StackRadar

CVE-2026-11940

High

Advisory

Published 23 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.007
53rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
882
of 17,787 indexed, latest versions
Container images
914
deployed by those charts
Fix available
9 of 18
affected packages

tarfile extraction filter bypass allows escaping the destination directory

Carried by container images the latest versions of 882 of 17,787 indexed charts deploy, on 914 images.

Affected packageAffected versionsFixed inImages
python3.11deb3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 moreno fix listed180
python3.8deb3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 moreno fix listed100
python3.12deb3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+11 moreno fix listed87
python3.10deb3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 moreno fix listed80
python3apk3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more3.12.14-r0, 3.14.7-r075
python3.13deb3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4, 3.13.7-1ubuntu0.13.13.5-2+deb13u574
python2.7deb2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 moreno fix listed54
python3.6deb3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 moreno fix listed44
python3.5deb3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9no fix listed25
python3.14deb3.14.4-1, 3.14.4-1ubuntu0.1, 3.14.4-1ubuntu0.2no fix listed9
python3.4deb3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7no fix listed7
python-3.14apk3.14.2-r2, 3.14.4-r2, 3.14.6-r03.14.6-r36
pythonbitnami3.11.11-0, 3.12.8-0, 3.13.5-13.10.213
python-3.13apk3.13.7-r0, 3.13.10-r0, 3.13.12-r23.13.14-r23
python-3.12apk3.12.0-r1, 3.12.9-r13.12.13-r102
python3rpm3.6.8-15.1.el8, 3.6.8-23.el8, 3.6.8-24.el8_2, 3.6.8-24.el8_2.2+27 more0:3.6.8-78.el8_10, 0:3.6.8-78.el8_10.rocky.0135
python3.9rpm3.9.16-1.el9, 3.9.16-1.el9_2.1, 3.9.16-1.el9_2.2, 3.9.18-1.el9_3.1+16 more0:3.9.25-7.el9_8.361
python3.12rpm3.12.5-2.el9_5.2, 3.12.13-2.el10_2.1, 3.12.13-3.el8_10, 3.12.13-3.el9_8.10:3.12.14-1.el8_10, 0:3.12.14-1.el9_8, 0:3.12.14-1.el10_25
OSV records
ALPINE-CVE-2026-11940BIT-python-2026-11940CGA-2877-fmjf-8j5qCGA-cr9q-h4v8-hfgpCGA-qmm2-954x-xmxrDEBIAN-CVE-2026-11940RHSA-2026:54268RHSA-2026:56219RHSA-2026:58902RHSA-2026:58971RHSA-2026:59009RLSA-2026:54268RLSA-2026:56219RLSA-2026:58902UBUNTU-CVE-2026-11940
Also known as
BIT-libpython-2026-11940, BIT-python-min-2026-11940, CGA-5363-9r7r-rr55, CGA-p86c-g5pg-rvpw, CGA-w3m6-c9vj-wm85, PSF-2026-30, RHSA-2026:64806, RHSA-2026:64816

Charts affected

882 by stars
ChartLatestAffected imagesRadar Score
gotenbergadnoctemVerified publisher0.5.01 of 1See more

gotenberg adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.37.0f29984bd1e22
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

5,582
uptime-kumaadnoctemVerified publisher0.4.11 of 1See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
python3.11@3.11.2-6+deb12u7
no fix listed

Open the chart page →

30,028
graphserviceaerospike-helmVerified publisher3.3.01 of 1See more

graphservice aerospike-helm 3.3.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
aerospike/aerospike-graph-service:3.3.0f35739b97a46
python3@3.14.5-r0
3.14.7-r0

Open the chart page →

453
akeyless-gatewayakeyless-services-helmVerified publisher3.5.31 of 2See more

akeyless-gateway akeyless-services-helm 3.5.3

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
akeyless/gateway:5.3.13d2e7dce5eb9
python3.12@3.12.3-1ubuntu0.16
no fix listed

Open the chart page →

1,522
aktoakto0.2.02 of 7See more

akto akto 0.2.0

2 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:6.2.11-1-ubi8ac776fad95a5
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10
confluentinc/cp-zookeeper:6.2.11-1-ubi8cae577096489
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10

