StackRadar

CVE-2026-11940

High

Advisory

Published 23 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.007
53rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
888
of 17,787 indexed, latest versions
Container images
919
deployed by those charts
Fix available
9 of 18
affected packages

tarfile extraction filter bypass allows escaping the destination directory

Carried by container images the latest versions of 888 of 17,787 indexed charts deploy, on 919 images.

Affected packageAffected versionsFixed inImages
python3.11deb3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 moreno fix listed181
python3.8deb3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 moreno fix listed100
python3.12deb3.12.3-1, 3.12.3-1ubuntu0.1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3+12 moreno fix listed89
python3.10deb3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 moreno fix listed80
python3apk3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more3.12.14-r0, 3.14.7-r075
python3.13deb3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4, 3.13.7-1ubuntu0.13.13.5-2+deb13u575
python2.7deb2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 moreno fix listed54
python3.6deb3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 moreno fix listed44
python3.5deb3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9no fix listed25
python3.14deb3.14.4-1, 3.14.4-1ubuntu0.1, 3.14.4-1ubuntu0.2no fix listed9
python3.4deb3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7no fix listed7
python-3.14apk3.14.2-r2, 3.14.4-r2, 3.14.6-r03.14.6-r36
pythonbitnami3.11.11-0, 3.12.8-0, 3.13.5-13.10.213
python-3.13apk3.13.7-r0, 3.13.10-r0, 3.13.12-r23.13.14-r23
python-3.12apk3.12.0-r1, 3.12.9-r13.12.13-r102
python3rpm3.6.8-15.1.el8, 3.6.8-23.el8, 3.6.8-24.el8_2, 3.6.8-24.el8_2.2+27 more0:3.6.8-78.el8_10, 0:3.6.8-78.el8_10.rocky.0136
python3.9rpm3.9.16-1.el9, 3.9.16-1.el9_2.1, 3.9.16-1.el9_2.2, 3.9.18-1.el9_3.1+16 more0:3.9.25-7.el9_8.361
python3.12rpm3.12.5-2.el9_5.2, 3.12.13-2.el10_2.1, 3.12.13-3.el8_10, 3.12.13-3.el9_8.10:3.12.14-1.el8_10, 0:3.12.14-1.el9_8, 0:3.12.14-1.el10_25
OSV records
ALPINE-CVE-2026-11940BIT-python-2026-11940CGA-2877-fmjf-8j5qCGA-cr9q-h4v8-hfgpCGA-qmm2-954x-xmxrDEBIAN-CVE-2026-11940RHSA-2026:54268RHSA-2026:56219RHSA-2026:58902RHSA-2026:58971RHSA-2026:59009RLSA-2026:54268RLSA-2026:56219RLSA-2026:58902UBUNTU-CVE-2026-11940
Also known as
BIT-libpython-2026-11940, BIT-python-min-2026-11940, CGA-5363-9r7r-rr55, CGA-p86c-g5pg-rvpw, CGA-w3m6-c9vj-wm85, PSF-2026-30, RHSA-2026:64806, RHSA-2026:64816

Charts affected

888 by stars
ChartLatestAffected imagesRadar Score
substreams-tier-2nodeifyVerified publisher1.1.31 of 1See more

substreams-tier-2 nodeify 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/firehose-ethereum:v2.14.3bf816072380e
python3.12@3.12.3-1ubuntu0.9
no fix listed

Open the chart page →

4,723
nominatimnominatim-chart1.3.01 of 3See more

nominatim nominatim-chart 1.3.0

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
mediagis/nominatim:3.7c15e941485ef
python3.8@3.8.10-0ubuntu1~20.04.5
no fix listed

Open the chart page →

22,713
notes-admin-front-helm-chartnotesprojectchart0.1.01 of 1See more

notes-admin-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
vlebediantsev/notes-admin-front:latest007c6670ff48
python3.11@3.11.2-6
no fix listed

