StackRadar

CVE-2026-11940

High

Advisory

Published 23 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.007
53rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
888
of 17,787 indexed, latest versions
Container images
919
deployed by those charts
Fix available
9 of 18
affected packages

tarfile extraction filter bypass allows escaping the destination directory

Carried by container images the latest versions of 888 of 17,787 indexed charts deploy, on 919 images.

Affected packageAffected versionsFixed inImages
python3.11deb3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 moreno fix listed181
python3.8deb3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 moreno fix listed100
python3.12deb3.12.3-1, 3.12.3-1ubuntu0.1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3+12 moreno fix listed89
python3.10deb3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 moreno fix listed80
python3apk3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more3.12.14-r0, 3.14.7-r075
python3.13deb3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4, 3.13.7-1ubuntu0.13.13.5-2+deb13u575
python2.7deb2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 moreno fix listed54
python3.6deb3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 moreno fix listed44
python3.5deb3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9no fix listed25
python3.14deb3.14.4-1, 3.14.4-1ubuntu0.1, 3.14.4-1ubuntu0.2no fix listed9
python3.4deb3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7no fix listed7
python-3.14apk3.14.2-r2, 3.14.4-r2, 3.14.6-r03.14.6-r36
pythonbitnami3.11.11-0, 3.12.8-0, 3.13.5-13.10.213
python-3.13apk3.13.7-r0, 3.13.10-r0, 3.13.12-r23.13.14-r23
python-3.12apk3.12.0-r1, 3.12.9-r13.12.13-r102
python3rpm3.6.8-15.1.el8, 3.6.8-23.el8, 3.6.8-24.el8_2, 3.6.8-24.el8_2.2+27 more0:3.6.8-78.el8_10, 0:3.6.8-78.el8_10.rocky.0136
python3.9rpm3.9.16-1.el9, 3.9.16-1.el9_2.1, 3.9.16-1.el9_2.2, 3.9.18-1.el9_3.1+16 more0:3.9.25-7.el9_8.361
python3.12rpm3.12.5-2.el9_5.2, 3.12.13-2.el10_2.1, 3.12.13-3.el8_10, 3.12.13-3.el9_8.10:3.12.14-1.el8_10, 0:3.12.14-1.el9_8, 0:3.12.14-1.el10_25
OSV records
ALPINE-CVE-2026-11940BIT-python-2026-11940CGA-2877-fmjf-8j5qCGA-cr9q-h4v8-hfgpCGA-qmm2-954x-xmxrDEBIAN-CVE-2026-11940RHSA-2026:54268RHSA-2026:56219RHSA-2026:58902RHSA-2026:58971RHSA-2026:59009RLSA-2026:54268RLSA-2026:56219RLSA-2026:58902UBUNTU-CVE-2026-11940
Also known as
BIT-libpython-2026-11940, BIT-python-min-2026-11940, CGA-5363-9r7r-rr55, CGA-p86c-g5pg-rvpw, CGA-w3m6-c9vj-wm85, PSF-2026-30, RHSA-2026:64806, RHSA-2026:64816

Charts affected

888 by stars
ChartLatestAffected imagesRadar Score
signal-cli-rest-apigeek-cookbookVerified publisher1.2.21 of 1See more

signal-cli-rest-api geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
bbernhard/signal-cli-rest-api:0.57549ad08d7e14
python3.8@3.8.10-0ubuntu1~20.04.2
no fix listed

Open the chart page →

10,202
tautulligeek-cookbookVerified publisher11.4.21 of 1See more

tautulli geek-cookbook 11.4.2

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/tautulli:v2.7.74ea617c30397
python3.8@3.8.10-0ubuntu1~20.04.1
no fix listed

Open the chart page →

10,676
nacosgujunxiang0.1.51 of 1See more

nacos gujunxiang 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
python3.14@3.14.4-1ubuntu0.1
no fix listed