Open the chart page →

13,613
akto-ai-guardrails-v2akto0.3.01 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

1 of the 6 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
redis/redis-stack-server:7.4.0-v172035434f455
python3.10@3.10.12-1~22.04.6
no fix listed

Open the chart page →

9,321
akto-central-setupakto1.1.101 of 5See more

akto-central-setup akto 1.1.10

1 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.28e01c0305844
python3.9@3.9.25-7.el9_8
0:3.9.25-7.el9_8.3

Open the chart page →

4,905
akto-hybrid-redactakto1.44.61See more

akto-hybrid-redact akto 1.44.6

1 container image this version deploys carries CVE-2026-11940.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
python3.9@3.9.23-2.el9
0:3.9.25-7.el9_8.3

Open the chart page →

—
akto-k8s-ebpfakto0.1.31 of 1See more

akto-k8s-ebpf akto 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
aktosecurity/mirror-api-logging:k8s_ebpffcf8be10bead
python3@3.12.13-r0
3.12.14-r0

Open the chart page →

838
akto-k8s-ebpf-openshiftakto0.1.11 of 1See more

akto-k8s-ebpf-openshift akto 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/mirror-api-logging:k8s_ebpf_core_impd94ce715f051
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

1,276
akto-mini-runtimeakto0.7.221 of 3See more

akto-mini-runtime akto 0.7.22

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
python3.9@3.9.25-7.el9_8
0:3.9.25-7.el9_8.3

Open the chart page →

2,741
akto-mini-runtime-shaakto0.7.231 of 3See more

akto-mini-runtime-sha akto 0.7.23

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafkadigest-pinnedd20bd62f0182
python3.9@3.9.23-2.el9
0:3.9.25-7.el9_8.3

Open the chart page →

3,217
akto-mini-testingakto1.45.72 of 5See more

akto-mini-testing akto 1.45.7

2 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-puppeteer-replay:1.49.4_latestf1c5763d565e
python3@3.12.13-r0
3.12.14-r0
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
python3.9@3.9.25-7.el9_8
0:3.9.25-7.el9_8.3

Open the chart page →

6,486
akto-mini-testing-kafkaakto1.42.12 of 5See more

akto-mini-testing-kafka akto 1.42.1

2 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.8.0-3-ubi8adc392d28a1e
python3@3.6.8-69.el8_10
0:3.6.8-78.el8_10
confluentinc/cp-zookeeper:7.8.0-3-ubi85ca5f3269814
python3@3.6.8-69.el8_10
0:3.6.8-78.el8_10

Open the chart page →

6,397
akto-mrs-runtime-combinedakto0.0.21 of 2See more

akto-mrs-runtime-combined akto 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
python3.9@3.9.21-2.el9_6.2
0:3.9.25-7.el9_8.3

Open the chart page →

1,826
akto-protectionakto0.1.02 of 4See more

akto-protection akto 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:6.2.11-1-ubi8ac776fad95a5
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10
confluentinc/cp-zookeeper:6.2.11-1-ubi8cae577096489
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10

Open the chart page →

11,285
akto-regional-setupakto1.3.12 of 9See more

akto-regional-setup akto 1.3.1

2 of the 9 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
redis/redis-stack-server:7.4.072035434f455
python3.10@3.10.12-1~22.04.6
no fix listed
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.28e01c0305844
python3.9@3.9.25-7.el9_8
0:3.9.25-7.el9_8.3

Open the chart page →

7,603
akto-runtimeakto0.1.81 of 2See more

akto-runtime akto 0.1.8

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
python3.9@3.9.25-7.el9_8
0:3.9.25-7.el9_8.3

Open the chart page →

1,411
akto-threat-backendakto0.1.51 of 2See more

akto-threat-backend akto 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
python3.9@3.9.25-7.el9_8
0:3.9.25-7.el9_8.3

Open the chart page →

1,490
akto-threat-clientakto0.2.01 of 2See more

akto-threat-client akto 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
python3.9@3.9.25-7.el9_8
0:3.9.25-7.el9_8.3

