StackRadar

CVE-2026-111063

Low

Advisory

Published 19 Oct 2026In the index since 20 Oct 2026
Severity
Low
worst across findings
CVSS
2.0
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 18,196 indexed, latest versions
Container images
242
deployed by those charts
Fix available
1 of 1
affected package

AIOHTTP: Secure attribute not enforced for shared cookie

Carried by container images the latest versions of 247 of 18,196 indexed charts deploy, on 242 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.1, 3.5.4, 3.6.2+37 more3.14.4242
OSV records
GHSA-494j-54xm-rwp3

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
csghubcsghubVerified publisher2.6.02 of 35See more

csghub csghub 2.6.0

2 of the 35 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
aiohttp@3.12.13
3.14.4
opencsghq/csgbot:v0.6.9-ee7d0271e26521
aiohttp@3.10.11
3.14.4

Open the chart page →

68,406
csgshipcsghubVerified publisher0.4.72 of 10See more

csgship csghub 0.4.7

2 of the 10 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
aiohttp@3.12.15
3.14.4
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
aiohttp@3.12.15
3.14.4

Open the chart page →

14,769
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.4.121994f40e0da
aiohttp@3.8.1
3.14.4

Open the chart page →

16,260
jupyterhubd4nVerified publisher3.3.72 of 7See more

jupyterhub d4n 3.3.7

2 of the 7 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
aiohttp@3.9.5
3.14.4
aristidetm/k8s-hub:3.3.7ccb516cb8474
aiohttp@3.9.3
3.14.4

Open the chart page →

20,252
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
aiohttp@3.8.5
3.14.4

Open the chart page →

7,598
dask-gatewaydask2026.3.01 of 2See more

dask-gateway dask 2026.3.0

1 of the 2 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-gateway-server:2026.3.0afa5a729114e
aiohttp@3.13.4
3.14.4

Open the chart page →

2,893
datacubedatacube-charts0.18.21 of 1See more

datacube datacube-charts 0.18.2

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
opendatacube/wms:latest1b90cdf68831
aiohttp@3.6.2
3.14.4

Open the chart page →

98,516
restcubedatacube-charts0.2.91 of 1See more

restcube datacube-charts 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
opendatacube/restcube:latest91870111837c
aiohttp@3.6.2
3.14.4

Open the chart page →

95,046
datagrokdatagrok1.0.31 of 7See more

datagrok datagrok 1.0.3

1 of the 7 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
datagrok/grok_spawner:latestb990a4eb1d19
aiohttp@3.14.3
3.14.4

Open the chart page →

2,227
kube-web-viewdecayofmind0.0.41 of 1See more

kube-web-view decayofmind 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:20.10.0b44a9cf81a2f
aiohttp@3.6.2
3.14.4

Open the chart page →

2,778
isponsorblocktvdefault-ghVerified publisher1.0.51 of 1See more

isponsorblocktv default-gh 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/dmunozv04/isponsorblocktv:v2.9.05b8cfa805cb6
aiohttp@3.13.5
3.14.4

Open the chart page →

851
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4

Open the chart page →

11,228
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4

Open the chart page →

11,228
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
aiohttp@3.11.12
3.14.4

Open the chart page →

57,643
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-rest:latest3009350bfc11
aiohttp@3.12.15
3.14.4

Open the chart page →

12,227
esphomeegebackVerified publisher2.0.271 of 1See more

esphome egeback 2.0.27

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
esphome/esphome:2026.9.14ad55931c018
aiohttp@3.14.3
3.14.4

Open the chart page →

3,810
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
aiohttp@3.12.14
3.14.4

Open the chart page →

3,355
argocd-version-exporterevilmartians0.0.11 of 1See more

argocd-version-exporter evilmartians 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
quay.io/evl.ms/argocd-exporter:0.0.136ea8f34aa6b
aiohttp@3.7.4.post0
3.14.4

Open the chart page →

2,540
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
aiohttp@3.8.3
3.14.4

Open the chart page →

5,320
fauxgpufauxgpuVerified publisher0.2.41 of 4See more

fauxgpu fauxgpu 0.2.4

1 of the 4 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/devops-dojo7/fauxgpu/api:0.2.428f706597c2f
aiohttp@3.14.3
3.14.4

Open the chart page →

4,061
activityrelayfedihost0.1.41 of 2See more

activityrelay fedihost 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
stratospire/activityrelay:0.2.3a4c34cb01117
aiohttp@3.8.3
3.14.4