Open the chart page →

1,820
headscaleheadscaleVerified publisher1.0.191 of 3See more

headscale headscale 1.0.19

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
alpine/k8s:1.36.244ef4942e171
python3@3.14.5-r1
3.14.7-r0

Open the chart page →

3,396
coreinstill-aiOfficialVerified publisher0.1.754 of 15See more

core instill-ai 0.1.75

4 of the 15 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
instill/artifact-backend:b28766ac4a393e601ed
python3.13@3.13.5-2
3.13.5-2+deb13u5
instill/mgmt-backend:d0933d4ebe12f77a3f9
python3.13@3.13.5-2
3.13.5-2+deb13u5
instill/model-backend:611f0f2e980125e5ba5
python3.13@3.13.5-2
3.13.5-2+deb13u5
temporalio/admin-tools:1.28cfde8170c92f
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

30,920
dayz-dedicated-serverjespernohrVerified publisher0.1.21 of 3See more

dayz-dedicated-server jespernohr 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/jespernohr/dayz-dedicated-server:0.1.1ec01d3ac7887
python3.12@3.12.3-1ubuntu0.2
no fix listed

Open the chart page →

4,357
calibre-webk8s-home-lab-repo9.1.11 of 1See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
python3.12@3.12.3-1ubuntu0.15
no fix listed

Open the chart page →

4,546
kubearmorkubearmor1.7.42 of 4See more

kubearmor kubearmor 1.7.4

2 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
kubearmor/kubearmor:stablea08141311045
python3@3.12.13-r0
3.12.14-r0
kubearmor/kubearmor-init:stable236ade6e67b1
python3@3.12.13-r0
3.12.14-r0

Open the chart page →

1,355
kubeservice-lxcfs-webhookkubservice-chartsVerified publisher1.6.01 of 6See more

kubeservice-lxcfs-webhook kubservice-charts 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
dongjiang1989/lxcfs:v6.0.34bf9ae391948
python3.8@3.8.10-0ubuntu1~20.04.18
no fix listed

Open the chart page →

11,630
bitwarden-crd-operatorlerentisVerified publisher0.18.01 of 1See more

bitwarden-crd-operator lerentis 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/lerentis/bitwarden-crd-operator:0.17.00a608c6ead85
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

2,004
lightsteplightstepsatellite1.2.41 of 1See more

lightstep lightstepsatellite 1.2.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
lightstep/collector:2021-01-26_23-02-36Z11c5569aaf3b
python3.5@3.5.2-2ubuntu0~16.04.5
no fix listed

Open the chart page →

15,345
memgraph-high-availabilitymemgraphVerified publisher1.4.11 of 2See more

memgraph-high-availability memgraph 1.4.1

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
memgraph/memgraph:3.13.1bd3fe13228f4
python3.12@3.12.3-1ubuntu0.17
no fix listed

Open the chart page →

1,208
openclaw-with-brainopenclaw-with-brainVerified publisher0.1.671 of 3See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
python3.11@3.11.2-6+deb12u7
no fix listed

Open the chart page →

5,224
oesopsmxVerified publisher4.0.327 of 25See more

oes opsmx 4.0.32

7 of the 25 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/rabbitmq:4.2-management3408107e5cc4
python3.12@3.12.3-1ubuntu0.9
no fix listed
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
python3@3.6.8-71.el8_10
0:3.6.8-78.el8_10
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
python3@3.6.8-71.el8_10
0:3.6.8-78.el8_10
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
python3@3.6.8-71.el8_10
0:3.6.8-78.el8_10
quay.io/opsmxpublic/ubi8-oes-db:v3.0.089ee6493af89
python3@3.6.8-38.el8_4
0:3.6.8-78.el8_10
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
python3@3.6.8-71.el8_10
0:3.6.8-78.el8_10
quay.io/opsmxpublic/ubi8-oes-ui:isd-spin-2025.10.01-e6f6f01-2025121006405d934bb66884
python3@3.6.8-71.el8_10
0:3.6.8-78.el8_10