Open the chart page →

13,331
notes-project-fromt-helm-chartnotesprojectchart0.1.01 of 1See more

notes-project-fromt-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
vlebediantsev/notes-project-front:latest945675fd2636
python3.11@3.11.2-6
no fix listed

Open the chart page →

13,405
registration-ms-front-helm-chartnotesprojectchart0.1.01 of 1See more

registration-ms-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
python3.11@3.11.2-6
no fix listed

Open the chart page →

13,387
zookeeper-helm-chartnotesprojectchart0.1.01 of 1See more

zookeeper-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
wurstmeister/zookeeper:latest7a7fd44a7210
python2.7@2.7.6-8
python3.4@3.4.0-2ubuntu1
no fix listed
no fix listed

Open the chart page →

41,455
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
python2.7@2.7.17-1~18.04ubuntu1.2
no fix listed

Open the chart page →

27,486
splashntppoolVerified publisher1.0.41 of 1See more

splash ntppool 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
scrapinghub/splash:3.4.1a5f89bc84606
python3.6@3.6.9-1~18.04
no fix listed

Open the chart page →

27,667
nai-corenutanix-helm-releasesVerified publisher2.8.01 of 14See more

nai-core nutanix-helm-releases 2.8.0

1 of the 14 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
nutanix/nai-jobs:v2.8.09c373718e1b1
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

806
nai-operatorsnutanix-helm-releasesVerified publisher2.8.01 of 5See more

nai-operators nutanix-helm-releases 2.8.0

1 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
nutanix/nai-jobs:v2.8.09c373718e1b1
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

806
firecrawlobeoneVerified publisher3.0.31 of 5See more

firecrawl obeone 3.0.3

1 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
library/rabbitmq:3.13-management-alpine606d8c0d6b3c
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

9,895
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
alpine/k8s:1.31.106dbe6f391eda
python3@3.12.11-r0
3.12.14-r0

Open the chart page →

17,085
automx2oleds-helm-chartsVerified publisher1.0.51 of 1See more

automx2 oleds-helm-charts 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
oled01/automx2:2025.1.105d3e398e675
python@3.13.5-1
python3.11@3.11.2-6+deb12u6
3.10.21
no fix listed

Open the chart page →

5,313
pulsarolehrgfVerified publisher0.0.51 of 2See more

pulsar olehrgf 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.1.016f9fdab3fa6
python3.10@3.10.12-1~22.04.2
no fix listed

Open the chart page →

9,059
apicurioone-acre-fundVerified publisher2.3.03 of 5See more

apicurio one-acre-fund 2.3.0

3 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
apicurio/apicurio-studio-api:0.2.62.Final302d202ed149
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10
apicurio/apicurio-studio-ui:0.2.62.Final349c845270c2
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10
apicurio/apicurio-studio-ws:0.2.62.Final27a91978a388
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10

Open the chart page →

18,666
anchore-engineopencloudcx1.13.01 of 2See more

anchore-engine opencloudcx 1.13.0

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
anchore/anchore-engine:v0.10.0bde9eedf639d
python3@3.6.8-37.el8
0:3.6.8-78.el8_10

Open the chart page →

18,023
cdn-remoteopencord0.2.41 of 3See more

cdn-remote opencord 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:1.0.0d59ccb138ffb
python2.7@2.7.12-1ubuntu0~16.04.4
no fix listed

Open the chart page →

63,277
comacopencord1.0.03 of 9See more

comac opencord 1.0.0

3 of the 9 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
python2.7@2.7.12-1ubuntu0~16.04.4
python3.5@3.5.2-2ubuntu0~16.04.5
no fix listed
no fix listed
omecproject/onos-progran:1.0.05715e5648aa0
python2.7@2.7.12-1ubuntu0~16.04.3
python3.5@3.5.2-2ubuntu0~16.04.4
no fix listed
no fix listed
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
python2.7@2.7.12-1ubuntu0~16.04.4
python3.5@3.5.2-2ubuntu0~16.04.5
no fix listed
no fix listed