Open the chart page →

1,523
browserlessalekcVerified publisher1.2.71 of 1See more

browserless alekc 1.2.7

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/browserless/chrome:v2.56.7d600eac6283f
python3.12@3.12.3-1ubuntu0.17
no fix listed

Open the chart page →

2,078
esphomealexmorbo-esphomeVerified publisher1.0.01 of 1See more

esphome alexmorbo-esphome 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
esphome/esphome:2024.12.2b2c6322700ac
python3.11@3.11.2-6+deb12u4
no fix listed

Open the chart page →

6,324
amorphieamorphie0.1.21 of 18See more

amorphie amorphie 0.1.2

1 of the 18 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
hazelcast/management-center:5.3.2f9d34300d330
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10

Open the chart page →

28,131
anchore-admission-controlleranchore-charts0.8.51See more

anchore-admission-controller anchore-charts 0.8.5

1 container image this version deploys carries CVE-2026-11940.

Container imageDigestPackageFixed in
cfssl/cfssl:v1.6.5c9018c2ddf0b
python3.11@3.11.2-6
no fix listed

Open the chart page →

—
music-assistant-serverandibraeuVerified publisher2.1.21 of 1See more

music-assistant-server andibraeu 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.9.950666a6f8d7f
python3.11@3.11.2-6+deb12u7
no fix listed

Open the chart page →

5,817
mathesarandrenarchyVerified publisher1.8.01 of 1See more

mathesar andrenarchy 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
mathesar/mathesar:0.12.0091757cb01fe
python3.11@3.11.2-6+deb12u7
no fix listed

Open the chart page →

7,239
speech-to-phraseandrenarchyVerified publisher1.3.01 of 1See more

speech-to-phrase andrenarchy 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
rhasspy/wyoming-speech-to-phrase:1.4.3e532f0dbc6b2
python3.11@3.11.2-6+deb12u6
no fix listed

Open the chart page →

3,991
games-on-whalesangelnu2.0.02 of 7See more

games-on-whales angelnu 2.0.0

2 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
andrewmackrodt/firefox-x11:142.0.1-r133f9080470c9
python3.10@3.10.12-1~22.04.11
no fix listed
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
python3.8@3.8.10-0ubuntu1~20.04
no fix listed

Open the chart page →

42,126
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
python3.13@3.13.5-2
3.13.5-2+deb13u5

Open the chart page →

5,558
antigenic-docuseal-helm-chartantigenic-docuseal-helm-chartVerified publisher0.2.01 of 1See more

antigenic-docuseal-helm-chart antigenic-docuseal-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
docuseal/docuseal:2.4.17493fd7f6728
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

2,766
monitoringantmediaVerified publisher1.0.01 of 6See more

monitoring antmedia 1.0.0

1 of the 6 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
python3@3.6.8-69.el8_10
0:3.6.8-78.el8_10

Open the chart page →

2,453
apishiftapishiftVerified publisher0.3.02 of 4See more

apishift apishift 0.3.0

2 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/everythingascode/apishift:v0.3.08fbbcd23b902
python3.9@3.9.25-7.el9_8
0:3.9.25-7.el9_8.3
quay.io/everythingascode/apishift-backend:v0.3.014ff275b2e61
python3.9@3.9.21-1.el9_5
0:3.9.25-7.el9_8.3

Open the chart page →

2,902
app-mobilityappmo0.1.01 of 5See more

app-mobility appmo 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
dellemc/csm-application-mobility-controller:v0.1.0148ada9060a9
python3@3.6.8-47.el8_6
0:3.6.8-78.el8_10

Open the chart page →

12,521
inbox-server-distributedappscodeVerified publisher2025.12.252 of 4See more

inbox-server-distributed appscode 2025.12.25

2 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
library/cassandra:4.1.37cbcec0086ac
python3.10@3.10.12-1~22.04.3
no fix listed
library/rabbitmq:3.12.1-managementf020c06da226
python3.10@3.10.6-1~22.04.2ubuntu1.1
no fix listed

Open the chart page →

15,573
james-komposeappscodeVerified publisher0.1.02 of 4See more

james-kompose appscode 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
library/cassandra:4.1.37cbcec0086ac
python3.10@3.10.12-1~22.04.3
no fix listed
library/rabbitmq:3.12.1-managementf020c06da226
python3.10@3.10.6-1~22.04.2ubuntu1.1
no fix listed

