CVE-2026-11822

High

Advisory

Published 9 Jun 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.5; base score, highest
EPSS: 0.002; 7th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,811; of 17,797 indexed, latest versions
Container images: 1,559; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,811 of 17,797 indexed charts deploy, on 1,559 images.

Affected package	Affected versions	Fixed in	Images
sqlite3deb	3.8.2-1ubuntu2, 3.8.2-1ubuntu2.1, 3.8.2-1ubuntu2.2, 3.11.0-1ubuntu1+37 more	3.37.2-2ubuntu0.6, 3.45.1-1ubuntu2.6, 3.46.1-7+deb13u2, 3.46.1-7+e3+2 more	1,482
sqliteapk	3.41.2-r4, 3.51.1-r0, 3.51.2-r0	3.53.4-r0	77

OSV records: ALPINE-CVE-2026-11822 DEBIAN-CVE-2026-11822 UBUNTU-CVE-2026-11822 ECHO-acfd-ccab-2f14
Also known as: USN-8480-1

Charts affected

1,811 by stars

Chart

Latest

Affected images

Radar Score

wordpress-alpinewordpress-alpine

1.5.18

1 of 6 See more

wordpress-alpine wordpress-alpine 1.5.18

1 of the 6 container images this version deploys carry CVE-2026-11822.

Container image	Digest	Package	Fixed in
library/memcached :1.6.45	dc561d52bb8a	sqlite3@3.46.1-7+deb13u1	3.46.1-7+deb13u2

Open the chart page →

4,080

Wordpresswordpress-mariadb

1.0.2

1 of 2 See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-11822.

Container image	Digest	Package	Fixed in
library/wordpress :latest	5a93c470ae82	sqlite3@3.46.1-7+deb13u1	3.46.1-7+deb13u2

Open the chart page →

5,713

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-11822.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	sqlite3@3.37.2-2ubuntu0.3	3.37.2-2ubuntu0.6

Open the chart page →

14,218

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-11822.

Container image	Digest	Package	Fixed in
ghcr.io/bat-bs/bitnami-pgvector :pg16	19ebe07b4daf	sqlite3@3.40.1-2+deb12u1	no fix listed

Open the chart page →

11,622

xkopsxkops

0.1.0

3 of 5 See more

xkops xkops 0.1.0

3 of the 5 container images this version deploys carry CVE-2026-11822.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	sqlite3@3.40.1-2	no fix listed
hamzaarshad10/querypodpy :1.7	154f38e8668e	sqlite3@3.40.1-2	no fix listed
murtazashah46/helmfile :latest	4d11726cf803	sqlite3@3.40.1-2	no fix listed

Open the chart page →

13,813

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11822.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	sqlite3@3.46.1-7+deb13u1	3.46.1-7+deb13u2

Open the chart page →

1,861

helm-demoyahoon-helm-demo

1.0.0

1 of 1 See more

helm-demo yahoon-helm-demo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-11822.

Container image	Digest	Package	Fixed in
ghcr.io/yahoon/helm-demo :1.0.0	2930290a758c	sqlite3@3.46.1-7+deb13u1	3.46.1-7+deb13u2

Open the chart page →

1,311

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11822.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	sqlite3@3.46.1-7+deb13u1	3.46.1-7+deb13u2

Open the chart page →

1,861

changedetection-iozekker6

1.101.0

1 See more

changedetection-io zekker6 1.101.0

1 container image this version deploys carries CVE-2026-11822.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.6	eb4a9f718801	sqlite3@3.40.1-2+deb12u2	no fix listed

Open the chart page →

—

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-11822.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	sqlite3@3.46.1-7+deb13u1	3.46.1-7+deb13u2

Open the chart page →

1,861

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-11822.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	sqlite3@3.22.0-1ubuntu0.4	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	sqlite3@3.31.1-4ubuntu0.2	no fix listed

