StackRadar

CVE-2026-111063

Low

Advisory

Published 19 Oct 2026In the index since 20 Oct 2026
Severity
Low
worst across findings
CVSS
2.0
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 18,196 indexed, latest versions
Container images
242
deployed by those charts
Fix available
1 of 1
affected package

AIOHTTP: Secure attribute not enforced for shared cookie

Carried by container images the latest versions of 247 of 18,196 indexed charts deploy, on 242 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.1, 3.5.4, 3.6.2+37 more3.14.4242
OSV records
GHSA-494j-54xm-rwp3

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
aiohttp@3.13.5
3.14.4

Open the chart page →

21,634
shynetjuniorjpdj0.1.331 of 1See more

shynet juniorjpdj 0.1.33

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.13.1ba54f7797a6b
aiohttp@3.8.1
3.14.4

Open the chart page →

2,890
jupyterhub-chartk8s-jupyterhub0.1.01 of 1See more

jupyterhub-chart k8s-jupyterhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
aiohttp@3.14.1
3.14.4

Open the chart page →

1,928
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
aiohttp@3.13.3
3.14.4

Open the chart page →

5,780
karbkarbVerified publisher1.0.31 of 1See more

karb karb 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/xeor/karb:main647a3c938d31
aiohttp@3.13.3
3.14.4

Open the chart page →

748
karb-chartkarbVerified publisher1.0.61 of 1See more

karb-chart karb 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/xeor/karb:1.0.6647a3c938d31
aiohttp@3.13.3
3.14.4

Open the chart page →

748
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
aiohttp@3.13.5
3.14.4

Open the chart page →

8,721
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
aiohttp@3.8.5
3.14.4

Open the chart page →

7,867
crate-operatorkrateo2.43.11 of 1See more

crate-operator krateo 2.43.1

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
crate/crate-operator:2.43.1ea396813f6f0
aiohttp@3.10.11
3.14.4

Open the chart page →

3,306
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
aiohttp@3.13.5
3.14.4

Open the chart page →

12,411
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
aiohttp@3.11.16
3.14.4

Open the chart page →

9,665
jupyterhubkubeblocksVerified publisher0.1.01 of 7See more

jupyterhub kubeblocks 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
aiohttp@3.8.5
3.14.4

Open the chart page →

9,860
kubernetes-feedskubernetes-feeds0.1.11 of 3See more

kubernetes-feeds kubernetes-feeds 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
lumutools/kubernetes-feeder:lateste35ffa90b129
aiohttp@3.14.3
3.14.4

Open the chart page →

1,235
deepflowkubesphere-stable6.2.6061 of 8See more

deepflow kubesphere-stable 6.2.606

1 of the 8 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
deepflowce/deepflow-app:v6.2.6.5a1888d35e787
aiohttp@3.4.4
3.14.4

Open the chart page →

24,125
kubevoipkubevoipOfficialVerified publisher0.6.81 of 1See more

kubevoip kubevoip 0.6.8

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/kubevoip/kubevoip:v0.6.841c603a93642
aiohttp@3.14.1
3.14.4

Open the chart page →

1,451
legendlegend0.1.21 of 1See more

legend legend 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/grofers/legend:0.1d6e901ad0ebd
aiohttp@3.7.1
3.14.4

Open the chart page →

5,631
calendar-apiliturgical0.1.51 of 1See more

calendar-api liturgical 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/liturgical-app/calendar-api:0.0.9688a685e2bde
aiohttp@3.12.15
3.14.4

Open the chart page →

1,703
liturgical-apiliturgical0.2.111 of 1See more

liturgical-api liturgical 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/liturgical-app/liturgical-api:1.0.12637bdcebdd8d
aiohttp@3.13.4
3.14.4

Open the chart page →

1,149
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
aiohttp@3.14.3
3.14.4

Open the chart page →

3,724
kafka-aggregatorlsst-sqre0.1.21 of 1See more

kafka-aggregator lsst-sqre 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
lsstsqre/kafkaaggregator:masterbe1b21060854
aiohttp@3.7.4
3.14.4

Open the chart page →

4,267
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
aiohttp@3.8.1
3.14.4

Open the chart page →

93,162
miot-harnessmicroboxlabs0.8.01 of 1See more

miot-harness microboxlabs 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-harness:0.1.0d548e9ae4b84
aiohttp@3.14.1
3.14.4

Open the chart page →

1,649
servicesmicroslacVerified publisher0.4.01 of 8See more

services microslac 0.4.0

1 of the 8 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
microslac/chat:latest417317e4e4e8
aiohttp@3.9.3
3.14.4