Open the chart page →

16,975
platform-apiappscodeVerified publisher2026.9.111 of 3See more

platform-api appscode 2026.9.11

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
python3.13@3.13.5-2
3.13.5-2+deb13u5

Open the chart page →

37,268
maxscaleappuio2.0.11 of 1See more

maxscale appuio 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/appuio/maxscale-docker:6.4.613a01be102b0
python3@3.6.8-48.el8_7.1.rocky.0
0:3.6.8-78.el8_10.rocky.0

Open the chart page →

2,903
appwriteappwrite-helmVerified publisher1.3.21 of 8See more

appwrite appwrite-helm 1.3.2

1 of the 8 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.01aaa70127114
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

9,847
arlas-aiasarlas-stackVerified publisher28.8.01 of 22See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
python@3.12.8-0
3.10.21

Open the chart page →

40,238
arma-reforgerarma-reforger0.5.31 of 8See more

arma-reforger arma-reforger 0.5.3

1 of the 8 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/brittonhayes/arma-reforger:latest6fde1edc0983
python3.8@3.8.10-0ubuntu1~20.04.6
no fix listed

Open the chart page →

23,353
keystonearzu0.2.293 of 4See more

keystone arzu 0.2.29

3 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
library/rabbitmq:3.7-managementb6dd45cc35b3
python3.6@3.6.9-1~18.04ubuntu1.1
no fix listed
openstackhelm/heat:wallaby-ubuntu_focalf728510bab3c
python3.8@3.8.10-0ubuntu1~20.04.8
no fix listed
openstackhelm/keystone:wallaby-ubuntu_focale07d75953d2e
python3.8@3.8.10-0ubuntu1~20.04.8
no fix listed

Open the chart page →

22,568
automatedconfigurationassist-iot-automated-configuration1.0.02 of 5See more

automatedconfiguration assist-iot-automated-configuration 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.5.1dc9b972db002
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10
confluentinc/cp-zookeeper:7.5.10bec03c1f3ce
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10

Open the chart page →

14,728
dltkvassist-iot-data-integrity-verification0.2.02 of 9See more

dltkv assist-iot-data-integrity-verification 0.2.0

2 of the 9 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
hyperledger/fabric-ca-tools:latest4ce6f43ded2e
python2.7@2.7.12-1ubuntu0~16.04.3
python3.5@3.5.2-2ubuntu0~16.04.4
no fix listed
no fix listed
hyperledger/fabric-couchdb:0.4.15f6c724592abf
python2.7@2.7.12-1ubuntu0~16.04.4
python3.5@3.5.2-2ubuntu0~16.04.5
no fix listed
no fix listed

Open the chart page →

77,706
dltflassist-iot-dlt-based-fl0.2.02 of 9See more

dltfl assist-iot-dlt-based-fl 0.2.0

2 of the 9 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
hyperledger/fabric-ca-tools:latest4ce6f43ded2e
python2.7@2.7.12-1ubuntu0~16.04.3
python3.5@3.5.2-2ubuntu0~16.04.4
no fix listed
no fix listed
hyperledger/fabric-couchdb:0.4.15f6c724592abf
python2.7@2.7.12-1ubuntu0~16.04.4
python3.5@3.5.2-2ubuntu0~16.04.5
no fix listed
no fix listed

Open the chart page →

77,706
idmassist-iot-identity-manager0.1.01 of 2See more

idm assist-iot-identity-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
assistiot/identity-manager_kc:latest0df4b4fa899a
python3@3.6.8-47.el8_6
0:3.6.8-78.el8_10

Open the chart page →

13,352
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
assistiot/open_api_backend:1.1.230812ba93555
python3.10@3.10.12-1~22.04.3
no fix listed