Open the chart page →

88,616
comac-platformopencord0.0.171 of 11See more

comac-platform opencord 0.0.17

1 of the 11 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
python2.7@2.7.12-1ubuntu0~16.04.4
python3.5@3.5.2-2ubuntu0~16.04.5
no fix listed
no fix listed

Open the chart page →

26,234
freeradiusopencord1.0.41 of 1See more

freeradius opencord 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
freeradius/freeradius-server:3.0.2121c8bfa904d8
python2.7@2.7.17-1~18.04
no fix listed

Open the chart page →

15,722
mcord-cdn-remoteopencord0.1.62 of 2See more

mcord-cdn-remote opencord 0.1.6

2 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:remote-v3d59ccb138ffb
python2.7@2.7.12-1ubuntu0~16.04.4
no fix listed
woojoong/wowza:latestec230db19652
python2.7@2.7.15~rc1-1ubuntu0.1
no fix listed

Open the chart page →

42,662
mcord-cdn-remote-freeopencord0.1.31 of 1See more

mcord-cdn-remote-free opencord 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:remote-v3d59ccb138ffb
python2.7@2.7.12-1ubuntu0~16.04.4
no fix listed

Open the chart page →

29,158
omec-control-planeopencord0.1.312 of 8See more

omec-control-plane opencord 0.1.31

2 of the 8 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
omecproject/c3po-hssdb:master-latest28a90cc26716
python2.7@2.7.18-1~20.04.1
no fix listed
omecproject/mme-exporter:paging-latestbcc5f19fd676
python3.6@3.6.9-1~18.04
no fix listed

Open the chart page →

40,795
onos-progranopencord1.2.71 of 2See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
muluder/prograncontrollermcord:0.1.843b597a93da7
python2.7@2.7.12-1ubuntu0~16.04.3
python3.5@3.5.2-2ubuntu0~16.04.4
no fix listed
no fix listed

Open the chart page →

38,889
ponsimv2opencord1.2.31 of 2See more

ponsimv2 opencord 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
voltha/voltha-tester:1.7.0655c3048a602
python2.7@2.7.12-1ubuntu0~16.04.4
no fix listed

Open the chart page →

12,631
sebaopencord1.0.06 of 17See more

seba opencord 1.0.0

6 of the 17 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
tpdock/freeradius:2.2.93da600c95a49
python2.7@2.7.12-1ubuntu0~16.04.2
python3.5@3.5.2-2ubuntu0~16.04.4
no fix listed
no fix listed
voltha/voltha-cli:1.6.0c4e41e92f046
python2.7@2.7.12-1ubuntu0~16.04.3
python3.5@3.5.2-2ubuntu0~16.04.5
no fix listed
no fix listed
voltha/voltha-envoy:1.6.059ab2a00f712
python3.4@3.4.3-1ubuntu1~14.04.5
no fix listed
voltha/voltha-netconf:1.6.037f80524c207
python2.7@2.7.12-1ubuntu0~16.04.3
no fix listed
voltha/voltha-ofagent:1.6.09ee8c1f4428c
python2.7@2.7.12-1ubuntu0~16.04.3
no fix listed
voltha/voltha-voltha:1.6.0ff596b62de59
python2.7@2.7.12-1ubuntu0~16.04.3
no fix listed

Open the chart page →

93,965
voltha-infraopencord2.14.01 of 10See more

voltha-infra opencord 2.14.0

1 of the 10 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
freeradius/freeradius-server:3.0.2121c8bfa904d8
python2.7@2.7.17-1~18.04
no fix listed

Open the chart page →

41,088
opencost-parquet-exporteropencostVerified publisher0.3.11 of 1See more

opencost-parquet-exporter opencost 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/opencost/opencost-parquet-exporter:v0.2.1ce85ef0ce665
python3.11@3.11.2-6+deb12u5
no fix listed