Open the chart page →

16,277
flyteconnectorflyte2.0.01 of 1See more

flyteconnector flyte 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.4

Open the chart page →

4,307
demo-workflowsfrinx-helm-charts2.0.01 of 3See more

demo-workflows frinx-helm-charts 2.0.0

1 of the 3 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
frinx/frinx-demo-workflows:6.1.0ee29588bd238
aiohttp@3.9.5
3.14.4

Open the chart page →

2,776
frinx-machinefrinx-helm-charts11.0.02 of 26See more

frinx-machine frinx-helm-charts 11.0.0

2 of the 26 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
frinx/device-induction:1.2.2a8fbdce554ad
aiohttp@3.10.5
3.14.4
frinx/topology-discovery:7.0.37832e3589dba
aiohttp@3.10.5
3.14.4

Open the chart page →

52,866
topology-discoveryfrinx-helm-charts4.0.01 of 2See more

topology-discovery frinx-helm-charts 4.0.0

1 of the 2 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
frinx/topology-discovery:7.0.37832e3589dba
aiohttp@3.10.5
3.14.4

Open the chart page →

6,583
changedetection-iogabe565Verified publisher0.12.01 of 2See more

changedetection-io gabe565 0.12.0

1 of the 2 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:latest34df3680db1c
aiohttp@3.14.3
3.14.4

Open the chart page →

3,051
esphomegabe565Verified publisher0.15.01 of 1See more

esphome gabe565 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:latest776a845d5089
aiohttp@3.14.3
3.14.4

Open the chart page →

3,810
tandoorgabe565Verified publisher0.9.91 of 2See more

tandoor gabe565 0.9.9

1 of the 2 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
aiohttp@3.10.11
3.14.4

Open the chart page →

2,547
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
aiohttp@3.13.2
3.14.4

Open the chart page →

11,820
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-notifier:v1.0.3d1b0ce10b513
aiohttp@3.13.5
3.14.4

Open the chart page →

17,717
glpiglpi-chart0.1.11 of 3See more

glpi glpi-chart 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
3.14.4

Open the chart page →

13,348
rag-apihajowielandVerified publisher1.0.01 of 1See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latesta62ce2221b43
aiohttp@3.14.3
3.14.4

Open the chart page →

1,496
resurrectbothalkeye0.1.51 of 1See more

resurrectbot halkeye 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
halkeye/slack-resurrect:v0.1.477b05e95fdb5
aiohttp@3.5.4
3.14.4

Open the chart page →

5,156
helixhelix1.4.31 of 2See more

helix helix 1.4.3

1 of the 2 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
aiohttp@3.13.5
3.14.4

Open the chart page →

6,449
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
aiohttp@3.11.13
3.14.4

Open the chart page →

5,990
archiveboxhelmforgeVerified publisher1.1.151 of 1See more

archivebox helmforge 1.1.15

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
archivebox/archivebox:0.9.73d4720d86c0e9
aiohttp@3.14.3
3.14.4

Open the chart page →

6,459
chiefonboardinghelmforgeVerified publisher1.1.171 of 3See more

chiefonboarding helmforge 1.1.17

1 of the 3 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
aiohttp@3.14.3
3.14.4

Open the chart page →

9,109
hermes-agenthelmforgeVerified publisher1.0.21 of 1See more

hermes-agent helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
aiohttp@3.14.3
3.14.4

Open the chart page →

7,245
jupyterhubhelmforgeVerified publisher1.0.71 of 3See more

jupyterhub helmforge 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
aiohttp@3.13.5
3.14.4

Open the chart page →

6,250
langflowhelmforgeVerified publisher2.0.41 of 1See more

langflow helmforge 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.6a0396e089eb9
aiohttp@3.14.3
3.14.4

Open the chart page →

144
medikeephelmforgeVerified publisher2.0.51 of 3See more

medikeep helmforge 2.0.5

1 of the 3 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/afairgiant/medikeep:v0.72.09285e26f6d0d
aiohttp@3.14.3
3.14.4

Open the chart page →

6,501
paperless-ngxhelmforgeVerified publisher1.1.11 of 4See more

paperless-ngx helmforge 1.1.1

1 of the 4 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4

Open the chart page →

8,102
openaevhelm-openbasVerified publisher2.0.151 of 7See more

openaev helm-openbas 2.0.15

1 of the 7 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.4

Open the chart page →

21,829
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.4

Open the chart page →

26,662
hetzner-s3-operatorhetzner-s3-operatorVerified publisher0.1.31 of 1See more

hetzner-s3-operator hetzner-s3-operator 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
kenchrcum/hetzner-s3-operator:0.1.384dae7aeea5b
aiohttp@3.13.5
3.14.4