Open the chart page →

18,277
smartorchestratorassist-iot-smart-orchestrator4.0.03 of 14See more

smartorchestrator assist-iot-smart-orchestrator 4.0.0

3 of the 14 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
python3.11@3.11.2-6
no fix listed
assistiot/smart-orchestrator_scheduler:latest38b003e55ff3
python3.11@3.11.2-6
no fix listed
assistiot/smart-orchestrator_scheduler_mc:latestb1dbe4d62a03
python3.11@3.11.2-6
no fix listed

Open the chart page →

45,363
videoaugmentationassist-iot-video-augmentation0.1.01 of 3See more

videoaugmentation assist-iot-video-augmentation 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
assistiot/video_augmentation:runner-cpu-lateste5ae539ce2cb
python3.8@3.8.10-0ubuntu1~20.04.7
no fix listed

Open the chart page →

13,913
astrotrekastria0.0.22 of 4See more

astrotrek astria 0.0.2

2 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg15-latesta8e3322e1cf9
python3.10@3.10.6-1~22.04.2ubuntu1
no fix listed
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
python3.11@3.11.2-6+deb12u3
no fix listed

Open the chart page →

32,501
bamboo-agentatlassian-data-centerVerified publisher2.0.151 of 1See more

bamboo-agent atlassian-data-center 2.0.15

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
atlassian/bamboo-agent-base:12.1.1151c2d7274eef
python3.12@3.12.3-1ubuntu0.16
no fix listed

