StackRadar

CVE-2026-11940

High

Advisory

Published 23 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.007
53rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
888
of 17,787 indexed, latest versions
Container images
919
deployed by those charts
Fix available
9 of 18
affected packages

tarfile extraction filter bypass allows escaping the destination directory

Carried by container images the latest versions of 888 of 17,787 indexed charts deploy, on 919 images.

Affected packageAffected versionsFixed inImages
python3.11deb3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 moreno fix listed181
python3.8deb3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 moreno fix listed100
python3.12deb3.12.3-1, 3.12.3-1ubuntu0.1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3+12 moreno fix listed89
python3.10deb3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 moreno fix listed80
python3apk3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more3.12.14-r0, 3.14.7-r075
python3.13deb3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4, 3.13.7-1ubuntu0.13.13.5-2+deb13u575
python2.7deb2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 moreno fix listed54
python3.6deb3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 moreno fix listed44
python3.5deb3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9no fix listed25
python3.14deb3.14.4-1, 3.14.4-1ubuntu0.1, 3.14.4-1ubuntu0.2no fix listed9
python3.4deb3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7no fix listed7
python-3.14apk3.14.2-r2, 3.14.4-r2, 3.14.6-r03.14.6-r36
pythonbitnami3.11.11-0, 3.12.8-0, 3.13.5-13.10.213
python-3.13apk3.13.7-r0, 3.13.10-r0, 3.13.12-r23.13.14-r23
python-3.12apk3.12.0-r1, 3.12.9-r13.12.13-r102
python3rpm3.6.8-15.1.el8, 3.6.8-23.el8, 3.6.8-24.el8_2, 3.6.8-24.el8_2.2+27 more0:3.6.8-78.el8_10, 0:3.6.8-78.el8_10.rocky.0136
python3.9rpm3.9.16-1.el9, 3.9.16-1.el9_2.1, 3.9.16-1.el9_2.2, 3.9.18-1.el9_3.1+16 more0:3.9.25-7.el9_8.361
python3.12rpm3.12.5-2.el9_5.2, 3.12.13-2.el10_2.1, 3.12.13-3.el8_10, 3.12.13-3.el9_8.10:3.12.14-1.el8_10, 0:3.12.14-1.el9_8, 0:3.12.14-1.el10_25
OSV records
ALPINE-CVE-2026-11940BIT-python-2026-11940CGA-2877-fmjf-8j5qCGA-cr9q-h4v8-hfgpCGA-qmm2-954x-xmxrDEBIAN-CVE-2026-11940RHSA-2026:54268RHSA-2026:56219RHSA-2026:58902RHSA-2026:58971RHSA-2026:59009RLSA-2026:54268RLSA-2026:56219RLSA-2026:58902UBUNTU-CVE-2026-11940
Also known as
BIT-libpython-2026-11940, BIT-python-min-2026-11940, CGA-5363-9r7r-rr55, CGA-p86c-g5pg-rvpw, CGA-w3m6-c9vj-wm85, PSF-2026-30, RHSA-2026:64806, RHSA-2026:64816

Charts affected

888 by stars
ChartLatestAffected imagesRadar Score
issuegenopsmxVerified publisher1.0.21 of 1See more

issuegen opsmx 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
opsmx11/issuegen:v2.1.05c50ca123d88
python3.4@3.4.3-1ubuntu1~14.04.6
no fix listed

Open the chart page →

26,367
grrosdfir-infrastructureVerified publisher1.0.31 of 5See more

grr osdfir-infrastructure 1.0.3

1 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/google/fleetspeak:v0.1.17cd264d33efd4
python3.11@3.11.2-6+deb12u2
no fix listed

Open the chart page →

10,965
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.09 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

9 of the 40 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/google/fleetspeak:v0.1.17cd264d33efd4
python3.11@3.11.2-6+deb12u2
no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
python3.12@3.12.3-1ubuntu0.15
no fix listed

Open the chart page →

72,154
radiusp2p-avs0.1.01 of 1See more

radius p2p-avs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
theradius/loggia:0.463ba348546ec
python3.11@3.11.2-6
no fix listed

