StackRadar

CVE-2026-11940

High

Advisory

Published 23 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.007
53rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
887
of 17,781 indexed, latest versions
Container images
918
deployed by those charts
Fix available
9 of 18
affected packages

tarfile extraction filter bypass allows escaping the destination directory

Carried by container images the latest versions of 887 of 17,781 indexed charts deploy, on 918 images.

Affected packageAffected versionsFixed inImages
python3.11deb3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 moreno fix listed181
python3.8deb3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 moreno fix listed100
python3.12deb3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+11 moreno fix listed89
python3.10deb3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 moreno fix listed80
python3apk3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more3.12.14-r0, 3.14.7-r075
python3.13deb3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4, 3.13.7-1ubuntu0.13.13.5-2+deb13u574
python2.7deb2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 moreno fix listed54
python3.6deb3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 moreno fix listed44
python3.5deb3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9no fix listed25
python3.14deb3.14.4-1, 3.14.4-1ubuntu0.1, 3.14.4-1ubuntu0.2no fix listed9
python3.4deb3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7no fix listed7
python-3.14apk3.14.2-r2, 3.14.4-r2, 3.14.6-r03.14.6-r36
pythonbitnami3.11.11-0, 3.12.8-0, 3.13.5-13.10.213
python-3.13apk3.13.7-r0, 3.13.10-r0, 3.13.12-r23.13.14-r23
python-3.12apk3.12.0-r1, 3.12.9-r13.12.13-r102
python3rpm3.6.8-15.1.el8, 3.6.8-23.el8, 3.6.8-24.el8_2, 3.6.8-24.el8_2.2+27 more0:3.6.8-78.el8_10, 0:3.6.8-78.el8_10.rocky.0135
python3.9rpm3.9.16-1.el9, 3.9.16-1.el9_2.1, 3.9.16-1.el9_2.2, 3.9.18-1.el9_3.1+16 more0:3.9.25-7.el9_8.361
python3.12rpm3.12.5-2.el9_5.2, 3.12.13-2.el10_2.1, 3.12.13-3.el8_10, 3.12.13-3.el9_8.10:3.12.14-1.el8_10, 0:3.12.14-1.el9_8, 0:3.12.14-1.el10_26
OSV records
ALPINE-CVE-2026-11940BIT-python-2026-11940CGA-2877-fmjf-8j5qCGA-cr9q-h4v8-hfgpCGA-qmm2-954x-xmxrDEBIAN-CVE-2026-11940RHSA-2026:54268RHSA-2026:56219RHSA-2026:58902RHSA-2026:58971RHSA-2026:59009RLSA-2026:54268RLSA-2026:56219RLSA-2026:58902UBUNTU-CVE-2026-11940
Also known as
BIT-libpython-2026-11940, BIT-python-min-2026-11940, CGA-5363-9r7r-rr55, CGA-p86c-g5pg-rvpw, CGA-w3m6-c9vj-wm85, PSF-2026-30, RHSA-2026:64806, RHSA-2026:64816

Charts affected

887 by stars
ChartLatestAffected imagesRadar Score
grrosdfir-infrastructureVerified publisher1.0.31 of 5See more

grr osdfir-infrastructure 1.0.3

1 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/google/fleetspeak:v0.1.17cd264d33efd4
python3.11@3.11.2-6+deb12u2
no fix listed

Open the chart page →

10,896
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.09 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

9 of the 40 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/google/fleetspeak:v0.1.17cd264d33efd4
python3.11@3.11.2-6+deb12u2
no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
python3.12@3.12.3-1ubuntu0.15
no fix listed
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
python3.12@3.12.3-1ubuntu0.15
no fix listed

Open the chart page →

71,208
radiusp2p-avs0.1.01 of 1See more

radius p2p-avs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
theradius/loggia:0.463ba348546ec
python3.11@3.11.2-6
no fix listed

Open the chart page →

12,350
ungatep2p-avs0.1.02 of 3See more

ungate p2p-avs 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
python3.11@3.11.2-6+deb12u2
no fix listed
xom4ekp2p/infini-route-attestators-public-mainnet-avs-webapi:latest2745b5fd8785
python3.11@3.11.2-6+deb12u2
no fix listed

Open the chart page →

27,373
p4p40.1.02 of 7See more

p4 p4 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
library/rabbitmq:3.11-managementc3f70098e01d
python3.10@3.10.12-1~22.04.3
no fix listed
mastercloudapps/server:v2.23f3d24dfe2686
python3@3.6.8-48.el8_7
0:3.6.8-78.el8_10

