StackRadar

CVE-2026-0603

High

Advisory

Published 23 Jan 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.3
base score, highest
EPSS
0.008
55th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
72
of 17,781 indexed, latest versions
Container images
68
deployed by those charts
Fix available
None
affected package

Hibernate vulnerable to SQL Injection

Carried by container images the latest versions of 72 of 17,781 indexed charts deploy, on 68 images.

Affected packageAffected versionsFixed inImages
hibernate-coremaven5.2.17.Final, 5.3.2.Final, 5.3.10.Final, 5.3.20.Final+20 moreno fix listed68
OSV records
GHSA-2p5w-cvg5-gc5c

Charts affected

72 by stars
ChartLatestAffected imagesRadar Score
user-data-ms-helm-chartnotesprojectchart0.1.01 of 2See more

user-data-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
vlebediantsev/user-data-ms-final-final:latest9319437f3c8f
hibernate-core@5.6.9.Final
no fix listed

Open the chart page →

5,873
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
hibernate-core@5.4.24.Final
no fix listed

Open the chart page →

6,037
bpjstk-serviceopenshift1.0.04 of 6See more

bpjstk-service openshift 1.0.0

4 of the 6 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
andrianrf/backoffice-be:latest6036614803d4
hibernate-core@5.6.15.Final
no fix listed
andrianrf/bpjstk-service:latest46abe878d9d8
hibernate-core@5.4.21.Final
no fix listed
andrianrf/bpjstk-simulator:latestb63fdb51d39d
hibernate-core@5.4.21.Final
no fix listed
andrianrf/iso-client:latestba560086ce15
hibernate-core@5.4.21.Final
no fix listed

Open the chart page →

34,671
smsf-configurationopenshift1.0.41 of 1See more

smsf-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
gurolakman/smsf-configuration:1.0.49abb3882bcbd
hibernate-core@5.6.7.Final
no fix listed

Open the chart page →

13,607
ussigw-configurationopenshift1.0.41 of 1See more

ussigw-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
hibernate-core@5.6.7.Final
no fix listed

Open the chart page →

13,455
p4p40.1.01 of 7See more

p4 p4 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
mastercloudapps/server:v2.23f3d24dfe2686
hibernate-core@5.6.14.Final
no fix listed

Open the chart page →

27,537
myappp4-helm0.1.01 of 6See more

myapp p4-helm 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
fjvela/urjc-fjvela-worker:1.0.170cebf67bd66
hibernate-core@5.4.8.Final
no fix listed

Open the chart page →

19,720
Practica_4_helmpr04helm0.1.01 of 7See more

Practica_4_helm pr04helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
codeurjc/server:v1.0310bea5b1ee7
hibernate-core@5.6.14.Final
no fix listed

Open the chart page →

27,558
management-portalradar-baseVerified publisher1.7.01 of 1See more

management-portal radar-base 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
hibernate-core@5.6.15.Final
no fix listed

Open the chart page →

3,182
reportportalreportportal5.7.23 of 8See more

reportportal reportportal 5.7.2

3 of the 8 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
reportportal/service-api:5.7.29df41f8fb320
hibernate-core@5.4.18.Final
no fix listed
reportportal/service-authorization:5.7.09e73114dbd15
hibernate-core@5.4.18.Final
no fix listed
reportportal/service-jobs:5.7.2dc166c58485a
hibernate-core@5.4.28.Final
no fix listed

Open the chart page →

25,737
helm-chart-examplesalaboy0.1.01 of 1See more

helm-chart-example salaboy 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
salaboy/fmtok8s-monolith:v0.1.0f225568e6d03
hibernate-core@5.4.18.Final
no fix listed

Open the chart page →

2,847
simple-keycloaksikalabs0.1.01 of 1See more

simple-keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.18830f76112b6
hibernate-core@5.6.12.Final
no fix listed

Open the chart page →

6,443
atlassian-confluencesomeblackmagic3.4.11 of 1See more

atlassian-confluence someblackmagic 3.4.1

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
atlassian/confluence-server:7.10.03b9222ab32ef
hibernate-core@5.3.2.Final
no fix listed