Open the chart page →

107,899
platzioplatz-ioVerified publisher0.6.51 of 2See more

platzio platz-io 0.6.5

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
platzio/backend:v0.6.5d5e5972f344b
python3@3.12.11-r0
3.12.14-r0

Open the chart page →

2,867
ipmi-exporterpnnl-miscscripts0.1.151 of 1See more

ipmi-exporter pnnl-miscscripts 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
pnnlmiscscripts/ipmi-exporter:1.2.0-181e18992d8e3
python3@3.6.8-56.el8_9.rocky.0
0:3.6.8-78.el8_10.rocky.0

Open the chart page →

2,994
repoflowrepoflow-helm-public0.9.11 of 8See more

repoflow repoflow-helm-public 0.9.1

1 of the 8 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
hasura/graphql-engine:v2.48.10f6c1c4b957d2
python3.10@3.10.12-1~22.04.11
no fix listed

Open the chart page →

13,615
nominatimrobjuz6.4.11 of 4See more

nominatim robjuz 6.4.1

1 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
mediagis/nominatim:5.3.27923a8e67197
python3.12@3.12.3-1ubuntu0.13
no fix listed

Open the chart page →

8,760
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
python3.8@3.8.10-0ubuntu1~20.04
no fix listed

Open the chart page →

24,549
plausiblesinextraVerified publisher1.1.21 of 1See more

plausible sinextra 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/plausible/community-edition:v3.2.133e60bfb40f2
python3@3.12.13-r0
3.12.14-r0

Open the chart page →

859
freeradiusstartechnicaVerified publisher1.2.01 of 1See more

freeradius startechnica 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
freeradius/freeradius-server:3.2.8af6fd34a5b78
python2.7@2.7.18-13ubuntu1.5
python3.10@3.10.12-1~22.04.10
no fix listed
no fix listed

Open the chart page →

5,814
sn-platformstreamnative1.11.441 of 9See more

sn-platform streamnative 1.11.44

1 of the 9 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed

Open the chart page →

15,525
pretixtechwolf12Verified publisher2026.7.01 of 3See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
pretix/standalone:2026.7.05df3b7aa852e
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

9,825
vaultvaultVerified publisher1.22.01 of 4See more

vault vault 1.22.0

1 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
alpine/k8s:1.35.5d870622d0040
python3@3.14.3-r0
3.14.7-r0

Open the chart page →

4,243
minio-operatorwenerme4.3.71 of 2See more

minio-operator wenerme 4.3.7

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
minio/operator:v4.3.754393e03f3b2
python3@3.6.8-41.el8
0:3.6.8-78.el8_10

Open the chart page →

6,085
wgerwgerOfficialVerified publisher1.0.01 of 8See more

wger wger 1.0.0

1 of the 8 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
wger/server:2.6997ead43aabd
python3.12@3.12.3-1ubuntu0.13
no fix listed

Open the chart page →

8,587
paperless-ngxadnoctemVerified publisher0.4.21 of 5See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.36.087c16b9f3642
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

19,769
github-actions-runneradwerx0.10.31 of 1See more

github-actions-runner adwerx 0.10.3

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
adwerx/github-actions-runner:2.276.1-20.04-1840d2b078682
python3.8@3.8.5-1~20.04
no fix listed

Open the chart page →

13,683
agentareaagentareaVerified publisher0.0.181 of 16See more

agentarea agentarea 0.0.18

1 of the 16 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
agentarea/agentarea-mcp-runner:latestd3c209a5d531
python3.11@3.11.2-6+deb12u8
no fix listed

Open the chart page →

14,960
akeyless-api-gatewayakeyless-services-helmVerified publisher1.62.221 of 1See more

akeyless-api-gateway akeyless-services-helm 1.62.22

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
akeyless/base:latest759e4289fae8
python3.12@3.12.3-1ubuntu0.13
no fix listed

