StackRadar

CVE-2026-0603

High

Advisory

Published 23 Jan 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.3
base score, highest
EPSS
0.008
55th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
72
of 17,781 indexed, latest versions
Container images
68
deployed by those charts
Fix available
None
affected package

Hibernate vulnerable to SQL Injection

Carried by container images the latest versions of 72 of 17,781 indexed charts deploy, on 68 images.

Affected packageAffected versionsFixed inImages
hibernate-coremaven5.2.17.Final, 5.3.2.Final, 5.3.10.Final, 5.3.20.Final+20 moreno fix listed68
OSV records
GHSA-2p5w-cvg5-gc5c

Charts affected

72 by stars
ChartLatestAffected imagesRadar Score
user-data-ms-helm-chartnotesprojectchart0.1.01 of 2See more

user-data-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
vlebediantsev/user-data-ms-final-final:latest9319437f3c8f
hibernate-core@5.6.9.Final
no fix listed

Open the chart page →

5,873
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
hibernate-core@5.4.24.Final
no fix listed

Open the chart page →

6,037
bpjstk-serviceopenshift1.0.04 of 6See more

bpjstk-service openshift 1.0.0

4 of the 6 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
andrianrf/backoffice-be:latest6036614803d4
hibernate-core@5.6.15.Final
no fix listed
andrianrf/bpjstk-service:latest46abe878d9d8
hibernate-core@5.4.21.Final
no fix listed
andrianrf/bpjstk-simulator:latestb63fdb51d39d
hibernate-core@5.4.21.Final
no fix listed
andrianrf/iso-client:latestba560086ce15
hibernate-core@5.4.21.Final
no fix listed

Open the chart page →

34,671
smsf-configurationopenshift1.0.41 of 1See more

smsf-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
gurolakman/smsf-configuration:1.0.49abb3882bcbd
hibernate-core@5.6.7.Final
no fix listed

Open the chart page →

13,607
ussigw-configurationopenshift1.0.41 of 1See more

ussigw-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
hibernate-core@5.6.7.Final
no fix listed

Open the chart page →

13,455
p4p40.1.01 of 7See more

p4 p4 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
mastercloudapps/server:v2.23f3d24dfe2686
hibernate-core@5.6.14.Final
no fix listed

Open the chart page →

27,537
myappp4-helm0.1.01 of 6See more

myapp p4-helm 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
fjvela/urjc-fjvela-worker:1.0.170cebf67bd66
hibernate-core@5.4.8.Final
no fix listed

Open the chart page →

19,720
Practica_4_helmpr04helm0.1.01 of 7See more

Practica_4_helm pr04helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
codeurjc/server:v1.0310bea5b1ee7
hibernate-core@5.6.14.Final
no fix listed

Open the chart page →

27,558
management-portalradar-baseVerified publisher1.7.01 of 1See more

management-portal radar-base 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
hibernate-core@5.6.15.Final
no fix listed

Open the chart page →

3,182
reportportalreportportal5.7.23 of 8See more

reportportal reportportal 5.7.2

3 of the 8 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
reportportal/service-api:5.7.29df41f8fb320
hibernate-core@5.4.18.Final
no fix listed
reportportal/service-authorization:5.7.09e73114dbd15
hibernate-core@5.4.18.Final
no fix listed
reportportal/service-jobs:5.7.2dc166c58485a
hibernate-core@5.4.28.Final
no fix listed

Open the chart page →

25,737
helm-chart-examplesalaboy0.1.01 of 1See more

helm-chart-example salaboy 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
salaboy/fmtok8s-monolith:v0.1.0f225568e6d03
hibernate-core@5.4.18.Final
no fix listed

Open the chart page →

2,847
simple-keycloaksikalabs0.1.01 of 1See more

simple-keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.18830f76112b6
hibernate-core@5.6.12.Final
no fix listed

Open the chart page →

6,443
atlassian-confluencesomeblackmagic3.4.11 of 1See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
atlassian/confluence-server:7.10.03b9222ab32ef
hibernate-core@5.3.2.Final
no fix listed