Open the chart page →

791
homeassistanthomeenterpriseinc0.3.01 of 1See more

homeassistant homeenterpriseinc 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2022.3.5565751f33794
aiohttp@3.8.1
3.14.4

Open the chart page →

9,167
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
aiohttp@3.14.3
3.14.4

Open the chart page →

36,286
ilum-apiilumVerified publisher6.7.31 of 1See more

ilum-api ilum 6.7.3

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
aiohttp@3.14.1
3.14.4

Open the chart page →

3,284
impulseimpulse1.1.11 of 1See more

impulse impulse 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/eslupmi/impulse:v3.7.1186a24030e82
aiohttp@3.13.5
3.14.4

Open the chart page →

1,321
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
aiohttp@3.11.11
3.14.4

Open the chart page →

5,623

Container images carrying it

242 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4
5
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4
4
langflowai/langflow:1.12.6:latesta0396e089eb9
aiohttp@3.14.3
3.14.4
3
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4
3
esphome/esphome:2026.9.14ad55931c018
aiohttp@3.14.3
3.14.4
2
frinx/topology-discovery:7.0.37832e3589dba
aiohttp@3.10.5
3.14.4
2
ilum/api:6.7.3624fd09528c8
aiohttp@3.14.1
3.14.4
2
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.4
2
nacos/nacos-server:latest1c191c30c8cd
aiohttp@3.14.3
3.14.4
2
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.4
2
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.4
2
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.4
2
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.4
2
polyaxon/polyaxon-agent:2.17.0da877a2647fc
aiohttp@3.14.3
3.14.4
2
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
aiohttp@3.14.3
3.14.4
2
safeglobal/safe-config-service:latest09a5e495c219
aiohttp@3.13.5
3.14.4
2
safeglobal/safe-transaction-service:latest7b576c73f865
aiohttp@3.14.3
3.14.4
2
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
3.14.4
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.4
2
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
aiohttp@3.14.3
3.14.4
2
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
aiohttp@3.14.3
3.14.4
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
aiohttp@3.11.13
3.14.4
2
ghcr.io/xeor/karb:1.0.6:main647a3c938d31
aiohttp@3.13.3
3.14.4
2
acockburn/appdaemon:4.0.83a93281d7e94
aiohttp@3.7.4
3.14.4
1
acryldata/datahub-actions:v1.7.0.1c5fd70130157
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-api:latestde166c910ef9
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-worker:latestadb761a4d103
aiohttp@3.14.3
3.14.4
1
alerta/alerta-web:8.5.04786b9eaa606
aiohttp@3.8.0
3.14.4
1
apache/airflow:2.8.4-python3.964e58748b6b9
aiohttp@3.9.3
3.14.4
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
aiohttp@3.10.5
3.14.4
1
apache/airflow:2.8.1e5560ad0b86e
aiohttp@3.9.1
3.14.4
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
aiohttp@3.7.4
3.14.4
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
aiohttp@3.11.16
3.14.4
1
archivebox/archivebox:0.9.73d4720d86c0e9
aiohttp@3.14.3
3.14.4
1
aristidetm/basic-notebook:3.6.5469dbc951224
aiohttp@3.9.5
3.14.4
1
aristidetm/k8s-hub:3.3.7ccb516cb8474
aiohttp@3.9.3
3.14.4
1
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
aiohttp@3.7.4
3.14.4
1
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
aiohttp@3.9.3
3.14.4
1
baserow/backend:1.31.1e0b3c8130b91
aiohttp@3.9.5
3.14.4
1
baserow/baserow:1.30.1df0c42eb67e8
aiohttp@3.9.5
3.14.4
1
bcgovimages/aries-cloudagent:py36-1.16-1_0.7.4faa2e2d21916
aiohttp@3.8.1
3.14.4
1
berkeleyskypilot/skypilot:0.14.125577df35586
aiohttp@3.14.3
3.14.4
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
aiohttp@3.13.2
3.14.4
1
burakince/mlflow:3.16.0ab4b566644b9
aiohttp@3.14.3
3.14.4
1
byjg/easy-haproxy:6.1.1230fdb7b00ae
aiohttp@3.14.1
3.14.4
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
aiohttp@3.13.5
3.14.4
1
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
aiohttp@3.14.3
3.14.4
1
ciuse99/suggestarr:v1.0.20d72768245ef5
aiohttp@3.11.12
3.14.4
1
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
aiohttp@3.11.10
3.14.4
1
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
aiohttp@3.11.10
3.14.4
1

syft 1.42.1 · advisories as of 20 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.