Open the chart page →

2,406
clearml-agentallegroaiVerified publisher5.3.31 of 1See more

clearml-agent allegroai 5.3.3

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
allegroai/clearml-agent-k8s-base:1.24-21772827a01bb5
python3.6@3.6.9-1~18.04ubuntu1.7
no fix listed

Open the chart page →

12,061
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

5,918
upcloud-csiankra-chartsVerified publisher0.4.01 of 8See more

upcloud-csi ankra-charts 0.4.0

1 of the 8 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
alpine/k8s:1.31.137a319b15cfc9
python3@3.12.11-r0
3.12.14-r0

Open the chart page →

14,920
antreaantreaVerified publisher2.7.01 of 2See more

antrea antrea 2.7.0

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
antrea/antrea-agent-ubuntu:v2.7.0c10bc45c6272
python3.12@3.12.3-1ubuntu0.15
no fix listed

Open the chart page →

3,514
apache-rangerapache-ranger0.1.01 of 2See more

apache-ranger apache-ranger 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
apache/ranger:2.7.076c176e8a0e4
python3.10@3.10.12-1~22.04.10
no fix listed

Open the chart page →

7,790
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-cas:latest6a107f224c34
python2.7@2.7.18-1~20.04.3
no fix listed

Open the chart page →

17,946
dltbrokerassist-iot-distributed-broker0.2.02 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

2 of the 9 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
hyperledger/fabric-ca-tools:latest4ce6f43ded2e
python2.7@2.7.12-1ubuntu0~16.04.3
python3.5@3.5.2-2ubuntu0~16.04.4
no fix listed
no fix listed
hyperledger/fabric-couchdb:0.4.15f6c724592abf
python2.7@2.7.12-1ubuntu0~16.04.4
python3.5@3.5.2-2ubuntu0~16.04.5
no fix listed
no fix listed

Open the chart page →

77,821
dltloggingassist-iot-logging-auditing0.2.02 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

2 of the 9 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
hyperledger/fabric-ca-tools:latest4ce6f43ded2e
python2.7@2.7.12-1ubuntu0~16.04.3
python3.5@3.5.2-2ubuntu0~16.04.4
no fix listed
no fix listed
hyperledger/fabric-couchdb:0.4.15f6c724592abf
python2.7@2.7.12-1ubuntu0~16.04.4
python3.5@3.5.2-2ubuntu0~16.04.5
no fix listed
no fix listed

Open the chart page →

77,802
music-assistantbdclark-helm-chartsVerified publisher0.4.131 of 1See more

music-assistant bdclark-helm-charts 0.4.13

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.3885872224fa5
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

3,617
open-elevationbeeinventor0.1.01 of 2See more

open-elevation beeinventor 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
openelevation/open-elevation:latest82fb21612e86
python3.8@3.8.10-0ubuntu1~20.04
no fix listed

Open the chart page →

13,199
aramid-indexerbiatec-repoVerified publisher3.9.03 of 5See more

aramid-indexer biatec-repo 3.9.0

3 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
scholtz2/aramid-algo-follow-node:v4.3.0-stable1ec63eca86b6
python3.12@3.12.3-1ubuntu0.8
no fix listed
scholtz2/aramid-conduit:v1.9.0-stable3a3b3d3277d2
python3.14@3.14.4-1
no fix listed
scholtz2/aramid-indexer:v3.9.0-stable6770214bc881
python3.14@3.14.4-1
no fix listed

Open the chart page →

13,513
aramid-participationbiatec-repoVerified publisher4.4.11 of 1See more

aramid-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-aramidmain-extended:4.4.1-stablef12ce1cfb72e
python3.10@3.10.12-1~22.04.6
no fix listed

