StackRadar

CVE-2026-106454

Medium

Advisory

Published 7 Oct 2026In the index since 8 Oct 2026
Severity
Medium
worst across findings
CVSS
4.3
base score, highest
EPSS
0.003
25th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
43
of 18,137 indexed, latest versions
Container images
48
deployed by those charts
Fix available
None
affected packages

Twisted: IMAP wildcardToRegexp() ReDoS

Carried by container images the latest versions of 43 of 18,137 indexed charts deploy, on 48 images.

Affected packageAffected versionsFixed inImages
twistedpypi16.6.0, 16.7.0rc2, 17.9.0, 18.9.0+13 moreno fix listed48
twisteddeb17.9.0-2ubuntu0.1no fix listed2
OSV records
GHSA-8pqf-f4m5-798gUBUNTU-CVE-2026-106454
Also known as
PYSEC-2026-4304

Charts affected

43 by stars
ChartLatestAffected imagesRadar Score
weblateweblateOfficialVerified publisher0.5.431 of 3See more

weblate weblate 0.5.43

1 of the 3 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
weblate/weblate:2026.10.1.1b0f200f38d70
twisted@26.4.0
no fix listed

Open the chart page →

7,565
synapsehalkeye0.40.01 of 2See more

synapse halkeye 0.40.0

1 of the 2 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
twisted@24.3.0
no fix listed

Open the chart page →

7,677
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
twisted@20.3.0
no fix listed

Open the chart page →

39,230
openvpn-asas-helm-chartOfficialVerified publisher0.2.11 of 1See more

openvpn-as as-helm-chart 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
openvpn/openvpn-as:latest2253c10ec652
twisted@25.5.0
no fix listed

Open the chart page →

3,325
baserowbaserow-chartVerified publisher1.1.11 of 6See more

baserow baserow-chart 1.1.1

1 of the 6 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
baserow/backend:2.4.1497347d0ba74
twisted@26.4.0
no fix listed

Open the chart page →

19,315
matrixzekker6Verified publisher3.32.01 of 4See more

matrix zekker6 3.32.0

1 of the 4 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.162.06b84a7bbac36
twisted@25.5.0
no fix listed

Open the chart page →

6,268
convertigoconvertigoOfficialVerified publisher8.4.61 of 5See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
twisted@24.3.0
no fix listed

Open the chart page →

17,574
psonoankra-chartsVerified publisher1.2.01 of 2See more

psono ankra-charts 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
psono/psono-server:5.0.03b974b43ea03
twisted@24.7.0
no fix listed

Open the chart page →

2,546
anteonanteonVerified publisher2.6.42 of 13See more

anteon anteon 2.6.4

2 of the 13 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
twisted@24.7.0
no fix listed
ddosify/selfhosted_backend:3.2.93c11e3182652
twisted@24.3.0
no fix listed

Open the chart page →

28,233
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latest6acb4a5903eb
twisted@24.11.0
no fix listed

Open the chart page →

2,214
paperlessgeek-cookbookVerified publisher9.2.01 of 1See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
twisted@22.4.0
no fix listed

Open the chart page →

4,850
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
twisted@25.5.0
no fix listed

Open the chart page →

67,978
vmware-exporterkremers2.3.01 of 1See more

vmware-exporter kremers 2.3.0

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
pryorda/vmware_exporter:v0.18.479925e63e59f
twisted@22.8.0
no fix listed

Open the chart page →

1,251
delugerubxkubeVerified publisher1.2.11 of 1See more

deluge rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
linuxserver/deluge:18.04.10ac871624394
twisted@17.9.0-2ubuntu0.1
twisted@17.9.0
no fix listed
no fix listed

Open the chart page →

14,191
prometheus-pve-exporterstenicVerified publisher0.1.11 of 1See more

prometheus-pve-exporter stenic 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
prompve/prometheus-pve-exporter:2.0.1ff6749eb03b0
twisted@20.3.0
no fix listed

Open the chart page →

2,564
synapsesudermanjr1.1.51 of 1See more

synapse sudermanjr 1.1.5

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
twisted@22.1.0
no fix listed

Open the chart page →

4,251
ddosifyanteonVerified publisher1.7.52 of 13See more

ddosify anteon 1.7.5

2 of the 13 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
twisted@24.3.0
no fix listed
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
twisted@24.3.0
no fix listed

Open the chart page →

31,850
argonix-apiargonix0.6.51 of 4See more

argonix-api argonix 0.6.5

1 of the 4 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api:0.6.5431abcce7c1e
twisted@26.4.0
no fix listed

Open the chart page →

6,186
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
twisted@21.2.0
no fix listed

Open the chart page →

87,228
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
twisted@24.3.0
no fix listed

Open the chart page →

12,306
duoauthproxy-radius-simplecaerus0.1.01 of 1See more

duoauthproxy-radius-simple caerus 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
ethanbergstrom/duoauthproxy:5.5.0345c2a46c103
twisted@20.3.0
no fix listed