Open the chart page →

11,095
ungatep2p-avs0.1.02 of 3See more

ungate p2p-avs 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
python3.11@3.11.2-6+deb12u2
no fix listed
xom4ekp2p/infini-route-attestators-public-mainnet-avs-webapi:latest2745b5fd8785
python3.11@3.11.2-6+deb12u2
no fix listed

Open the chart page →

25,681
p4p40.1.02 of 7See more

p4 p4 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
library/rabbitmq:3.11-managementc3f70098e01d
python3.10@3.10.12-1~22.04.3
no fix listed
mastercloudapps/server:v2.23f3d24dfe2686
python3@3.6.8-48.el8_7
0:3.6.8-78.el8_10

Open the chart page →

27,667
minecraftpaul1365972-mc3.0.11 of 1See more

minecraft paul1365972-mc 3.0.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
itzg/minecraft-server:latest8672e335dbef
python3.12@3.12.3-1ubuntu0.16
no fix listed

Open the chart page →

4,315
pet-battle-infrapetbattle1.0.321 of 2See more

pet-battle-infra petbattle 1.0.32

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.8bb5e052770e5
python3@3.6.8-39.el8_4.1
0:3.6.8-78.el8_10

Open the chart page →

15,466
pet-battle-tournamentpetbattle1.0.401 of 3See more

pet-battle-tournament petbattle 1.0.40

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.8bb5e052770e5
python3@3.6.8-39.el8_4.1
0:3.6.8-78.el8_10

Open the chart page →

15,466
redis-stack-awsphamxuanduong0.1.01 of 1See more

redis-stack-aws phamxuanduong 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
redis/redis-stack-server:7.4.0-v0887cf87cc744
python3.10@3.10.12-1~22.04.4
no fix listed

Open the chart page →

3,277
dummy-servicephanVerified publisher0.3.41 of 1See more

dummy-service phan 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
phan2410/dummy-service:0.0.89c6ed6de26ca
python3.11@3.11.2-6+deb12u5
no fix listed

Open the chart page →

5,731
falcon-asgi-serverphanVerified publisher0.1.01 of 1See more

falcon-asgi-server phan 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
phan2410/falcon-asgi-server:0.1.04a86d138832d
python3.11@3.11.2-6+deb12u5
no fix listed

Open the chart page →

8,215
phronetisphronetis0.1.272 of 2See more

phronetis phronetis 0.1.27

2 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
python3.12@3.12.3-1ubuntu0.5
no fix listed
knspar/phronetis-operator:0.1.60c4f0543ee58
python3.11@3.11.2-6
no fix listed

Open the chart page →

15,077
seafilephybros-helm-charts4.0.11 of 1See more

seafile phybros-helm-charts 4.0.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.97ac833196f60
python3.8@3.8.10-0ubuntu1~20.04.5
no fix listed

Open the chart page →

22,146
piepieVerified publisher0.11.11 of 1See more

pie pie 0.11.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/topolvm/pie:0.18.0aa467443e407
python3.10@3.10.12-1~22.04.17
no fix listed

Open the chart page →

2,149
firehose-ethereumpinaxVerified publisher0.3.21 of 2See more

firehose-ethereum pinax 0.3.2

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/firehose-ethereum:v2.12.4-gethd7bdfa7b41da
python3.12@3.12.3-1ubuntu0.7
no fix listed

Open the chart page →

7,149
subgraph-oraclepinaxVerified publisher0.0.11 of 1See more

subgraph-oracle pinax 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/graphprotocol/availability-oracle:sha-28312fd472a25038957
python3.11@3.11.2-6+deb12u2
no fix listed

Open the chart page →

11,373
substreams-sink-kvpinaxVerified publisher0.0.41 of 1See more

substreams-sink-kv pinax 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/substreams-sink-kv:v2.3.026953ec68d5d
python3.8@3.8.10-0ubuntu1~20.04.13
no fix listed

Open the chart page →

6,695
substreams-sink-nooppinaxVerified publisher0.0.31 of 1See more

substreams-sink-noop pinax 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/substreams-sink-noop:v1.4.0d7c43c3135c6
python3.8@3.8.10-0ubuntu1~20.04.13
no fix listed

Open the chart page →

6,641
substreams-tier-2pinaxVerified publisher0.0.81 of 1See more

substreams-tier-2 pinax 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/firehose-ethereum:v2.12.489969b78fb07
python3.12@3.12.3-1ubuntu0.7
no fix listed