Open the chart page →

7,239
aramid-relaybiatec-repoVerified publisher4.4.11 of 1See more

aramid-relay biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
scholtz2/aramid-algo-node:v4.4.1-stable70263d8fab5b
python3.12@3.12.3-1ubuntu0.8
no fix listed

Open the chart page →

5,108
voimain-participationbiatec-repoVerified publisher4.4.11 of 1See more

voimain-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-voimain-extended:4.4.1-stable64966de56d9f
python3.10@3.10.12-1~22.04.6
no fix listed

Open the chart page →

7,239
self-hostbitwarden2.4.01 of 11See more

self-host bitwarden 2.4.0

1 of the 11 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
mcr.microsoft.com/mssql/server:2025-CU5-ubuntu-24.04cee0f4db03b5
python3.12@3.12.3-1ubuntu0.13
no fix listed

Open the chart page →

5,238
easyhaproxybyjgVerified publisher2.0.41 of 1See more

easyhaproxy byjg 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
byjg/easy-haproxy:6.1.1230fdb7b00ae
python3@3.14.5-r0
3.14.7-r0

Open the chart page →

933
nacosbytectl0.1.61 of 1See more

nacos bytectl 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
python3.14@3.14.4-1ubuntu0.1
no fix listed

Open the chart page →

1,820
tensorflow-notebookcloudnativeapp0.1.21 of 1See more

tensorflow-notebook cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
tensorflow/tensorflow:1.6.0-devel1e3172090703
python2.7@2.7.12-1ubuntu0~16.04.3
python3.5@3.5.2-2ubuntu0~16.04.4
no fix listed
no fix listed

Open the chart page →

36,132
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
python3.13@3.13.5-2
3.13.5-2+deb13u5

Open the chart page →

11,236
cp-schema-registrycp-schema-registryVerified publisher1.0.01 of 1See more

cp-schema-registry cp-schema-registry 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/cp-schema-registry:8.1.1-msk-iam-auth2.3.530d1a445acc7
python3.9@3.9.23-2.el9
0:3.9.25-7.el9_8.3

Open the chart page →

1,883

Container images carrying it

919 by charts deploying them

A fixed version is listed for 9 of the 18 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
python-3.14@3.14.2-r2
3.14.6-r3
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
python3.9@3.9.18-3.el9
0:3.9.25-7.el9_8.3
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
python3.9@3.9.16-1.el9_2.1
0:3.9.25-7.el9_8.3
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
python3@3.6.8-37.el8
0:3.6.8-78.el8_10
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
python3@3.6.8-67.el8_10
0:3.6.8-78.el8_10
1
quay.io/sshaaf/keycloak-mcp-server:0.4.0b7e9cba72f8a
python3.9@3.9.19-8.el9_5.1
0:3.9.25-7.el9_8.3
1
quay.io/strimzi/operator:0.45.158c727cd2e68
python3.9@3.9.21-2.el9_6.2
0:3.9.25-7.el9_8.3
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
python3@3.6.8-48.el8_7.1
0:3.6.8-78.el8_10
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
python3.11@3.11.2-6
no fix listed
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
python3.12@3.12.3-1ubuntu0.15
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
python3.11@3.11.2-6+deb12u7
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb:4.4.5cf72810d33f5
python3@3.6.8-37.el8
0:3.6.8-78.el8_10
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
python3.8@3.8.5-1~20.04.2
no fix listed
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
python3.9@3.9.25-3.el9_7.2
0:3.9.25-7.el9_8.3
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
python3@3.12.13-r0
3.12.14-r0
1
registry.gitlab.com/xrow-public/velero-client/velero-client:1.4.203015f863a3e
python3.12@3.12.13-2.el10_2.1
0:3.12.14-1.el10_2
1
registry.k8s.io/sig-storage/nfsplugin:v4.13.41eb5a85180a4
python3.11@3.11.2-6+deb12u7
no fix listed
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
python3.11@3.11.2-6+deb12u5
no fix listed
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.