Open the chart page →

13,605
smtp-fake-serversomeblackmagic0.1.01 of 1See more

smtp-fake-server someblackmagic 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
someblackmagic/smtp-fake-server:latest0d63ba37a560
hibernate-core@5.4.25.Final
no fix listed

Open the chart page →

4,278
umsappstacksimplifyVerified publisher1.0.01 of 3See more

umsapp stacksimplify 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
ghcr.io/stacksimplify/kube-usermgmt-webapp:1.0.0-mysqldb41b45003c6b6
hibernate-core@5.3.10.Final
no fix listed

Open the chart page →

6,101
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
hibernate-core@5.4.24.Final
no fix listed

Open the chart page →

18,756
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
thingsboard/tb-node:3.4.1645f43b688f7
hibernate-core@5.6.9.Final
no fix listed

Open the chart page →

25,394
webapp-db-javawebapp-db-java-repo0.1.01 of 2See more

webapp-db-java webapp-db-java-repo 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
arturisimo/webapp-db-java:v2c95524e90b57
hibernate-core@5.6.4.Final
no fix listed

Open the chart page →

2,566
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
hibernate-core@5.3.20.Final
no fix listed

Open the chart page →

28,605
apicurio-registry-sqlwitcom-gmbh0.1.01 of 1See more

apicurio-registry-sql witcom-gmbh 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
apicurio/apicurio-registry-jpa:1.3.2.Final44eeddd3562c
hibernate-core@5.4.22.Final
no fix listed

Open the chart page →

3,424
zahori-serverzahoriVerified publisher1.0.11 of 2See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
zahoriaut/zahori-server:0.1.17b2de13916f3e
hibernate-core@5.6.14.Final
no fix listed

Open the chart page →

5,846
keycloakxzaks2.2.01 of 1See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
hibernate-core@5.6.14.Final
no fix listed

Open the chart page →

6,016

Container images carrying it

68 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
thingsboard/tb-node:3.4.1645f43b688f7
hibernate-core@5.6.9.Final
no fix listed
1
thingsboard/tb-node:3.6.0f40a542832c4
hibernate-core@5.6.15.Final
no fix listed
1
thmmniii/fbs-core:v1.27.15438517d9fc2
hibernate-core@5.6.15.Final
no fix listed
1
torrespro/mca-worker:2.0.06d3bd305a1ba
hibernate-core@5.4.8.Final
no fix listed
1
vlebediantsev/file-system-ms-final:latest10393a89b4a8
hibernate-core@5.6.9.Final
no fix listed
1
vlebediantsev/logic-ms:latestdf8bf38c535b
hibernate-core@5.6.9.Final
no fix listed
1
vlebediantsev/registration-ms-final:latest427af418b75e
hibernate-core@5.6.9.Final
no fix listed
1
vlebediantsev/user-data-ms-final-final:latest9319437f3c8f
hibernate-core@5.6.9.Final
no fix listed
1
zahoriaut/zahori-server:0.1.17b2de13916f3e
hibernate-core@5.6.14.Final
no fix listed
1
zbalogh/reservation-api-server:1.0.97c247e399a1f
hibernate-core@5.6.11.Final
no fix listed
1
ghcr.io/jfwenisch/discord-experiencebot:latestb52ff07f9f0c
hibernate-core@5.6.11.Final
no fix listed
1
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
hibernate-core@5.4.17.Final
no fix listed
1
ghcr.io/perceptolab/devops-demo-app:0.0.2cdc0658c40fb
hibernate-core@5.6.11.Final
no fix listed
1
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
hibernate-core@5.6.15.Final
no fix listed
1
ghcr.io/stacksimplify/kube-usermgmt-webapp:1.0.0-mysqldb41b45003c6b6
hibernate-core@5.3.10.Final
no fix listed
1
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
hibernate-core@5.3.20.Final
no fix listed
1
quay.io/keycloak/keycloak:20.0.18830f76112b6
hibernate-core@5.6.12.Final
no fix listed
1
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
hibernate-core@5.6.14.Final
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.