Open the chart page →

4,938
pingdom-operatorpingdom-operator0.0.201 of 1See more

pingdom-operator pingdom-operator 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
python3.11@3.11.2-6+deb12u2
no fix listed

Open the chart page →

11,017
planectlplanectlVerified publisher0.7.01 of 10See more

planectl planectl 0.7.0

1 of the 10 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
library/node:208f693eaa7e0a
python3.11@3.11.2-6+deb12u6
no fix listed

Open the chart page →

25,626
gitlab-runner-operatorpnnl-miscscripts0.1.61 of 1See more

gitlab-runner-operator pnnl-miscscripts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
python3@3.6.8-15.1.el8
0:3.6.8-78.el8_10

Open the chart page →

11,153
tenant-namespace-operatorpnnl-miscscripts0.1.281 of 1See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10

Open the chart page →

12,754
pod-birdspod-birds0.1.01 of 1See more

pod-birds pod-birds 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
teknas09/bird-pod:latest12a1fa85c4aa
python3.11@3.11.2-6
no fix listed

Open the chart page →

11,680
Practica_4_helmpr04helm0.1.02 of 7See more

Practica_4_helm pr04helm 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
codeurjc/server:v1.0310bea5b1ee7
python3@3.6.8-48.el8_7
0:3.6.8-78.el8_10
library/rabbitmq:3.9-management8a279e9396a8
python3.10@3.10.12-1~22.04.3
no fix listed

Open the chart page →

27,649
practica-helmpractica-helm0.1.01 of 7See more

practica-helm practica-helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
library/rabbitmq:3-management-alpine606d8c0d6b3c
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

28,495
priceapp-chartpriceapp0.1.01 of 1See more

priceapp-chart priceapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ildarmukhametzyanov/priceapp:0.115d23720a3ee
python3.11@3.11.2-6
no fix listed

Open the chart page →

6,932
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

2,752
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

3,271
powerdnspuckpuck2.0.01 of 4See more

powerdns puckpuck 2.0.0

1 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
pschiffe/pdns-admin:0.4.137ebba8c2b8f
python3.9@3.9.25-7.el9_8.2
0:3.9.25-7.el9_8.3

Open the chart page →

4,614
game-serverpvillaverdeVerified publisher1.0.51 of 1See more

game-server pvillaverde 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/itzg/minecraft-server:latestc1a267d9ed6d
python3.12@3.12.3-1ubuntu0.16
no fix listed

Open the chart page →

4,315
pyredispyredis-helm0.1.01 of 2See more

pyredis pyredis-helm 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
avinash263/pyredis263:latestaa2b8727f1a6
python3.11@3.11.2-6
no fix listed

Open the chart page →

12,652
mychartpythonweb0.1.01 of 1See more

mychart pythonweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
qichenxu4pd/pythonexample:1.0f3a8502bc21b
python3.11@3.11.2-6
no fix listed

Open the chart page →

11,400
mypythonpythonweb0.1.01 of 1See more

mypython pythonweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
qichenxu4pd/pythonexample:1.0f3a8502bc21b
python3.11@3.11.2-6
no fix listed

Open the chart page →

11,400
cupsr2dlan-helm-chartsVerified publisher0.1.01 of 1See more

cups r2dlan-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
anujdatar/cups:25.07.01685df04a643b
python3.11@3.11.2-6+deb12u6
no fix listed

Open the chart page →

7,691
rada-platformrada-platform0.1.03 of 7See more

rada-platform rada-platform 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
python3.11@3.11.2-6+deb12u3
no fix listed
trinodb/trino:45038c6f24ab1a4
python3.9@3.9.18-3.el9
0:3.9.25-7.el9_8.3
ghcr.io/projectnessie/nessie:0.92.19efe3c74d55f
python3.9@3.9.18-3.el9_4.1
0:3.9.25-7.el9_8.3

Open the chart page →

20,812
kubecostradar-baseVerified publisher1.0.01 of 7See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.22a461dc5cb96a
python3.9@3.9.21-1.el9_5
0:3.9.25-7.el9_8.3