Open the chart page →

11,003
akeyless-api-gatewayopenshift1.41.21 of 1See more

akeyless-api-gateway openshift 1.41.2

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
akeyless/base-rhel:0.0.14ba8900a0061
python3@3.6.8-56.el8_9.3
0:3.6.8-78.el8_10

Open the chart page →

11,795
bpjstk-serviceopenshift1.0.03 of 6See more

bpjstk-service openshift 1.0.0

3 of the 6 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
andrianrf/backoffice:latest047a7837651e
python3@3.6.8-62.el8_10
0:3.6.8-78.el8_10
andrianrf/backoffice-be:latest6036614803d4
python3.9@3.9.16-1.el9
0:3.9.25-7.el9_8.3
andrianrf/iso-server:latest7da47f525c7d
python3.9@3.9.16-1.el9
0:3.9.25-7.el9_8.3

Open the chart page →

34,721
canvas-oamportalopenshift4.0.01 of 1See more

canvas-oamportal openshift 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
gurolakman/oam:4.0.0ed8fd2062548
python3@3.6.8-62.el8_10
0:3.6.8-78.el8_10

Open the chart page →

7,519
chatbot-ai-sampleopenshift0.1.62 of 4See more

chatbot-ai-sample openshift 0.1.6

2 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/ai-lab/llamacpp_python:latest70d138997acd
python3.9@3.9.18-3.el9_4.5
0:3.9.25-7.el9_8.3
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
python3.9@3.9.18-3.el9
0:3.9.25-7.el9_8.3

Open the chart page →

18,991
exporteropenshift1.0.473 of 3See more

exporter openshift 1.0.47

3 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
public.ecr.aws/perfectscale-io/kube-state-metrics:4.1.14-redhat849e235e2d3e
python3@3.6.8-67.el8_10
0:3.6.8-78.el8_10
public.ecr.aws/perfectscale-io/psc-exporter:v1.0.45-redhat9083e60c38bc
python3.9@3.9.19-8.el9_5.1
0:3.9.25-7.el9_8.3
public.ecr.aws/perfectscale-io/ubi9/ubi:9.5d7c3def9252b
python3.9@3.9.19-8.el9_5.1
0:3.9.25-7.el9_8.3

Open the chart page →

13,034
flomesh-consoleopenshift0.70.0-30-ubi82 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

2 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
python3@3.6.8-48.el8_7
0:3.6.8-78.el8_10
quay.io/flomesh/pipy-repo-ubi8:0.70.0-469912fdf6c183
python3@3.6.8-48.el8_7
0:3.6.8-78.el8_10

Open the chart page →

9,968
fsmopenshift0.1.8-ubi.61 of 6See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/flomesh/pipy-ubi8:0.50.0-8824352dca6672
python3@3.6.8-48.el8_7
0:3.6.8-78.el8_10

Open the chart page →

16,554
kb-cloud-installeropenshift2.1.351 of 1See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
python3.9@3.9.25-2.el9_7
0:3.9.25-7.el9_8.3

Open the chart page →

4,145
kite-agentopenshift1.0.01 of 1See more

kite-agent openshift 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/fengyuanxing/zte_endogenous_security/kite-agent:V2.0.0734808044936
python3@3.6.8-76.el8_10
0:3.6.8-78.el8_10

Open the chart page →

5,863
orion-ldopenshift1.0.31 of 2See more

orion-ld openshift 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/fiware/orion-ld:1.0.1ea838e5b4051
python3@3.6.8-39.el8_4
0:3.6.8-78.el8_10

Open the chart page →

14,727
osm-edgeopenshift1.2.1-ubi81 of 7See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/flomesh/pipy-ubi8:0.70.0-4635d87a381432
python3@3.6.8-48.el8_7
0:3.6.8-78.el8_10

Open the chart page →

19,449
redhat-trusted-application-pipelineopenshift1.0.21 of 2See more

redhat-trusted-application-pipeline openshift 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
python3.9@3.9.16-1.el9_2.1
0:3.9.25-7.el9_8.3

