StackRadar

CVE-2026-109618

Critical

Advisory

Published 21 Oct 2026In the index since 22 Oct 2026
Severity
Critical
worst across findings
CVSS
9.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
26
of 18,219 indexed, latest versions
Container images
26
deployed by those charts
Fix available
7 of 7
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 26 of 18,219 indexed charts deploy, on 26 images.

Affected packageAffected versionsFixed inImages
php-8.3apk8.3.35-r2, 8.3.35-r38.3.35-r48
php7.4deb7.4.3-4ubuntu2.6, 7.4.3-4ubuntu2.12, 7.4.3-4ubuntu2.13, 7.4.3-4ubuntu2.15+1 more7.4.3-4ubuntu2.29+esm55
php8.1deb8.1.2-1ubuntu2.3, 8.1.2-1ubuntu2.14, 8.1.2-1ubuntu2.248.1.2-1ubuntu2.283
php8.2deb8.2.7-1~deb12u1, 8.2.31-1~deb12u1, 8.2.34-1~deb12u18.2.35-1~deb12u13
php8.3deb8.3.6-0ubuntu0.24.04.3, 8.3.6-0ubuntu0.24.04.5, 8.3.6-0ubuntu0.24.04.68.3.6-0ubuntu0.24.04.133
php-8.4apk8.4.26-r38.4.26-r43
php8.5deb8.5.9-0ubuntu18.5.9-0ubuntu2.11
OSV records
CGA-799f-vm39-p5vhCGA-jqc7-qx97-xvrvDEBIAN-CVE-2026-109618UBUNTU-CVE-2026-109618
Also known as
CGA-mjxf-rh4w-54ff, CGA-qrqp-vmm9-825p, USN-8948-1, USN-8948-2

Charts affected

26 by stars
ChartLatestAffected imagesRadar Score
zabbixzabbix-communityVerified publisher7.1.01 of 5See more

zabbix zabbix-community 7.1.0

1 of the 5 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
zabbix/zabbix-web-nginx-pgsql:ubuntu-7.0.237d4d58086515
php8.3@8.3.6-0ubuntu0.24.04.6
8.3.6-0ubuntu0.24.04.13

Open the chart page →

16,616
zabbixcetic3.1.31 of 5See more

zabbix cetic 3.1.3

1 of the 5 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
zabbix/zabbix-web-nginx-pgsql:ubuntu-6.0.899e9a090b516
php8.1@8.1.2-1ubuntu2.3
8.1.2-1ubuntu2.28

Open the chart page →

38,076
snipeitt3n3.4.11 of 2See more

snipeit t3n 3.4.1

1 of the 2 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
snipe/snipe-it:v6.0.1455fb7636a98c
php7.4@7.4.3-4ubuntu2.13
7.4.3-4ubuntu2.29+esm5

Open the chart page →

86,604
zabbix-serveraekondratievVerified publisher1.0.61 of 4See more

zabbix-server aekondratiev 1.0.6

1 of the 4 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
zabbix/zabbix-web-nginx-pgsql:ubuntu-5.4.601de79c31391
php7.4@7.4.3-4ubuntu2.6
7.4.3-4ubuntu2.29+esm5

Open the chart page →

32,401
tt-rssangelnu7.0.01 of 2See more

tt-rss angelnu 7.0.0

1 of the 2 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
ghcr.io/angelnu/tt-rss:2.0.10086c9d9ea1e37c4
php8.5@8.5.9-0ubuntu1
8.5.9-0ubuntu2.1

Open the chart page →

1,077
zabbix-server-mysqlfermosit3.0.21 of 4See more

zabbix-server-mysql fermosit 3.0.2

1 of the 4 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
zabbix/zabbix-web-nginx-mysql:ubuntu-6.4-latest0e5f69c4c54e
php8.3@8.3.6-0ubuntu0.24.04.3
8.3.6-0ubuntu0.24.04.13

Open the chart page →

14,316
rss-bridgegabe565Verified publisher0.5.21 of 1See more

rss-bridge gabe565 0.5.2

1 of the 1 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
ghcr.io/rss-bridge/rss-bridge:latestfcd6ac6335ef
php8.2@8.2.34-1~deb12u1
8.2.35-1~deb12u1

Open the chart page →

2,179
icinga2geek-cookbookVerified publisher4.2.01 of 1See more

icinga2 geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
jordan/icinga2:latestf75025fe8ea8
php8.2@8.2.31-1~deb12u1
8.2.35-1~deb12u1