Open the chart page →

3,255
vmware-exporterdniel0.0.11 of 1See more

vmware-exporter dniel 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
pryorda/vmware_exporter:v0.18.3e0f5ba8b7856
twisted@22.2.0
no fix listed

Open the chart page →

1,423
pritunldysnixVerified publisher0.2.71 of 3See more

pritunl dysnix 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
dysnix/pritunl:v1.29-r819951e3e7a32
twisted@20.3.0
no fix listed

Open the chart page →

7,017
demo-workflowsfrinx-helm-charts2.0.01 of 3See more

demo-workflows frinx-helm-charts 2.0.0

1 of the 3 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
frinx/sample-topology:6.1.01a19658415b6
twisted@16.7.0rc2
no fix listed

Open the chart page →

2,746
sample-topologyfrinx-helm-charts3.1.11 of 1See more

sample-topology frinx-helm-charts 3.1.1

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
frinx/sample-topology:6.1.01a19658415b6
twisted@16.7.0rc2
no fix listed

Open the chart page →

1,267
delugegeek-cookbookVerified publisher5.4.21 of 1See more

deluge geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
linuxserver/deluge:version-2.0.3-2201906121747ubuntu18.04.12ce561a95e7b
twisted@17.9.0-2ubuntu0.1
twisted@17.9.0
no fix listed
no fix listed

Open the chart page →

14,200
librechat-exporterhajowielandVerified publisher1.0.01 of 1See more

librechat-exporter hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
ghcr.io/virtuos/librechat_exporter:2.0.050ea1cf0086f
twisted@24.11.0
no fix listed

Open the chart page →

2,610
archiveboxhelmforgeVerified publisher1.1.141 of 1See more

archivebox helmforge 1.1.14

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
archivebox/archivebox:0.9.73d4720d86c0e9
twisted@26.4.0
no fix listed

Open the chart page →

6,393
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
twisted@25.5.0
no fix listed

Open the chart page →

21,318
jx-app-anchorejenkins-x0.0.41 of 2See more

jx-app-anchore jenkins-x 0.0.4

1 of the 2 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
anchore/anchore-engine:v0.7.1ed9b3badd17c
twisted@20.3.0
no fix listed

Open the chart page →

10,790
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
twisted@22.10.0
no fix listed

Open the chart page →

84,313
delugelib42Verified publisher1.3.01 of 1See more

deluge lib42 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
lib42/deluge:20c4d1d326f95
twisted@22.10.0
no fix listed

Open the chart page →

1,062
delugelinkding0.2.31 of 1See more

deluge linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
linuxserver/deluge:libtorrentv1-2.2.0-ls40052eac68ccc0
twisted@24.11.0
no fix listed

Open the chart page →

1,778
splashntppoolVerified publisher1.0.41 of 1See more

splash ntppool 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
scrapinghub/splash:3.4.1a5f89bc84606
twisted@19.7.0
no fix listed

Open the chart page →

95,096
anchore-engineopencloudcx1.13.01 of 2See more

anchore-engine opencloudcx 1.13.0

1 of the 2 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
anchore/anchore-engine:v0.10.0bde9eedf639d
twisted@20.3.0
no fix listed

Open the chart page →

19,948
comacopencord1.0.03 of 9See more

comac opencord 1.0.0

3 of the 9 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
omecproject/kubernetes-synchronizer:comac-1.0.07c17a7b1d1ef
twisted@18.9.0
no fix listed
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
twisted@16.6.0
no fix listed
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
twisted@16.6.0
no fix listed

Open the chart page →

258,132
comac-platformopencord0.0.172 of 11See more

comac-platform opencord 0.0.17

2 of the 11 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
omecproject/kubernetes-synchronizer:comac-1.0.07c17a7b1d1ef
twisted@18.9.0
no fix listed
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
twisted@16.6.0
no fix listed

Open the chart page →

82,091
ponsimv2opencord1.2.31 of 2See more

ponsimv2 opencord 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
voltha/voltha-tester:1.7.0655c3048a602
twisted@17.9.0
no fix listed

Open the chart page →

67,176
sebaopencord1.0.04 of 17See more

seba opencord 1.0.0

4 of the 17 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
voltha/voltha-cli:1.6.0c4e41e92f046
twisted@17.9.0
no fix listed
voltha/voltha-netconf:1.6.037f80524c207
twisted@17.9.0
no fix listed
voltha/voltha-ofagent:1.6.09ee8c1f4428c
twisted@17.9.0
no fix listed
voltha/voltha-voltha:1.6.0ff596b62de59
twisted@17.9.0
no fix listed

Open the chart page →

366,105
delugeretsamedocVerified publisher26.9.01 of 1See more

deluge retsamedoc 26.9.0

1 of the 1 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
linuxserver/deluge:2.2.0bf306ddd5e6d
twisted@26.4.0
no fix listed

Open the chart page →

93
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
twisted@24.7.0
no fix listed

Open the chart page →

12,049
synapsetranhailongVerified publisher0.1.01 of 2See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.78.0def97fd537d8
twisted@22.10.0
no fix listed

Open the chart page →

3,607
dingtalk-botxxl-job-adminVerified publisher0.1.31 of 2See more

dingtalk-bot xxl-job-admin 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-106454.

