StackRadar

CVE-2026-104635

High

Advisory

Published 13 Oct 2026In the index since 14 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
20
of 18,117 indexed, latest versions
Container images
18
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 20 of 18,117 indexed charts deploy, on 18 images.

Affected packageAffected versionsFixed inImages
protobufdeb2.6.1-1.3, 3.0.0-9, 3.0.0-9.1ubuntu1, 3.0.0-9.1ubuntu1.1+6 moreno fix listed18
OSV records
UBUNTU-CVE-2026-104635

Charts affected

20 by stars
ChartLatestAffected imagesRadar Score
mysqlkubelauncherVerified publisher0.4.61 of 1See more

mysql kubelauncher 0.4.6

1 of the 1 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/mysqldigest-pinnedb25f98e6a86f
protobuf@3.21.12-15ubuntu1
no fix listed

Open the chart page →

771
headwind-mdmchristianhuthVerified publisher6.0.01 of 1See more

headwind-mdm christianhuth 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
headwindmdm/hmdm:0.1.93550b4840840
protobuf@3.12.4-1ubuntu7.22.04.6
no fix listed

Open the chart page →

3,148
kamu-api-serverkamuVerified publisher0.93.01 of 1See more

kamu-api-server kamu 0.93.0

1 of the 1 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
ghcr.io/kamu-data/kamu-api-server:0.93.0a743ebe54204
protobuf@3.6.1.3-2ubuntu5.2
no fix listed

Open the chart page →

7,829
edgelessdbedgelesssysVerified publisher0.3.21 of 1See more

edgelessdb edgelesssys 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
ghcr.io/edgelesssys/edgelessdb-sgx-1gb:v0.3.27e1d7a11a11a
protobuf@3.6.1.3-2ubuntu5
no fix listed

Open the chart page →

5,149
mumblesyntaxerror404Verified publisher1.0.51 of 1See more

mumble syntaxerror404 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
ghcr.io/mumble-voip/mumble-server:v1.6.8703da59810c075
protobuf@3.21.12-8.2ubuntu0.3
no fix listed

Open the chart page →

1,194
videoaugmentationassist-iot-video-augmentation0.1.01 of 3See more

videoaugmentation assist-iot-video-augmentation 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
assistiot/video_augmentation:runner-cpu-lateste5ae539ce2cb
protobuf@3.6.1.3-2ubuntu5.2
no fix listed

Open the chart page →

77,997
otbrcharts-derwitt-devVerified publisher0.2.01 of 1See more

otbr charts-derwitt-dev 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
openthread/otbr:latest49b352ce39dd
protobuf@3.0.0-9.1ubuntu1.1
no fix listed

Open the chart page →

66,307
webpagetest-agentcloudnativeapp0.2.01 of 1See more

webpagetest-agent cloudnativeapp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
protobuf@2.6.1-1.3
no fix listed

Open the chart page →

136,640
marblerun-coordinatoredgelesssysVerified publisher0.5.01 of 1See more

marblerun-coordinator edgelesssys 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
ghcr.io/edgelesssys/coordinator:v0.5.0bcd5b8d4c45c
protobuf@3.0.0-9.1ubuntu1
no fix listed

Open the chart page →

12,560
business-api-ecosystemfiware1.2.01 of 4See more

business-api-ecosystem fiware 1.2.0

1 of the 4 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
protobuf@3.6.1.3-2ubuntu5.2
no fix listed

Open the chart page →

119,061
xtevegeek-cookbookVerified publisher8.4.21 of 1See more

xteve geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/xteve:v2.2.0.200292b3614670f
protobuf@3.6.1.3-2ubuntu5
no fix listed

Open the chart page →

19,903
tcs-issuerintelVerified publisher0.5.01 of 2See more

tcs-issuer intel 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
intel/trusted-certificate-issuer:0.5.0591a9db4a427
protobuf@3.6.1.3-2ubuntu5
no fix listed

Open the chart page →

7,120
cdn-remoteopencord0.2.41 of 3See more

cdn-remote opencord 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:1.0.0d59ccb138ffb
protobuf@2.6.1-1.3
no fix listed

Open the chart page →

65,738
mcord-cdn-remoteopencord0.1.61 of 2See more

mcord-cdn-remote opencord 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:remote-v3d59ccb138ffb
protobuf@2.6.1-1.3
no fix listed