Open the chart page →

13,605
smtp-fake-serversomeblackmagic0.1.01 of 1See more

smtp-fake-server someblackmagic 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
someblackmagic/smtp-fake-server:latest0d63ba37a560
hibernate-core@5.4.25.Final
no fix listed

Open the chart page →

4,278
umsappstacksimplifyVerified publisher1.0.01 of 3See more

umsapp stacksimplify 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
ghcr.io/stacksimplify/kube-usermgmt-webapp:1.0.0-mysqldb41b45003c6b6
hibernate-core@5.3.10.Final
no fix listed

Open the chart page →

6,101
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
hibernate-core@5.4.24.Final
no fix listed

Open the chart page →

18,756
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
thingsboard/tb-node:3.4.1645f43b688f7
hibernate-core@5.6.9.Final
no fix listed

Open the chart page →

25,394
webapp-db-javawebapp-db-java-repo0.1.01 of 2See more

webapp-db-java webapp-db-java-repo 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
arturisimo/webapp-db-java:v2c95524e90b57
hibernate-core@5.6.4.Final
no fix listed

Open the chart page →

2,566
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
hibernate-core@5.3.20.Final
no fix listed

Open the chart page →

28,605
apicurio-registry-sqlwitcom-gmbh0.1.01 of 1See more

apicurio-registry-sql witcom-gmbh 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
apicurio/apicurio-registry-jpa:1.3.2.Final44eeddd3562c
hibernate-core@5.4.22.Final
no fix listed

Open the chart page →

3,424
zahori-serverzahoriVerified publisher1.0.11 of 2See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
zahoriaut/zahori-server:0.1.17b2de13916f3e
hibernate-core@5.6.14.Final
no fix listed

Open the chart page →

5,846
keycloakxzaks2.2.01 of 1See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-0603.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
hibernate-core@5.6.14.Final
no fix listed