Open the chart page →

9,389
radar-cp-ksql-serverradar-baseVerified publisher0.0.21 of 2See more

radar-cp-ksql-server radar-base 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
python3@3.6.8-56.el8_9.3
0:3.6.8-78.el8_10

Open the chart page →

5,269
radar-kafkaradar-baseVerified publisher0.4.11 of 2See more

radar-kafka radar-base 0.4.1

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
python3.9@3.9.21-1.el9_5
0:3.9.25-7.el9_8.3

Open the chart page →

4,236
strimzi-kafka-operatorradar-baseVerified publisher0.46.01 of 1See more

strimzi-kafka-operator radar-base 0.46.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
python3.9@3.9.21-1.el9_5
0:3.9.25-7.el9_8.3

Open the chart page →

1,968
rawfile-localpvrawfile0.15.21 of 6See more

rawfile-localpv rawfile 0.15.2

1 of the 6 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
openebs/rawfile-localpv:v0.15.2a39ef27ea28b
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

2,794
javareact-java0.1.01 of 1See more

java react-java 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
project2team4/react:latest3ff031a08887
python3.8@3.8.10-0ubuntu1~20.04.4
no fix listed

Open the chart page →

15,583
ibm-mongodb-enterprise-helmredhat0.3.01 of 1See more

ibm-mongodb-enterprise-helm redhat 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ibmcom/ibm-enterprise-mongodb-ppc64le:4.4d28bf361327a
python3@3.6.8-31.el8
0:3.6.8-78.el8_10

Open the chart page →

12,248
ansible-automation-platformredhat-cop0.0.91 of 1See more

ansible-automation-platform redhat-cop 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.7464a3af4dfe0
python3@3.6.8-39.el8_4.1
0:3.6.8-78.el8_10

Open the chart page →

15,290
argocd-operatorredhat-cop1.2.21 of 1See more

argocd-operator redhat-cop 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.7464a3af4dfe0
python3@3.6.8-39.el8_4.1
0:3.6.8-78.el8_10

Open the chart page →

15,290
ploigosredhat-cop0.0.91 of 2See more

ploigos redhat-cop 0.0.9

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.66722d5041b47
python3@3.6.8-24.el8_2
0:3.6.8-78.el8_10

Open the chart page →

11,437
sonatype-nexusredhat-cop1.1.131 of 2See more

sonatype-nexus redhat-cop 1.1.13

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/openshift/origin-jenkins-agent-base:latestc241c971aef8
python3@3.6.8-47.el8_6.4
0:3.6.8-78.el8_10

Open the chart page →

16,060
stackrox-chartredhat-cop0.0.101 of 1See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
python3@3.6.8-37.el8
0:3.6.8-78.el8_10