Open the chart page →

44,524
mcord-cdn-remote-freeopencord0.1.31 of 1See more

mcord-cdn-remote-free opencord 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:remote-v3d59ccb138ffb
protobuf@2.6.1-1.3
no fix listed

Open the chart page →

30,593
sebaopencord1.0.02 of 17See more

seba opencord 1.0.0

2 of the 17 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
voltha/voltha-netconf:1.6.037f80524c207
protobuf@3.0.0-9
no fix listed
voltha/voltha-ofagent:1.6.09ee8c1f4428c
protobuf@3.0.0-9
no fix listed

Open the chart page →

366,899
substreams-sink-kvpinaxVerified publisher0.0.41 of 1See more

substreams-sink-kv pinax 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/substreams-sink-kv:v2.3.026953ec68d5d
protobuf@3.6.1.3-2ubuntu5.2
no fix listed

Open the chart page →

59,281
substreams-sink-nooppinaxVerified publisher0.0.31 of 1See more

substreams-sink-noop pinax 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/substreams-sink-noop:v1.4.0d7c43c3135c6
protobuf@3.6.1.3-2ubuntu5.2
no fix listed

Open the chart page →

59,211
kurento_webrtc_demostunner0.1.01 of 2See more

kurento_webrtc_demo stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
kurento/kurento-media-server:latest03c0d34d0828
protobuf@3.21.12-8.2ubuntu0.2
no fix listed

Open the chart page →

14,002
stunner-kurento-one2one-callstunner0.1.01 of 2See more

stunner-kurento-one2one-call stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-104635.

Container imageDigestPackageFixed in
kurento/kurento-media-server:latest03c0d34d0828
protobuf@3.21.12-8.2ubuntu0.2
no fix listed

Open the chart page →

14,002

Container images carrying it

18 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
omecproject/cdn-video-repo:1.0.0:remote-v3d59ccb138ffb
protobuf@2.6.1-1.3
no fix listed
3
kurento/kurento-media-server:latest03c0d34d0828
protobuf@3.21.12-8.2ubuntu0.2
no fix listed
2
assistiot/video_augmentation:runner-cpu-lateste5ae539ce2cb
protobuf@3.6.1.3-2ubuntu5.2
no fix listed
1
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
protobuf@3.6.1.3-2ubuntu5.2
no fix listed
1
headwindmdm/hmdm:0.1.93550b4840840
protobuf@3.12.4-1ubuntu7.22.04.6
no fix listed
1
intel/trusted-certificate-issuer:0.5.0591a9db4a427
protobuf@3.6.1.3-2ubuntu5
no fix listed
1
openthread/otbr:latest49b352ce39dd
protobuf@3.0.0-9.1ubuntu1.1
no fix listed
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
protobuf@2.6.1-1.3
no fix listed
1
voltha/voltha-netconf:1.6.037f80524c207
protobuf@3.0.0-9
no fix listed
1
voltha/voltha-ofagent:1.6.09ee8c1f4428c
protobuf@3.0.0-9
no fix listed
1
ghcr.io/edgelesssys/coordinator:v0.5.0bcd5b8d4c45c
protobuf@3.0.0-9.1ubuntu1
no fix listed
1
ghcr.io/edgelesssys/edgelessdb-sgx-1gb:v0.3.27e1d7a11a11a
protobuf@3.6.1.3-2ubuntu5
no fix listed
1
ghcr.io/k8s-at-home/xteve:v2.2.0.200292b3614670f
protobuf@3.6.1.3-2ubuntu5
no fix listed
1
ghcr.io/kamu-data/kamu-api-server:0.93.0a743ebe54204
protobuf@3.6.1.3-2ubuntu5.2
no fix listed
1
ghcr.io/kubelauncher/mysqlb25f98e6a86f
protobuf@3.21.12-15ubuntu1
no fix listed
1
ghcr.io/mumble-voip/mumble-server:v1.6.8703da59810c075
protobuf@3.21.12-8.2ubuntu0.3
no fix listed
1
ghcr.io/streamingfast/substreams-sink-kv:v2.3.026953ec68d5d
protobuf@3.6.1.3-2ubuntu5.2
no fix listed
1
ghcr.io/streamingfast/substreams-sink-noop:v1.4.0d7c43c3135c6
protobuf@3.6.1.3-2ubuntu5.2
no fix listed
1

syft 1.42.1 · advisories as of 14 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.