Open the chart page →

27,537
minecraftpaul1365972-mc3.0.11 of 1See more

minecraft paul1365972-mc 3.0.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
itzg/minecraft-server:latest8672e335dbef
python3.12@3.12.3-1ubuntu0.16
no fix listed

Open the chart page →

4,253
pet-battle-infrapetbattle1.0.321 of 2See more

pet-battle-infra petbattle 1.0.32

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.8bb5e052770e5
python3@3.6.8-39.el8_4.1
0:3.6.8-78.el8_10

Open the chart page →

15,466
pet-battle-tournamentpetbattle1.0.401 of 3See more

pet-battle-tournament petbattle 1.0.40

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.8bb5e052770e5
python3@3.6.8-39.el8_4.1
0:3.6.8-78.el8_10

Open the chart page →

15,466
redis-stack-awsphamxuanduong0.1.01 of 1See more

redis-stack-aws phamxuanduong 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
redis/redis-stack-server:7.4.0-v0887cf87cc744
python3.10@3.10.12-1~22.04.4
no fix listed

Open the chart page →

3,229
dummy-servicephanVerified publisher0.3.41 of 1See more

dummy-service phan 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
phan2410/dummy-service:0.0.89c6ed6de26ca
python3.11@3.11.2-6+deb12u5
no fix listed

Open the chart page →

5,706
falcon-asgi-serverphanVerified publisher0.1.01 of 1See more

falcon-asgi-server phan 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
phan2410/falcon-asgi-server:0.1.04a86d138832d
python3.11@3.11.2-6+deb12u5
no fix listed

Open the chart page →

8,189
phronetisphronetis0.1.272 of 2See more

phronetis phronetis 0.1.27

2 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
python3.12@3.12.3-1ubuntu0.5
no fix listed
knspar/phronetis-operator:0.1.60c4f0543ee58
python3.11@3.11.2-6
no fix listed

Open the chart page →

16,196
seafilephybros-helm-charts4.0.11 of 1See more

seafile phybros-helm-charts 4.0.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.97ac833196f60
python3.8@3.8.10-0ubuntu1~20.04.5
no fix listed

Open the chart page →

22,084
piepieVerified publisher0.11.11 of 1See more

pie pie 0.11.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/topolvm/pie:0.18.0aa467443e407
python3.10@3.10.12-1~22.04.17
no fix listed

Open the chart page →

2,100
firehose-ethereumpinaxVerified publisher0.3.21 of 2See more

firehose-ethereum pinax 0.3.2

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/firehose-ethereum:v2.12.4-gethd7bdfa7b41da
python3.12@3.12.3-1ubuntu0.7
no fix listed

Open the chart page →

7,062
subgraph-oraclepinaxVerified publisher0.0.11 of 1See more

subgraph-oracle pinax 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/graphprotocol/availability-oracle:sha-28312fd472a25038957
python3.11@3.11.2-6+deb12u2
no fix listed

Open the chart page →

11,347
substreams-sink-kvpinaxVerified publisher0.0.41 of 1See more

substreams-sink-kv pinax 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/substreams-sink-kv:v2.3.026953ec68d5d
python3.8@3.8.10-0ubuntu1~20.04.13
no fix listed

Open the chart page →

6,641
substreams-sink-nooppinaxVerified publisher0.0.31 of 1See more

substreams-sink-noop pinax 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/substreams-sink-noop:v1.4.0d7c43c3135c6
python3.8@3.8.10-0ubuntu1~20.04.13
no fix listed

Open the chart page →

6,587
substreams-tier-2pinaxVerified publisher0.0.81 of 1See more

substreams-tier-2 pinax 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/firehose-ethereum:v2.12.489969b78fb07
python3.12@3.12.3-1ubuntu0.7
no fix listed

Open the chart page →

4,889
pingdom-operatorpingdom-operator0.0.201 of 1See more

pingdom-operator pingdom-operator 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
python3.11@3.11.2-6+deb12u2
no fix listed

Open the chart page →

11,923
planectlplanectlVerified publisher0.7.01 of 10See more

planectl planectl 0.7.0

1 of the 10 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
library/node:208f693eaa7e0a
python3.11@3.11.2-6+deb12u6
no fix listed

Open the chart page →

25,934
gitlab-runner-operatorpnnl-miscscripts0.1.61 of 1See more

gitlab-runner-operator pnnl-miscscripts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
python3@3.6.8-15.1.el8
0:3.6.8-78.el8_10