Open the chart page →

10,839
nominatimheywood8-helm-chartsVerified publisher3.10.81 of 3See more

nominatim heywood8-helm-charts 3.10.8

1 of the 3 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
mediagis/nominatim:4.2d0eae7b51374
php8.1@8.1.2-1ubuntu2.14
8.1.2-1ubuntu2.28

Open the chart page →

15,662
kc-chartkc-chart1.0.01 of 3See more

kc-chart kc-chart 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
jhoncytech/bookworm-apache-wordpress:latest18c3ca1f411e
php8.2@8.2.7-1~deb12u1
8.2.35-1~deb12u1

Open the chart page →

10,338
phppgadminkfirfer0.1.121 of 1See more

phppgadmin kfirfer 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
kfirfer/phppgadmin:7.13.0-22efb4a5d74a3
php7.4@7.4.3-4ubuntu2.15
7.4.3-4ubuntu2.29+esm5

Open the chart page →

11,160
nominatimnominatim-chart1.3.01 of 3See more

nominatim nominatim-chart 1.3.0

1 of the 3 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
mediagis/nominatim:3.7c15e941485ef
php7.4@7.4.3-4ubuntu2.12
7.4.3-4ubuntu2.29+esm5

Open the chart page →

25,556
adminerquench-adminerVerified publisher0.0.91 of 1See more

adminer quench-adminer 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/adminerdigest-pinneda2a3c8b637fa
php-8.3@8.3.35-r2
8.3.35-r4

Open the chart page →

52
backdropquench-backdropVerified publisher0.0.31 of 2See more

backdrop quench-backdrop 0.0.3

1 of the 2 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/backdropdigest-pinned58766d7b2e51
php-8.4@8.4.26-r3
8.4.26-r4

Open the chart page →

127
coolifyquench-coolifyVerified publisher0.0.441 of 4See more

coolify quench-coolify 0.0.44

1 of the 4 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/coolify-appdigest-pinnede066fd657105
php-8.4@8.4.26-r3
8.4.26-r4

Open the chart page →

437
drupalquench-drupalVerified publisher0.0.281 of 2See more

drupal quench-drupal 0.0.28

1 of the 2 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/drupaldigest-pinned33bc6d25b887
php-8.4@8.4.26-r3
8.4.26-r4

Open the chart page →

127
friendicaquench-friendicaVerified publisher0.0.21 of 2See more

friendica quench-friendica 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/friendicadigest-pinned0ccf2ae5dc7b
php-8.3@8.3.35-r3
8.3.35-r4

Open the chart page →

126
joomlaquench-joomla0.0.101 of 2See more

joomla quench-joomla 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/joomladigest-pinnedfd58dd0c4c26
php-8.3@8.3.35-r3
8.3.35-r4

Open the chart page →

137
matomoquench-matomoVerified publisher0.0.91 of 1See more

matomo quench-matomo 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/matomodigest-pinned488150bb68b4
php-8.3@8.3.35-r2
8.3.35-r4

Open the chart page →

85
mediawikiquench-mediawikiVerified publisher0.0.81 of 1See more

mediawiki quench-mediawiki 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/mediawikidigest-pinnedf6dbb4f8477f
php-8.3@8.3.35-r3
8.3.35-r4

Open the chart page →

69
nextcloudquench-nextcloudVerified publisher0.0.251 of 2See more

nextcloud quench-nextcloud 0.0.25

1 of the 2 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/nextclouddigest-pinned0846d0a1f424
php-8.3@8.3.35-r3
8.3.35-r4

Open the chart page →

154
wordpressquench-wordpressVerified publisher0.0.271 of 2See more

wordpress quench-wordpress 0.0.27

1 of the 2 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/wordpressdigest-pinned549c2299ac7e
php-8.3@8.3.35-r2
8.3.35-r4

Open the chart page →

143
zabbixquench-zabbixVerified publisher0.0.61 of 3See more

zabbix quench-zabbix 0.0.6

1 of the 3 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/zabbix-webdigest-pinned77f09c438997
php-8.3@8.3.35-r3
8.3.35-r4

Open the chart page →

178
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
php8.1@8.1.2-1ubuntu2.24
8.1.2-1ubuntu2.28

Open the chart page →

9,934
snipeitschmitzis6.1.01 of 2See more

snipeit schmitzis 6.1.0

1 of the 2 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
snipe/snipe-it:v8.3.1141ebf2386fe
php8.3@8.3.6-0ubuntu0.24.04.5
8.3.6-0ubuntu0.24.04.13

Open the chart page →

69,212
owncloudth-chartsVerified publisher0.2.11 of 1See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-109618.