Open the chart page →

8,634
smsf-configurationopenshift1.0.41 of 1See more

smsf-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
gurolakman/smsf-configuration:1.0.49abb3882bcbd
python3@3.6.8-56.el8_9.2
0:3.6.8-78.el8_10

Open the chart page →

13,608
smsf-dispatcheropenshift1.0.41 of 1See more

smsf-dispatcher openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
gurolakman/smsf-dispatcher:1.0.46537e8ed8de8
python3@3.6.8-56.el8_9.2
0:3.6.8-78.el8_10

Open the chart page →

11,740
smsf-momtopenshift1.0.41 of 1See more

smsf-momt openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
gurolakman/smsf-momt:1.0.4ce23b20a8a17
python3@3.6.8-56.el8_9.2
0:3.6.8-78.el8_10

Open the chart page →

13,570
smsf-registrationopenshift1.0.41 of 1See more

smsf-registration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
gurolakman/smsf-registration:1.0.4b22e746edd5d
python3@3.6.8-56.el8_9.2
0:3.6.8-78.el8_10

Open the chart page →

13,553
ussigw-configurationopenshift1.0.41 of 1See more

ussigw-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
python3@3.6.8-56.el8_9.2
0:3.6.8-78.el8_10

Open the chart page →

13,457
ussigw-coreopenshift1.0.41 of 1See more

ussigw-core openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
gurolakman/ussigw-core:1.0.48739565c3ea2
python3@3.6.8-56.el8_9.2
0:3.6.8-78.el8_10

Open the chart page →

13,101
openshift-integration-operatoropenshift-integration-operatorVerified publisher0.8.21 of 2See more

openshift-integration-operator openshift-integration-operator 0.8.2

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/openshift-integration-operator:v0.8.2d6fc43ac802e
python3.9@3.9.21-1.el9_5
0:3.9.25-7.el9_8.3

Open the chart page →

2,063
open-vpnopenvpn0.0.11 of 1See more

open-vpn openvpn 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/openvpn-as:version-2.8.6-916f8e7d-ubuntu184ee0764310e7
python2.7@2.7.17-1~18.04ubuntu1.2
no fix listed

Open the chart page →

15,607
openvscode-serveropenvscode-server-helmVerified publisher2.7.371 of 2See more

openvscode-server openvscode-server-helm 2.7.37

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
antiantiops/vscode-browser-docker:1.137.0eeff80a99d92
python3.12@3.12.3-1ubuntu0.16
no fix listed

Open the chart page →

4,284
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
openwhisk/ow-utils:1.0.0c80dba0de3aa
python2.7@2.7.17-1~18.04ubuntu1.2
no fix listed

Open the chart page →

36,230

Container images carrying it

919 by charts deploying them

A fixed version is listed for 9 of the 18 affected packages.