Open the chart page →

11,151
tenant-namespace-operatorpnnl-miscscripts0.1.281 of 1See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10

Open the chart page →

12,754
pod-birdspod-birds0.1.01 of 1See more

pod-birds pod-birds 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
teknas09/bird-pod:latest12a1fa85c4aa
python3.11@3.11.2-6
no fix listed

Open the chart page →

12,912
Practica_4_helmpr04helm0.1.02 of 7See more

Practica_4_helm pr04helm 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
codeurjc/server:v1.0310bea5b1ee7
python3@3.6.8-48.el8_7
0:3.6.8-78.el8_10
library/rabbitmq:3.9-management8a279e9396a8
python3.10@3.10.12-1~22.04.3
no fix listed

Open the chart page →

27,558
practica-helmpractica-helm0.1.01 of 7See more

practica-helm practica-helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
library/rabbitmq:3-management-alpine606d8c0d6b3c
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

28,484
priceapp-chartpriceapp0.1.01 of 1See more

priceapp-chart priceapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ildarmukhametzyanov/priceapp:0.115d23720a3ee
python3.11@3.11.2-6
no fix listed

Open the chart page →

8,169
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

2,751
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

3,270
powerdnspuckpuck2.0.01 of 4See more

powerdns puckpuck 2.0.0

1 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
pschiffe/pdns-admin:0.4.137ebba8c2b8f
python3.9@3.9.25-7.el9_8.2
0:3.9.25-7.el9_8.3

Open the chart page →

4,616
game-serverpvillaverdeVerified publisher1.0.51 of 1See more

game-server pvillaverde 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/itzg/minecraft-server:latestc1a267d9ed6d
python3.12@3.12.3-1ubuntu0.16
no fix listed

Open the chart page →

4,253
pyredispyredis-helm0.1.01 of 2See more

pyredis pyredis-helm 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
avinash263/pyredis263:latestaa2b8727f1a6
python3.11@3.11.2-6
no fix listed

Open the chart page →

14,537
mychartpythonweb0.1.01 of 1See more

mychart pythonweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
qichenxu4pd/pythonexample:1.0f3a8502bc21b
python3.11@3.11.2-6
no fix listed

Open the chart page →

12,566
mypythonpythonweb0.1.01 of 1See more

mypython pythonweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
qichenxu4pd/pythonexample:1.0f3a8502bc21b
python3.11@3.11.2-6
no fix listed

Open the chart page →

12,566
cupsr2dlan-helm-chartsVerified publisher0.1.01 of 1See more

cups r2dlan-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
anujdatar/cups:25.07.01685df04a643b
python3.11@3.11.2-6+deb12u6
no fix listed

Open the chart page →

7,685
rada-platformrada-platform0.1.03 of 7See more

rada-platform rada-platform 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
python3.11@3.11.2-6+deb12u3
no fix listed
trinodb/trino:45038c6f24ab1a4
python3.9@3.9.18-3.el9
0:3.9.25-7.el9_8.3
ghcr.io/projectnessie/nessie:0.92.19efe3c74d55f
python3.9@3.9.18-3.el9_4.1
0:3.9.25-7.el9_8.3

Open the chart page →

21,211
kubecostradar-baseVerified publisher1.0.01 of 7See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.22a461dc5cb96a
python3.9@3.9.21-1.el9_5
0:3.9.25-7.el9_8.3

Open the chart page →

9,355
radar-cp-ksql-serverradar-baseVerified publisher0.0.21 of 2See more

radar-cp-ksql-server radar-base 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
python3@3.6.8-56.el8_9.3
0:3.6.8-78.el8_10

Open the chart page →

5,269
radar-kafkaradar-baseVerified publisher0.4.11 of 2See more

radar-kafka radar-base 0.4.1

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
python3.9@3.9.21-1.el9_5
0:3.9.25-7.el9_8.3

Open the chart page →

4,219
strimzi-kafka-operatorradar-baseVerified publisher0.46.01 of 1See more

strimzi-kafka-operator radar-base 0.46.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
python3.9@3.9.21-1.el9_5
0:3.9.25-7.el9_8.3

Open the chart page →

1,951
rawfile-localpvrawfile0.15.21 of 6See more

rawfile-localpv rawfile 0.15.2

1 of the 6 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
openebs/rawfile-localpv:v0.15.2a39ef27ea28b
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