Open the chart page →

29,226
redminerestic-pvc-backupVerified publisher0.2.61 of 1See more

redmine restic-pvc-backup 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

4,252

Container images carrying it

919 by charts deploying them

A fixed version is listed for 9 of the 18 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
python3.11@3.11.2-6+deb12u6
no fix listed
1
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
python3.13@3.13.5-2+deb13u2
3.13.5-2+deb13u5
1
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
python3.11@3.11.2-6+deb12u2
no fix listed
1
ghcr.io/netbox-community/netbox:v4.7.01685e91c61bb
python3.14@3.14.4-1ubuntu0.2
no fix listed
1
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
python3.11@3.11.2-6+deb12u7
no fix listed
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
python3.11@3.11.2-6+deb12u7
no fix listed
1
ghcr.io/opencost/opencost-parquet-exporter:v0.2.1ce85ef0ce665
python3.11@3.11.2-6+deb12u5
no fix listed
1
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
python3.12@3.12.3-1ubuntu0.15
no fix listed
1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
python3.12@3.12.3-1ubuntu0.15
no fix listed
1
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
python3.12@3.12.3-1ubuntu0.15
no fix listed
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
python3.12@3.12.3-1ubuntu0.15
no fix listed
1
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
python3.12@3.12.3-1ubuntu0.15
no fix listed
1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
python3.12@3.12.3-1ubuntu0.15
no fix listed
1
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
python3.12@3.12.3-1ubuntu0.15
no fix listed
1
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
python3.12@3.12.3-1ubuntu0.15
no fix listed
1
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
python2.7@2.7.18-1~20.04.1
python3.8@3.8.10-0ubuntu1~20.04.4
no fix listed
no fix listed
1
ghcr.io/plausible/community-edition:v3.0.114c1afde21d6
python3@3.12.10-r0
3.12.14-r0
1
ghcr.io/projectnessie/nessie:0.92.19efe3c74d55f
python3.9@3.9.18-3.el9_4.1
0:3.9.25-7.el9_8.3
1
ghcr.io/projectnessie/nessie:0.108.4c0f42874c810
python3.9@3.9.25-7.el9_8.2
0:3.9.25-7.el9_8.3
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
ghcr.io/samr037/node-debug-dashboard:0.3.0c79b2e64a211
python3.11@3.11.2-6+deb12u8
no fix listed
1
ghcr.io/sdr-enthusiasts/docker-flightradar24:latest917e53402d51
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
python3.11@3.11.2-6+deb12u5
no fix listed
1
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
ghcr.io/smarter-project/audio-client:v3.1.23c8375dc5487
python3.8@3.8.10-0ubuntu1~20.04.5
no fix listed
1
ghcr.io/smarter-project/gstreamer:v1.0.25ecb16015aa8
python3.8@3.8.10-0ubuntu1~20.04.5
no fix listed
1
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
python3.8@3.8.10-0ubuntu1~20.04.5
no fix listed
1
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
python3.12@3.12.3-1ubuntu0.12
no fix listed
1
ghcr.io/streamingfast/firehose-core:v1.12.391fca773a63f
python3.12@3.12.3-1ubuntu0.9
no fix listed
1
ghcr.io/streamingfast/firehose-ethereum:v2.12.489969b78fb07
python3.12@3.12.3-1ubuntu0.7
no fix listed
1
ghcr.io/streamingfast/firehose-ethereum:v2.14.3bf816072380e
python3.12@3.12.3-1ubuntu0.9
no fix listed
1
ghcr.io/streamingfast/firehose-ethereum:v2.12.4-gethd7bdfa7b41da
python3.12@3.12.3-1ubuntu0.7
no fix listed
1
ghcr.io/streamingfast/go-ethereum:geth-v1.16.9-fh3.08e3cb38953a3
python3.12@3.12.3-1ubuntu0.10
no fix listed
1
ghcr.io/streamingfast/substreams-sink-kv:v2.3.026953ec68d5d
python3.8@3.8.10-0ubuntu1~20.04.13
no fix listed
1
ghcr.io/streamingfast/substreams-sink-noop:v1.4.0d7c43c3135c6
python3.8@3.8.10-0ubuntu1~20.04.13
no fix listed
1
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
python3.12@3.12.3-1ubuntu0.13
no fix listed
1
ghcr.io/tarampampam/video-dl-bot:1.4.36daa2dc7556b
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
python-3.14@3.14.4-r2
3.14.6-r3
1
ghcr.io/thoroslives/zilean:v3.10.1bce6aca0f6ca
python3@3.11.12-r1
3.12.14-r0
1
ghcr.io/topolvm/pie:0.18.0aa467443e407
python3.10@3.10.12-1~22.04.17
no fix listed
1
ghcr.io/topolvm/topolvm-with-sidecar:0.41.170548dbe0c6a
python3.10@3.10.12-1~22.04.17
no fix listed
1
ghcr.io/topolvm/topolvm-with-sidecar:0.35.0b354978c440d
python3.10@3.10.12-1~22.04.6
no fix listed
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
python3.11@3.11.2-6+deb12u6
no fix listed
1
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
python3.11@3.11.2-6
no fix listed
1
ghcr.io/wittdennis/homeassistant-otbr:4.2.31b53b0b3488e
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
python3.11@3.11.2-6
no fix listed
1
ghcr.io/wundergraph/cosmo/otelcollector:0.18.15a6fe78d4d15
python3.11@3.11.2-6+deb12u5
no fix listed
1
ghcr.io/zazukoians/qlever-server:v0.10.0f10fd24b2290
python3.12@3.12.3-1ubuntu0.15
no fix listed
1
ghcr.io/zoriya/kyoo_autosync:4.7.1fbba58ddb1a6
python3.11@3.11.2-6+deb12u4
no fix listed
1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
python3.11@3.11.2-6+deb12u4
no fix listed
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.