Container imageDigestPackageFixed inUsed by
speckle/speckle-monitor-deployment:2.18.12-branch.testing3.88744-f55b34181335b40696a
python3.11@3.11.2-6
no fix listed
1
speckle/speckle-monitor-deployment:2.19.2-branch.hotfix-2.19.1.124125-665e7e1b696ac5022ab
python3.11@3.11.2-6
no fix listed
1
speckle/speckle-monitor-deployment:2.21.3-branch.testing5.219631-2153befcf72ad0f25fb
python3.11@3.11.2-6
no fix listed
1
speckle/speckle-monitor-deployment:2.18.11-branch.testing2.88634-335d469d6790a97ad47
python3.11@3.11.2-6
no fix listed
1
speckle/speckle-monitor-deployment:2.17.14-branch.testing.72707.921a5f8ff1641ac3f1b
python3.11@3.11.2-6
no fix listed
1
splunk/splunk-operator:2.0.0c4e0d3146226
python3@3.6.8-45.el8
0:3.6.8-78.el8_10
1
sslhep/servicex_app:v1.8.51d12f943cec5
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
sslhep/servicex_code_gen_atlas_xaod:v1.8.5e7aff7f97b89
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
sslhep/servicex_code_gen_func_adl_uproot:v1.8.5b01b8ee966ed
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
sslhep/servicex_code_gen_python:v1.8.50e4175a4e1eb
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
sslhep/servicex_code_gen_raw_uproot:v1.8.5671980005c57
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
sslhep/servicex_code_gen_topcp:v1.8.5596db2abdd09
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
sslhep/servicex-did-finder-atlasopenmagic:v1.8.554aaf1721d03
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
sslhep/servicex-did-finder-cernopendata:v1.8.52cb88ceab5bb
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
sslhep/servicex-did-finder-xrootd:v1.8.5c284442b44e3
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
stackstorm/st2actionrunner:3.888235ba70cad
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed
1
stackstorm/st2api:3.86f56d239d280
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed
1
stackstorm/st2auth:3.833ecfda16608
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed
1
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed
1
stackstorm/st2notifier:3.8f190a6212195
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed
1
stackstorm/st2rulesengine:3.8259503496ff9
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed
1
stackstorm/st2scheduler:3.8b1de2055c362
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed
1
stackstorm/st2sensorcontainer:3.8b1a338f64773
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed
1
stackstorm/st2stream:3.81c8904a3bf67
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed
1
stackstorm/st2timersengine:3.81bf35bfaf00c
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed
1
stackstorm/st2workflowengine:3.819fdfffdbba8
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed
1
stashapp/stash:latest24dbd7607174
python3.8@3.8.5-1~20.04.2
no fix listed
1
stashapp/stash:v0.31.1df744af5a0c9
python3@3.12.13-r0
3.12.14-r0
1
statcan/ckan:2.93921305425b8
python3.8@3.8.5-1~20.04.3
no fix listed
1
streamnative/apache-pulsar-grafana-dashboard-k8s:0.0.1611bceacec8fb
python3.8@3.8.5-1~20.04.3
no fix listed
1
substratusai/verba:v0.4.0-baseURL261695be635eb
python3.11@3.11.2-6
no fix listed
1
supabase/realtime:v2.102.3aa1c92c0cf32
python3.11@3.11.2-6+deb12u7
no fix listed
1
supabase/realtime:latestd3aa0c86c7b3
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
supabase/storage-api:v1.60.4c8eb9858eafe
python3@3.12.13-r0
3.12.14-r0
1
supabase/studio:20241021-9f9b08326d8070c55e9
python3.11@3.11.2-6+deb12u3
no fix listed
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
python3.11@3.11.2-6+deb12u8
no fix listed
1
supabase/studio:latest94a2a9d2906e
python3.11@3.11.2-6+deb12u8
no fix listed
1
svtechnmaa/svtech_debuger:v1.0.3a934ffd63d25
python3.10@3.10.12-1~22.04.3
no fix listed
1
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
python2.7@2.7.18-1~20.04.3
no fix listed
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed
1
sysnet4admin/colosseum-cms:loge74b43c7f492
python3.11@3.11.2-6+deb12u6
no fix listed
1
sysnet4admin/colosseum-prm:log5802bfcd7fed
python3.11@3.11.2-6+deb12u6
no fix listed
1
szurubooru/server:2.5accf2ad9fbc3
python3@3.12.13-r0
3.12.14-r0
1
teknas09/bird-pod:latest12a1fa85c4aa
python3.11@3.11.2-6
no fix listed
1
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
python3@3.12.11-r0
3.12.14-r0
1
temporalio/admin-tools:1.28cfde8170c92f
python3@3.12.12-r0
3.12.14-r0
1
tensorflow/tensorflow:1.6.0-devel1e3172090703
python2.7@2.7.12-1ubuntu0~16.04.3
python3.5@3.5.2-2ubuntu0~16.04.4
no fix listed
no fix listed
1
theradius/loggia:0.463ba348546ec
python3.11@3.11.2-6
no fix listed
1
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
python3.13@3.13.5-2+deb13u2
3.13.5-2+deb13u5
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.