Open the chart page →

9,272

Container images carrying it

1,559 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
jjorozco20/flask-mysql-app :1.0.0	b5e44e3ba09c	sqlite3@3.40.1-2+deb12u1	no fix listed	1
jmferrer/azure-devops-agent :latest	030f68ec6998	sqlite3@3.11.0-1ubuntu1.4	no fix listed	1
jodogne/orthanc-plugins :latest	6ff510aa29c2	sqlite3@3.46.1-7+deb13u1	3.46.1-7+deb13u2	1
jonasal/devpi-server :6.17.0-alpine	ec1eee99a18d	sqlite@3.51.1-r0	3.53.4-r0	1
jordan/icinga2 :latest	f75025fe8ea8	sqlite3@3.40.1-2+deb12u2	no fix listed	1
josh5/unmanic :0.2.6	4d49c4816260	sqlite3@3.37.2-2ubuntu0.3	3.37.2-2ubuntu0.6	1
journeyapps/powersync-service :latest	bf46f66e5dcc	sqlite3@3.46.1-7+deb13u1	3.46.1-7+deb13u2	1
jpgouin/openldap :2.6.9-fix	bfdd0088c776	sqlite3@3.40.1-2+deb12u1	no fix listed	1
juicedata/juicefs-csi-driver :v0.33.0	f918e7331c05	sqlite3@3.40.1-2+deb12u1	no fix listed	1
jupyterhub/jupyterhub :5.4.6	3974ba945e65	sqlite3@3.45.1-1ubuntu2.5	3.45.1-1ubuntu2.6	1
jupyterhub/k8s-hub :0.11.1	b6b4a1a34bf0	sqlite3@3.31.1-4ubuntu0.2	no fix listed	1
jupyterhub/k8s-hub :1.2.0	e4770285aaf7	sqlite3@3.31.1-4ubuntu0.2	no fix listed	1
jupyterhub/k8s-singleuser-sample :0.11.1	e3e6f3051df8	sqlite3@3.31.1-4ubuntu0.2	no fix listed	1
jupyterjsc/jupyterhub-outpost :2.3.1	aea53b13f235	sqlite@3.51.2-r0	3.53.4-r0	1
kenchrcum/ansible-playbook-operator :0.1.7	12fb213debf1	sqlite@3.51.2-r0	3.53.4-r0	1
kenchrcum/fluxcd-helm-upgrader :0.7.7	c326e28a8f5f	sqlite@3.51.2-r0	3.53.4-r0	1
kenchrcum/grafana-dashboard-converter :0.3.10	5310497aea3f	sqlite@3.51.2-r0	3.53.4-r0	1
kenchrcum/hetzner-s3-operator :0.1.3	84dae7aeea5b	sqlite@3.51.2-r0	3.53.4-r0	1
kenchrcum/wasabi-s3-operator :0.2.7	ce657c622ce5	sqlite@3.51.2-r0	3.53.4-r0	1
kennethreitz/httpbin :latest	599fe5e50731	sqlite3@3.22.0-1	no fix listed	1
kfirfer/phppgadmin :7.13.0-2	2efb4a5d74a3	sqlite3@3.31.1-4ubuntu0.5	no fix listed	1
kimai/kimai2 :2.67.0	3084f1e5ecdc	sqlite3@3.40.1-2+deb12u2	no fix listed	1
kinseii/wazuh-agent :4.14.1	7160eb143728	sqlite3@3.40.1-2+deb12u2	no fix listed	1
kitware/cdash :v5.3.0	d7767d9b9da4	sqlite3@3.46.1-7+deb13u1	3.46.1-7+deb13u2	1
kixote/typemill	4e9dff179519	sqlite3@3.46.1-7+deb13u1	3.46.1-7+deb13u2	1
kixote/typemill	628f79a08cc7	sqlite3@3.46.1-7+deb13u1	3.46.1-7+deb13u2	1
knspar/phronetis :0.1.46	09499d2dc91a	sqlite3@3.45.1-1ubuntu2.3	3.45.1-1ubuntu2.6	1
knspar/phronetis-operator :0.1.6	0c4f0543ee58	sqlite3@3.40.1-2	no fix listed	1
koenkk/zigbee2mqtt :2.7.2	60a295b40f4e	sqlite@3.51.1-r0	3.53.4-r0	1
kong/httpbin :latest	a6ac46531193	sqlite3@3.37.2-2ubuntu0.3	3.37.2-2ubuntu0.6	1
kpetrem/mqtt-exporter :latest	dca3255f3531	sqlite@3.51.2-r0	3.53.4-r0	1
krontechnology/aapm-agent :1.8.4	1cc7d5be6529	sqlite3@3.37.2-2ubuntu0.5	3.37.2-2ubuntu0.6	1
krontechnology/aapm-agent :1.1.0	7feef7d2ab42	sqlite3@3.31.1-4ubuntu0.5	no fix listed	1
krontechnology/aapm-service :1.1.3	9dd602db8baa	sqlite3@3.37.2-2ubuntu0.5	3.37.2-2ubuntu0.6	1
kserve/models-web-app :v0.13.0	73486345a602	sqlite3@3.40.1-2	no fix listed	1
kubeflownotebookswg/jupyter-web-app :v1.9.2	afb52057c997	sqlite3@3.40.1-2	no fix listed	1
kubeflownotebookswg/tensorboards-web-app :v1.9.2	77f07f52a84a	sqlite3@3.40.1-2	no fix listed	1
kubeflownotebookswg/volumes-web-app :v1.9.2	f63c3e550af3	sqlite3@3.40.1-2	no fix listed	1
kubeoperator/webkubectl :v2.4.0	be8f0d624640	sqlite3@3.22.0-1ubuntu0.3	no fix listed	1
kubeovn/kube-ovn :v1.14.0	6722b54eb5c0	sqlite3@3.45.1-1ubuntu2.3	3.45.1-1ubuntu2.6	1
kusionstack/kusion :v0.14.0	126c8f0b0976	sqlite3@3.37.2-2ubuntu0.3	3.37.2-2ubuntu0.6	1
kyovint/kyoimgtransactions :1.0.0	48c19e3ae9a3	sqlite3@3.46.1-7	3.46.1-7+deb13u2	1
kyovint/kyoimgusers :1.0.0	80084149156e	sqlite3@3.46.1-7	3.46.1-7+deb13u2	1
labs64/traefik-authproxy :0.0.3	dfc6086dfbce	sqlite3@3.46.1-7+deb13u1	3.46.1-7+deb13u2	1
laly9999/node-app :1	dd0e503913e1	sqlite3@3.40.1-2+deb12u1	no fix listed	1
langgenius/dify-agent-backend :1.16.1	097d3fd27a7b	sqlite3@3.40.1-2+deb12u2	no fix listed	1
langgenius/dify-agent-local-sandbox :1.16.1	bf8027ddccf3	sqlite3@3.40.1-2+deb12u2	no fix listed	1
langgenius/dify-api :1.0.0	066035f93856	sqlite3@3.40.1-2+deb12u1	no fix listed	1
langgenius/dify-api :1.16.1	dcefa5f7c47c	sqlite3@3.40.1-2+deb12u2	no fix listed	1
langgenius/dify-api :0.6.11	fca918260dd6	sqlite3@3.40.1-2	no fix listed	1