Container imageDigestPackageFixed in
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
twisted@25.5.0
no fix listed

Open the chart page →

3,882

Container images carrying it

48 by charts deploying them

A fixed version is listed for 0 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
frinx/sample-topology:6.1.01a19658415b6
twisted@16.7.0rc2
no fix listed
2
omecproject/kubernetes-synchronizer:comac-1.0.07c17a7b1d1ef
twisted@18.9.0
no fix listed
2
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
twisted@16.6.0
no fix listed
2
anchore/anchore-engine:v0.10.0bde9eedf639d
twisted@20.3.0
no fix listed
1
anchore/anchore-engine:v0.7.1ed9b3badd17c
twisted@20.3.0
no fix listed
1
archivebox/archivebox:0.9.73d4720d86c0e9
twisted@26.4.0
no fix listed
1
baserow/backend:2.4.1497347d0ba74
twisted@26.4.0
no fix listed
1
baserow/backend:1.31.1e0b3c8130b91
twisted@24.3.0
no fix listed
1
baserow/baserow:1.30.1df0c42eb67e8
twisted@24.3.0
no fix listed
1
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
twisted@24.3.0
no fix listed
1
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
twisted@24.7.0
no fix listed
1
ddosify/selfhosted_backend:3.2.93c11e3182652
twisted@24.3.0
no fix listed
1
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
twisted@24.3.0
no fix listed
1
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
twisted@25.5.0
no fix listed
1
dysnix/pritunl:v1.29-r819951e3e7a32
twisted@20.3.0
no fix listed
1
ethanbergstrom/duoauthproxy:5.5.0345c2a46c103
twisted@20.3.0
no fix listed
1
gethue/hue:4.11.011b649636e68
twisted@22.10.0
no fix listed
1
gethue/hue:4.10.05702b2c37ff9
twisted@21.2.0
no fix listed
1
gethue/hue:latest7d5c1b9f8a79
twisted@25.5.0
no fix listed
1
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
twisted@20.3.0
no fix listed
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
twisted@25.5.0
no fix listed
1
lib42/deluge:20c4d1d326f95
twisted@22.10.0
no fix listed
1
linuxserver/deluge:libtorrentv1-2.2.0-ls40052eac68ccc0
twisted@24.11.0
no fix listed
1
linuxserver/deluge:18.04.10ac871624394
twisted@17.9.0-2ubuntu0.1
twisted@17.9.0
no fix listed
no fix listed
1
linuxserver/deluge:version-2.0.3-2201906121747ubuntu18.04.12ce561a95e7b
twisted@17.9.0-2ubuntu0.1
twisted@17.9.0
no fix listed
no fix listed
1
linuxserver/deluge:2.2.0bf306ddd5e6d
twisted@26.4.0
no fix listed
1
matrixdotorg/synapse:v1.162.06b84a7bbac36
twisted@25.5.0
no fix listed
1
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
twisted@24.7.0
no fix listed
1
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
twisted@22.1.0
no fix listed
1
matrixdotorg/synapse:v1.78.0def97fd537d8
twisted@22.10.0
no fix listed
1
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
twisted@16.6.0
no fix listed
1
openvpn/openvpn-as:latest2253c10ec652
twisted@25.5.0
no fix listed
1
prompve/prometheus-pve-exporter:2.0.1ff6749eb03b0
twisted@20.3.0
no fix listed
1
pryorda/vmware_exporter:v0.18.479925e63e59f
twisted@22.8.0
no fix listed
1
pryorda/vmware_exporter:v0.18.3e0f5ba8b7856
twisted@22.2.0
no fix listed
1
psono/psono-server:5.0.03b974b43ea03
twisted@24.7.0
no fix listed
1
scrapinghub/splash:3.4.1a5f89bc84606
twisted@19.7.0
no fix listed
1
voltha/voltha-cli:1.6.0c4e41e92f046
twisted@17.9.0
no fix listed
1
voltha/voltha-netconf:1.6.037f80524c207
twisted@17.9.0
no fix listed
1
voltha/voltha-ofagent:1.6.09ee8c1f4428c
twisted@17.9.0
no fix listed
1
voltha/voltha-tester:1.7.0655c3048a602
twisted@17.9.0
no fix listed
1
voltha/voltha-voltha:1.6.0ff596b62de59
twisted@17.9.0
no fix listed
1
weblate/weblate:2026.10.1.1b0f200f38d70
twisted@26.4.0
no fix listed
1
ghcr.io/argonix-io/argonix-api:0.6.5431abcce7c1e
twisted@26.4.0
no fix listed
1
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
twisted@24.3.0
no fix listed
1
ghcr.io/gabe565/obico/web:latest6acb4a5903eb
twisted@24.11.0
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
twisted@22.4.0
no fix listed
1
ghcr.io/virtuos/librechat_exporter:2.0.050ea1cf0086f
twisted@24.11.0
no fix listed
1

syft 1.42.1 · advisories as of 16 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.