Open the chart page →

34,721
buildkite-exporterminaVerified publisher0.1.41 of 1See more

buildkite-exporter mina 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
codaprotocol/buildkite-exporter:0.2.137c68e67a401
aiohttp@3.7.3
3.14.4

Open the chart page →

3,374
mum-discord-botmum-discord-botVerified publisher0.3.71 of 1See more

mum-discord-bot mum-discord-bot 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/drewburr-labs/mum-discord-bot:3.1.26e82914e1051
aiohttp@3.9.1
3.14.4

Open the chart page →

15,336
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
aiohttp@3.8.4
3.14.4

Open the chart page →

6,436
esphome-device-buildernewbenji-chartsVerified publisher0.1.11 of 1See more

esphome-device-builder newbenji-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.7.4e636269c6390
aiohttp@3.14.3
3.14.4

Open the chart page →

3,862
home-assistantnewbenji-chartsVerified publisher0.7.21 of 1See more

home-assistant newbenji-charts 0.7.2

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.8.0a21689ef0510
aiohttp@3.14.3
3.14.4

Open the chart page →

3,469
music-assistantnewbenji-chartsVerified publisher0.1.01 of 1See more

music-assistant newbenji-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.645fdb050e069
aiohttp@3.14.3
3.14.4

Open the chart page →

4,956
object-clonerobject-clonerVerified publisher2.0.01 of 1See more

object-cloner object-cloner 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/ideamixes/object-cloner:2.0.031030fd2f192
aiohttp@3.8.5
3.14.4

Open the chart page →

1,659
ocellusaiocellusaiVerified publisher0.1.121 of 2See more

ocellusai ocellusai 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
quay.io/ocellusai/operator:v0.10.59ff01f642e2b
aiohttp@3.14.1
3.14.4

Open the chart page →

1,746
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
aiohttp@3.13.3
3.14.4

Open the chart page →

3,114
paperless-ngxoli-the-devVerified publisher1.3.21 of 1See more

paperless-ngx oli-the-dev 1.3.2

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4

Open the chart page →

5,530
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest92b8fab500f9
aiohttp@3.14.3
3.14.4

Open the chart page →

8,985
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
aiohttp@3.9.5
3.14.4

Open the chart page →

21,507
terminalsopen-webui0.7.02 of 2See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/open-webui/terminals:latest6850ed976e7e
aiohttp@3.14.3
3.14.4
ghcr.io/open-webui/terminals-operator:latest5e1ceb6b3b26
aiohttp@3.14.3
3.14.4

Open the chart page →

2,335
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
aiohttp@3.13.2
3.14.4

Open the chart page →

6,312
email-managerphntom0.1.221 of 2See more

email-manager phntom 0.1.22

1 of the 2 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
phntom/email-manager:0.1.22d8e2a9f2f085
aiohttp@3.8.4
3.14.4

Open the chart page →

3,564
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
knspar/phronetis-operator:0.1.60c4f0543ee58
aiohttp@3.12.13
3.14.4

Open the chart page →

18,498
pieeatpieeatOfficialVerified publisher0.9.31 of 1See more

pieeat pieeat 0.9.3

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
quay.io/maxiv/pieeat:0.9.3099715479210
aiohttp@3.13.5
3.14.4

Open the chart page →

1,787
agentpolyaxon2.17.03 of 4See more

agent polyaxon 2.17.0

3 of the 4 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
polyaxon/polyaxon-agent:2.17.0da877a2647fc
aiohttp@3.14.3
3.14.4
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
aiohttp@3.14.3
3.14.4
polyaxon/polyaxon-streams:2.17.0a5fec70e757b
aiohttp@3.14.3
3.14.4

Open the chart page →

10,881
polyaxonpolyaxon2.17.03 of 5See more

polyaxon polyaxon 2.17.0

3 of the 5 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
polyaxon/polyaxon-agent:2.17.0da877a2647fc
aiohttp@3.14.3
3.14.4
polyaxon/polyaxon-api:2.17.0163707082036
aiohttp@3.14.3
3.14.4
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
aiohttp@3.14.3
3.14.4

Open the chart page →

14,949
prowlerprowler0.1.11 of 1See more

prowler prowler 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
toniblyx/prowler:stable9dbcc3c9abd7
aiohttp@3.14.3
3.14.4

Open the chart page →

2,317
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
aiohttp@3.12.13
3.14.4

Open the chart page →

8,436
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
aiohttp@3.10.5
3.14.4