Open the chart page →

1,581

Container images carrying it

914 by charts deploying them

A fixed version is listed for 9 of the 18 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/it-at-m/wjh-rechner:1.0.0bc70cdb5a01a
python3.9@3.9.18-1.el9_3.1
0:3.9.25-7.el9_8.3
1
ghcr.io/it-at-m/zammad-ldap-sync:dev10de22c8cbce
python3.9@3.9.25-7.el9_8
0:3.9.25-7.el9_8.3
1
ghcr.io/itzg/minecraft-server:latestc1a267d9ed6d
python3.12@3.12.3-1ubuntu0.16
no fix listed
1
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
python3@3.6.8-23.el8
0:3.6.8-78.el8_10
1
ghcr.io/jeremylong/open-vulnerability-data-mirror:v9.0.49a69aa14dc3e
python3@3.12.12-r0
3.12.14-r0
1
ghcr.io/jespernohr/dayz-dedicated-server:0.1.1ec01d3ac7887
python3.12@3.12.3-1ubuntu0.2
no fix listed
1
ghcr.io/jfwenisch/discord-experiencebot:latestb52ff07f9f0c
python3.6@3.6.9-1~18.04ubuntu1.12
no fix listed
1
ghcr.io/jfwenisch/steamcmd-manager:v0.4.5dab685e668d9
python3.12@3.12.3-1ubuntu0.3
no fix listed
1
ghcr.io/jfwenisch/webtools:v0.1.44569cae83c70
python3.12@3.12.3-1ubuntu0.3
no fix listed
1
ghcr.io/jr0dd/puppeteer:v13.3.26047599cd78e
python3.8@3.8.10-0ubuntu1~20.04.2
no fix listed
1
ghcr.io/k8s-at-home/bazarr:v1.0.3fdb5501cdfb9
python3.8@3.8.10-0ubuntu1~20.04.2
no fix listed
1
ghcr.io/k8s-at-home/haste-server:latest827aa2f2389d
python3.8@3.8.10-0ubuntu1~20.04
no fix listed
1
ghcr.io/k8s-at-home/nzbget:v21.1e5571acd10ce
python3.10@3.10.4-3ubuntu0.1
no fix listed
1
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
python3.8@3.8.5-1~20.04.2
no fix listed
1
ghcr.io/k8s-at-home/prowlarr:v0.3.0.1710c863aa9875fa
python3.8@3.8.10-0ubuntu1~20.04.4
no fix listed
1
ghcr.io/k8s-at-home/qbittorrent:v4.4.261deadd1ec78
python3.8@3.8.10-0ubuntu1~20.04.4
no fix listed
1
ghcr.io/k8s-at-home/sabnzbd:v3.3.1c2d6e775db5a
python3.8@3.8.5-1~20.04.3
no fix listed
1
ghcr.io/k8s-at-home/tautulli:v2.7.74ea617c30397
python3.8@3.8.10-0ubuntu1~20.04.1
no fix listed
1
ghcr.io/k8s-at-home/transmission:v3.006011182e3946
python3.8@3.8.10-0ubuntu1~20.04.5
no fix listed
1
ghcr.io/k8s-at-home/xteve:v2.2.0.200292b3614670f
python3.8@3.8.10-0ubuntu1~20.04.4
no fix listed
1
ghcr.io/kamu-data/kamu-api-server:0.89.04ed7a896dd2b
python3.8@3.8.10-0ubuntu1~20.04.18
no fix listed
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
python3@3.12.11-r0
3.12.14-r0
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
python3@3.12.11-r0
3.12.14-r0
1
ghcr.io/kore3lab/kore-board.terminal:v0.5.5f52e66eff50b
python3.6@3.6.9-1~18.04ubuntu1.9
no fix listed
1
ghcr.io/kubeflow/spark-operator/controller:2.2.1865ff4da5686
python3.8@3.8.10-0ubuntu1~20.04.18
no fix listed
1
ghcr.io/kubelauncher/cassandrab66aba320083
python3.14@3.14.4-1ubuntu0.1
no fix listed
1
ghcr.io/kubiyabot/agent-manager:v0.4.13757bdd779345
python3.13@3.13.5-2
3.13.5-2+deb13u5
1
ghcr.io/kvaps/kubefarm-ltsp:v0.13.424efef013a53
python3.8@3.8.10-0ubuntu1~20.04.2
no fix listed
1
ghcr.io/lerentis/bitwarden-crd-operator:0.17.00a608c6ead85
python3@3.12.12-r0
3.12.14-r0
1
ghcr.io/libreconnect/ferriscompany:0.1.0-rc6ed86db9f0efe
python3.11@3.11.2-6+deb12u3
no fix listed
1
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
python3.12@3.12.3-1ubuntu0.15
no fix listed
1
ghcr.io/linuxserver/duplicati:latesta792931146b4
python3.12@3.12.3-1ubuntu0.16
no fix listed
1
ghcr.io/linuxserver/healthchecks:version-v3.9b5c6bfb00b03
python3@3.12.10-r0
3.12.14-r0
1
ghcr.io/linuxserver/syslog-ng:4.10.247fae7f540f9
python3@3.12.13-r0
3.12.14-r0
1
ghcr.io/llm-d/llm-d-model-service:v0.0.158b99a8104a2f
python3.9@3.9.21-2.el9
0:3.9.25-7.el9_8.3
1
ghcr.io/lloesche/valheim-server:latest20fde516ce31
python3.13@3.13.5-2
3.13.5-2+deb13u5
1
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
python3.12@3.12.3-1ubuntu0.5
no fix listed
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
python3.11@3.11.2-6+deb12u6
no fix listed
1
ghcr.io/microboxlabs/miot-calendar:latest-jvm7157cdc0bf5b
python3.9@3.9.23-2.el9
0:3.9.25-7.el9_8.3
1
ghcr.io/microboxlabs/miot-srv:latest4ec11d229028
python3.9@3.9.23-2.el9
0:3.9.25-7.el9_8.3
1
ghcr.io/microboxlabs/miot-srv:latest5796553b41ae
python3.9@3.9.23-2.el9
0:3.9.25-7.el9_8.3
1
ghcr.io/middleware-labs/mw-kube-agent:1.12.09c7bc0f9bb35
python3.12@3.12.3-1ubuntu0.3
no fix listed
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
python3.11@3.11.2-6+deb12u6
no fix listed
1
ghcr.io/music-assistant/server:2.9.950666a6f8d7f
python3.11@3.11.2-6+deb12u7
no fix listed
1
ghcr.io/music-assistant/server:2.10.3885872224fa5
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
python3.11@3.11.2-6+deb12u6
no fix listed
1
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
python3.13@3.13.5-2+deb13u2
3.13.5-2+deb13u5
1
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
python3.11@3.11.2-6+deb12u2
no fix listed
1
ghcr.io/netbox-community/netbox:v4.7.01685e91c61bb
python3.14@3.14.4-1ubuntu0.2
no fix listed
1
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
python3.11@3.11.2-6+deb12u7
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.