/distribution/distribution@v2.8.2+incompatibleno fix listed
LowGO-2026-6091stdlib@go1.26.41.25.13
LowGHSA-hrxh-6v49-42gfgoogle.golang.org/grpc@v1.81.11.82.1
LowGHSA-685w-q87j-wqw3github.com/docker/distribution@v0.0.0-20260701071724-493dca9a81a8+dirtyno fix listed
LowGO-2022-0646github.com/aws/aws-sdk-go@v1.55.8no fix listed
LowGO-2026-5856stdlib@go1.26.41.25.12

Indexed versions

VersionPublishedApp versionVulnerabilitiesRadar Score
1.19.4latestyesterday2.15.4——
1.19.22 months ago2.15.210532393,440

The latest version and the previous major, as selected nightly from the repository’s index.

README badge
[![Radar Score](https://charts.stackradar.io/badge/wener/harbor.svg)](https://charts.stackradar.io/charts/wener/harbor)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.

helm v3.16.4 · syft 1.42.1 · rendered 4 Oct 2026 · scanned 16 Oct 2026 · advisories as of 16 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.