Open the chart page →

24,366
radar-kafkaradar-baseVerified publisher0.4.11 of 2See more

radar-kafka radar-base 0.4.1

1 of the 2 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
ghcr.io/lsst-sqre/strimzi-registry-operator:0.6.07e25f7048aff
aiohttp@3.8.1
3.14.4

Open the chart page →

5,084
rawfile-localpvrawfile0.15.31 of 6See more

rawfile-localpv rawfile 0.15.3

1 of the 6 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
openebs/rawfile-localpv:v0.15.396fd7987ea79
aiohttp@3.14.3
3.14.4

Open the chart page →

4,918
kube-web-viewrlex0.5.01 of 1See more

kube-web-view rlex 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:23.8.0431f1bf013d0
aiohttp@3.8.4
3.14.4

Open the chart page →

5,410
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4

Open the chart page →

11,228
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-111063.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
aiohttp@3.14.3
3.14.4

Open the chart page →

4,015

Container images carrying it

242 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4
5
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4
4
langflowai/langflow:1.12.6:latesta0396e089eb9
aiohttp@3.14.3
3.14.4
3
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4
3
esphome/esphome:2026.9.14ad55931c018
aiohttp@3.14.3
3.14.4
2
frinx/topology-discovery:7.0.37832e3589dba
aiohttp@3.10.5
3.14.4
2
ilum/api:6.7.3624fd09528c8
aiohttp@3.14.1
3.14.4
2
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.4
2
nacos/nacos-server:latest1c191c30c8cd
aiohttp@3.14.3
3.14.4
2
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.4
2
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.4
2
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.4
2
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.4
2
polyaxon/polyaxon-agent:2.17.0da877a2647fc
aiohttp@3.14.3
3.14.4
2
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
aiohttp@3.14.3
3.14.4
2
safeglobal/safe-config-service:latest09a5e495c219
aiohttp@3.13.5
3.14.4
2
safeglobal/safe-transaction-service:latest7b576c73f865
aiohttp@3.14.3
3.14.4
2
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
3.14.4
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.4
2
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
aiohttp@3.14.3
3.14.4
2
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
aiohttp@3.14.3
3.14.4
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
aiohttp@3.11.13
3.14.4
2
ghcr.io/xeor/karb:1.0.6:main647a3c938d31
aiohttp@3.13.3
3.14.4
2
acockburn/appdaemon:4.0.83a93281d7e94
aiohttp@3.7.4
3.14.4
1
acryldata/datahub-actions:v1.7.0.1c5fd70130157
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-api:latestde166c910ef9
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-worker:latestadb761a4d103
aiohttp@3.14.3
3.14.4
1
alerta/alerta-web:8.5.04786b9eaa606
aiohttp@3.8.0
3.14.4
1
apache/airflow:2.8.4-python3.964e58748b6b9
aiohttp@3.9.3
3.14.4
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
aiohttp@3.10.5
3.14.4
1
apache/airflow:2.8.1e5560ad0b86e
aiohttp@3.9.1
3.14.4
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
aiohttp@3.7.4
3.14.4
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
aiohttp@3.11.16
3.14.4
1
archivebox/archivebox:0.9.73d4720d86c0e9
aiohttp@3.14.3
3.14.4
1
aristidetm/basic-notebook:3.6.5469dbc951224
aiohttp@3.9.5
3.14.4
1
aristidetm/k8s-hub:3.3.7ccb516cb8474
aiohttp@3.9.3
3.14.4
1
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
aiohttp@3.7.4
3.14.4
1
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
aiohttp@3.9.3
3.14.4
1
baserow/backend:1.31.1e0b3c8130b91
aiohttp@3.9.5
3.14.4
1
baserow/baserow:1.30.1df0c42eb67e8
aiohttp@3.9.5
3.14.4
1
bcgovimages/aries-cloudagent:py36-1.16-1_0.7.4faa2e2d21916
aiohttp@3.8.1
3.14.4
1
berkeleyskypilot/skypilot:0.14.125577df35586
aiohttp@3.14.3
3.14.4
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
aiohttp@3.13.2
3.14.4
1
burakince/mlflow:3.16.0ab4b566644b9
aiohttp@3.14.3
3.14.4
1
byjg/easy-haproxy:6.1.1230fdb7b00ae
aiohttp@3.14.1
3.14.4
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
aiohttp@3.13.5
3.14.4
1
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
aiohttp@3.14.3
3.14.4
1
ciuse99/suggestarr:v1.0.20d72768245ef5
aiohttp@3.11.12
3.14.4
1
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
aiohttp@3.11.10
3.14.4
1
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
aiohttp@3.11.10
3.14.4
1

syft 1.42.1 · advisories as of 20 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.