2,769
javareact-java0.1.01 of 1See more

java react-java 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
project2team4/react:latest3ff031a08887
python3.8@3.8.10-0ubuntu1~20.04.4
no fix listed

Open the chart page →

15,520
ibm-mongodb-enterprise-helmredhat0.3.01 of 1See more

ibm-mongodb-enterprise-helm redhat 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ibmcom/ibm-enterprise-mongodb-ppc64le:4.4d28bf361327a
python3@3.6.8-31.el8
0:3.6.8-78.el8_10

Open the chart page →

12,248
ansible-automation-platformredhat-cop0.0.91 of 1See more

ansible-automation-platform redhat-cop 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.7464a3af4dfe0
python3@3.6.8-39.el8_4.1
0:3.6.8-78.el8_10

Open the chart page →

15,291
argocd-operatorredhat-cop1.2.21 of 1See more

argocd-operator redhat-cop 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.7464a3af4dfe0
python3@3.6.8-39.el8_4.1
0:3.6.8-78.el8_10

Open the chart page →

15,291
ploigosredhat-cop0.0.91 of 2See more

ploigos redhat-cop 0.0.9

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.66722d5041b47
python3@3.6.8-24.el8_2
0:3.6.8-78.el8_10

Open the chart page →

11,437
sonatype-nexusredhat-cop1.1.131 of 2See more

sonatype-nexus redhat-cop 1.1.13

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/openshift/origin-jenkins-agent-base:latestc241c971aef8
python3@3.6.8-47.el8_6.4
0:3.6.8-78.el8_10

Open the chart page →

16,047
stackrox-chartredhat-cop0.0.101 of 1See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
python3@3.6.8-37.el8
0:3.6.8-78.el8_10

Open the chart page →

29,227
redminerestic-pvc-backupVerified publisher0.2.61 of 1See more

redmine restic-pvc-backup 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

4,240
esphomeretsamedocVerified publisher2026.2.51 of 1See more

esphome retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
esphome/esphome:2024.3.09ab8cc88b28c
python3.11@3.11.2-6
no fix listed

Open the chart page →

7,431

Container images carrying it

918 by charts deploying them

A fixed version is listed for 9 of the 18 affected packages.