Open the chart page →

6,016

Container images carrying it

68 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
codeurjc/server:v1.0310bea5b1ee7
hibernate-core@5.6.14.Final
no fix listed
8
mastercloudapps/server:v2.23f3d24dfe2686
hibernate-core@5.6.14.Final
no fix listed
4
quay.io/keycloak/keycloak:20.0054ef67eb7da
hibernate-core@5.6.14.Final
no fix listed
2
quay.io/keycloak/keycloak:17.0.1-legacy68f9f38c8f30
hibernate-core@5.3.24.Final
no fix listed
2
1dev/server:11.9.0cd5b12fe5471
hibernate-core@5.4.24.Final
no fix listed
1
andrianrf/backoffice-be:latest6036614803d4
hibernate-core@5.6.15.Final
no fix listed
1
andrianrf/bpjstk-service:latest46abe878d9d8
hibernate-core@5.4.21.Final
no fix listed
1
andrianrf/bpjstk-simulator:latestb63fdb51d39d
hibernate-core@5.4.21.Final
no fix listed
1
andrianrf/iso-client:latestba560086ce15
hibernate-core@5.4.21.Final
no fix listed
1
apicurio/apicurio-registry-jpa:1.3.2.Final44eeddd3562c
hibernate-core@5.4.22.Final
no fix listed
1
arturisimo/webapp-db-java:v2c95524e90b57
hibernate-core@5.6.4.Final
no fix listed
1
assistiot/identity-manager_kc:latest0df4b4fa899a
hibernate-core@5.3.24.Final
no fix listed
1
atlassian/confluence-server:7.10.03b9222ab32ef
hibernate-core@5.3.2.Final
no fix listed
1
atlassian/crowd:5.2.2ebf761c7d437
hibernate-core@5.4.32.Final
no fix listed
1
beastob/url-shortener:1.0.299a49885ab33
hibernate-core@5.4.32.Final
no fix listed
1
binhex/arch-nzbhydra2:3.1.0-1-01fb8952921ab6
hibernate-core@5.4.17.Final
no fix listed
1
bitnamilegacy/keycloak:20.0.5cb04e49e6eb1
hibernate-core@5.6.14.Final
no fix listed
1
chandanteekinavar/findery-market-order-service:1.00cf52bf5ee9a
hibernate-core@5.4.32.Final
no fix listed
1
dannielkil/book-backend:lateste3b479a55a69
hibernate-core@5.6.10.Final
no fix listed
1
davidvmar/urjc-davidvmar-worker:1.0.10d221e834a21
hibernate-core@5.4.8.Final
no fix listed
1
fiware/mintaka:0.7.092a3c5cf43c0
hibernate-core@5.6.10.Final
no fix listed
1
fiware/mintaka:latestefc6793388cc
hibernate-core@5.6.10.Final
no fix listed
1
fjvela/urjc-fjvela-worker:1.0.170cebf67bd66
hibernate-core@5.4.8.Final
no fix listed
1
folioci/mod-agreements:latest29c3f233a498
hibernate-core@5.6.15.Final
no fix listed
1
folioci/mod-licenses:latestcfd6109bf477
hibernate-core@5.6.15.Final
no fix listed
1
folioci/mod-oa:latestae3b069d4ba5
hibernate-core@5.6.15.Final
no fix listed
1
folioci/mod-serials-management:latest571fa1ffe8c9
hibernate-core@5.6.15.Final
no fix listed
1
folioci/mod-service-interaction:latestf53c327a48e8
hibernate-core@5.6.15.Final
no fix listed
1
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
hibernate-core@5.4.27.Final
no fix listed
1
geonode/geoserver:2.28.4-latest81b1d431b7e9
hibernate-core@5.6.15.Final
no fix listed
1
gridgain/community:8.9.11d32d182a0e6a
hibernate-core@5.4.24.Final
no fix listed
1
gurolakman/smsf-configuration:1.0.49abb3882bcbd
hibernate-core@5.6.7.Final
no fix listed
1
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
hibernate-core@5.6.7.Final
no fix listed
1
jingking/geonetwork-hnap:4.2.843e74ab234e1
hibernate-core@5.6.7.Final
no fix listed
1
kimb88/hello-world-spring-boot:latest0639155241cb
hibernate-core@5.2.17.Final
no fix listed
1
library/xwiki:lts-postgres-tomcat56490ac14a31
hibernate-core@5.6.15.Final
no fix listed
1
platform9community/customers-service:latest2089811e5cc6
hibernate-core@5.4.17.Final
no fix listed
1
platform9community/vets-service:latestd1165c94dfb3
hibernate-core@5.4.17.Final
no fix listed
1
platform9community/visits-service:latest8d11b50368c6
hibernate-core@5.4.17.Final
no fix listed
1
pmoscode/axelor-open-suite:v7.2.57a58f4d762f5c
hibernate-core@5.6.12.Final
no fix listed
1
refar/apm-api:v5.7.1241373fa2972
hibernate-core@5.4.18.Final
no fix listed
1
reportportal/service-api:5.7.29df41f8fb320
hibernate-core@5.4.18.Final
no fix listed
1
reportportal/service-authorization:5.7.09e73114dbd15
hibernate-core@5.4.18.Final
no fix listed
1
reportportal/service-jobs:5.7.2dc166c58485a
hibernate-core@5.4.28.Final
no fix listed
1
robotshop/rs-shipping:latest89753ab48919
hibernate-core@5.4.20.Final
no fix listed
1
salaboy/fmtok8s-monolith:v0.1.0f225568e6d03
hibernate-core@5.4.18.Final
no fix listed
1
sdandey/dandey-apps:kanban-board-kanban-appbef0f599737b
hibernate-core@5.3.10.Final
no fix listed
1
sismics/docs:v1.10f4b0ef019cf1
hibernate-core@5.4.27.Final
no fix listed
1
someblackmagic/smtp-fake-server:latest0d63ba37a560
hibernate-core@5.4.25.Final
no fix listed
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
hibernate-core@5.4.24.Final
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.