Container imageDigestPackageFixed in
owncloud/server:10.15.051d9b74fc2a8
php7.4@7.4.3-4ubuntu2.23
7.4.3-4ubuntu2.29+esm5

Open the chart page →

11,715

Container images carrying it

26 by charts deploying them

A fixed version is listed for 7 of the 7 affected packages.

Container imageDigestPackageFixed inUsed by
checkmk/check-mk-community:2.5.0p6c11b422210c4
php8.1@8.1.2-1ubuntu2.24
8.1.2-1ubuntu2.28
1
jhoncytech/bookworm-apache-wordpress:latest18c3ca1f411e
php8.2@8.2.7-1~deb12u1
8.2.35-1~deb12u1
1
jordan/icinga2:latestf75025fe8ea8
php8.2@8.2.31-1~deb12u1
8.2.35-1~deb12u1
1
kfirfer/phppgadmin:7.13.0-22efb4a5d74a3
php7.4@7.4.3-4ubuntu2.15
7.4.3-4ubuntu2.29+esm5
1
mediagis/nominatim:3.7c15e941485ef
php7.4@7.4.3-4ubuntu2.12
7.4.3-4ubuntu2.29+esm5
1
mediagis/nominatim:4.2d0eae7b51374
php8.1@8.1.2-1ubuntu2.14
8.1.2-1ubuntu2.28
1
owncloud/server:10.15.051d9b74fc2a8
php7.4@7.4.3-4ubuntu2.23
7.4.3-4ubuntu2.29+esm5
1
snipe/snipe-it:v8.3.1141ebf2386fe
php8.3@8.3.6-0ubuntu0.24.04.5
8.3.6-0ubuntu0.24.04.13
1
snipe/snipe-it:v6.0.1455fb7636a98c
php7.4@7.4.3-4ubuntu2.13
7.4.3-4ubuntu2.29+esm5
1
zabbix/zabbix-web-nginx-mysql:ubuntu-6.4-latest0e5f69c4c54e
php8.3@8.3.6-0ubuntu0.24.04.3
8.3.6-0ubuntu0.24.04.13
1
zabbix/zabbix-web-nginx-pgsql:ubuntu-5.4.601de79c31391
php7.4@7.4.3-4ubuntu2.6
7.4.3-4ubuntu2.29+esm5
1
zabbix/zabbix-web-nginx-pgsql:ubuntu-7.0.237d4d58086515
php8.3@8.3.6-0ubuntu0.24.04.6
8.3.6-0ubuntu0.24.04.13
1
zabbix/zabbix-web-nginx-pgsql:ubuntu-6.0.899e9a090b516
php8.1@8.1.2-1ubuntu2.3
8.1.2-1ubuntu2.28
1
ghcr.io/angelnu/tt-rss:2.0.10086c9d9ea1e37c4
php8.5@8.5.9-0ubuntu1
8.5.9-0ubuntu2.1
1
ghcr.io/quenchworks/images/adminera2a3c8b637fa
php-8.3@8.3.35-r2
8.3.35-r4
1
ghcr.io/quenchworks/images/backdrop58766d7b2e51
php-8.4@8.4.26-r3
8.4.26-r4
1
ghcr.io/quenchworks/images/coolify-appe066fd657105
php-8.4@8.4.26-r3
8.4.26-r4
1
ghcr.io/quenchworks/images/drupal33bc6d25b887
php-8.4@8.4.26-r3
8.4.26-r4
1
ghcr.io/quenchworks/images/friendica0ccf2ae5dc7b
php-8.3@8.3.35-r3
8.3.35-r4
1
ghcr.io/quenchworks/images/joomlafd58dd0c4c26
php-8.3@8.3.35-r3
8.3.35-r4
1
ghcr.io/quenchworks/images/matomo488150bb68b4
php-8.3@8.3.35-r2
8.3.35-r4
1
ghcr.io/quenchworks/images/mediawikif6dbb4f8477f
php-8.3@8.3.35-r3
8.3.35-r4
1
ghcr.io/quenchworks/images/nextcloud0846d0a1f424
php-8.3@8.3.35-r3
8.3.35-r4
1
ghcr.io/quenchworks/images/wordpress549c2299ac7e
php-8.3@8.3.35-r2
8.3.35-r4
1
ghcr.io/quenchworks/images/zabbix-web77f09c438997
php-8.3@8.3.35-r3
8.3.35-r4
1
ghcr.io/rss-bridge/rss-bridge:latestfcd6ac6335ef
php8.2@8.2.34-1~deb12u1
8.2.35-1~deb12u1
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.