Container imageDigestPackageFixed inUsed by
moreillon/user-manager:v5.0.2e1c9bfab5c16
python3.11@3.11.2-6
no fix listed
2
nacos/nacos-server:latest1c191c30c8cd
python3.14@3.14.4-1ubuntu0.1
no fix listed
2
nutanix/nai-jobs:v2.8.09c373718e1b1
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
2
obolnetwork/charon:v1.10.0278c7e2897b6
python3.13@3.13.5-2
3.13.5-2+deb13u5
2
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
python2.7@2.7.12-1ubuntu0~16.04.4
python3.5@3.5.2-2ubuntu0~16.04.5
no fix listed
no fix listed
2
opendatacube/ows:latest668cbb41473c
python3.12@3.12.3-1ubuntu0.3
no fix listed
2
qichenxu4pd/pythonexample:1.0f3a8502bc21b
python3.11@3.11.2-6
no fix listed
2
redis/redis-stack:7.2.0-v91c5f43fddcdd
python3.10@3.10.12-1~22.04.3
no fix listed
2
redis/redis-stack-server:7.4.0:7.4.0-v172035434f455
python3.10@3.10.12-1~22.04.6
no fix listed
2
redis/redis-stack-server:7.2.0-v10e44b2b49d059
python3.10@3.10.12-1~22.04.3
no fix listed
2
smartedge/generic-multi-access-network-virtualization:1.04cd63c22ce36
python3.8@3.8.10-0ubuntu1~20.04.5
no fix listed
2
stakater/stakater-nordmart-review:1.0.35954d2be66e95
python3@3.6.8-45.el8
0:3.6.8-78.el8_10
2
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed
2
svtechnmaa/svtech_debuger:v1.0.0b2987abe57d3
python3.10@3.10.4-3
no fix listed
2
tzahi12345/youtubedl-material:4.3.2:latest2f943d584711
python3.10@3.10.6-1~22.04.2ubuntu1
no fix listed
2
uffizzi/controller:latest0344805f267b
python3.11@3.11.2-6
no fix listed
2
vdiogov/glpi-conteiner:latest6945f84f0058
python3.11@3.11.2-6+deb12u2
no fix listed
2
wurstmeister/zookeeper:latest7a7fd44a7210
python2.7@2.7.6-8
python3.4@3.4.0-2ubuntu1
no fix listed
no fix listed
2
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
python3.12@3.12.3-1ubuntu0.17
no fix listed
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
python3.12@3.12.3-1ubuntu0.5
no fix listed
2
ghcr.io/codingducksrl/laravel:8.15be52524664c
python2.7@2.7.18-13ubuntu1.1
python3.10@3.10.6-1~22.04
no fix listed
no fix listed
2
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
python3.8@3.8.10-0ubuntu1~20.04
no fix listed
2
ghcr.io/google/fleetspeak:v0.1.17cd264d33efd4
python3.11@3.11.2-6+deb12u2
no fix listed
2
ghcr.io/linuxserver/openvpn-as:version-2.8.6-916f8e7d-ubuntu184ee0764310e7
python2.7@2.7.17-1~18.04ubuntu1.2
no fix listed
2
ghcr.io/plausible/community-edition:v3.2.133e60bfb40f2
python3@3.12.13-r0
3.12.14-r0
2
ghcr.io/smarter-project/hydra/isolated-vm:main4457b79b24cd
python3.11@3.11.2-6+deb12u6
no fix listed
2
ghcr.io/xeor/karb:1.0.6:main647a3c938d31
python-3.14@3.14.6-r0
3.14.6-r3
2
mcr.microsoft.com/azure-sql-edge:latest902628a8be89
python3.8@3.8.10-0ubuntu1~20.04.8
no fix listed
2
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
python3.9@3.9.23-2.el9
0:3.9.25-7.el9_8.3
2
quay.io/argoprojlabs/argocd-image-updater:v1.3.0cb009167015c
python3@3.14.5-r0
3.14.7-r0
2
quay.io/frrouting/frr:10.4.38745af1f9bbb
python3@3.12.12-r0
3.12.14-r0
2
quay.io/keycloak/keycloak:20.0054ef67eb7da
python3@3.6.8-48.el8_7
0:3.6.8-78.el8_10
2
quay.io/keycloak/keycloak:17.0.1-legacy68f9f38c8f30
python3@3.6.8-41.el8
0:3.6.8-78.el8_10
2
quay.io/openshift/origin-cli:4.7464a3af4dfe0
python3@3.6.8-39.el8_4.1
0:3.6.8-78.el8_10
2
quay.io/openshift/origin-cli:4.8bb5e052770e5
python3@3.6.8-39.el8_4.1
0:3.6.8-78.el8_10
2
quay.io/strimzi/drain-cleaner:1.6.15fb28e9f30d0
python3.9@3.9.25-7.el9_8
0:3.9.25-7.el9_8.3
2
quay.io/strimzi/operator:0.39.002f6f143fc6d
python3@3.6.8-56.el8_9.3
0:3.6.8-78.el8_10
2
quay.io/strimzi/operator:0.46.0ac434a48ac2b
python3.9@3.9.21-1.el9_5
0:3.9.25-7.el9_8.3
2
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
python3@3.12.12-r0
3.12.14-r0
2
registry.k8s.io/sig-storage/smbplugin:v1.20.3dc7746bb081e
python3.11@3.11.2-6+deb12u7
no fix listed
2
a10networks/acos-prometheus-exporter:latest8dc58d434d71
python3.6@3.6.9-1~18.04ubuntu1
no fix listed
1
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
python3.13@3.13.5-2+deb13u2
3.13.5-2+deb13u5
1
aboogie/login_test_backend:new9c41a4483ac8
python3.11@3.11.2-6+deb12u2
no fix listed
1
adwerx/github-actions-runner:2.276.1-20.04-1840d2b078682
python3.8@3.8.5-1~20.04
no fix listed
1
aerospike/aerospike-graph-service:3.3.0f35739b97a46
python3@3.14.5-r0
3.14.7-r0
1
agentarea/agentarea-mcp-runner:latestd3c209a5d531
python3.11@3.11.2-6+deb12u8
no fix listed
1
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
python3.8@3.8.5-1~20.04.3
no fix listed
1
akeyless/base:latest759e4289fae8
python3.12@3.12.3-1ubuntu0.13
no fix listed
1
akeyless/base-rhel:0.0.14ba8900a0061
python3@3.6.8-56.el8_9.3
0:3.6.8-78.el8_10
1
akeyless/gateway:5.3.13d2e7dce5eb9
python3.12@3.12.3-1ubuntu0.16
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.