StackRadar

CVE-2026-11940

High

Advisory

Published 23 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.007
53rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
887
of 17,781 indexed, latest versions
Container images
918
deployed by those charts
Fix available
9 of 18
affected packages

tarfile extraction filter bypass allows escaping the destination directory

Carried by container images the latest versions of 887 of 17,781 indexed charts deploy, on 918 images.

Affected packageAffected versionsFixed inImages
python3.11deb3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 moreno fix listed181
python3.8deb3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 moreno fix listed100
python3.12deb3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+11 moreno fix listed89
python3.10deb3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 moreno fix listed80
python3apk3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more3.12.14-r0, 3.14.7-r075
python3.13deb3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4, 3.13.7-1ubuntu0.13.13.5-2+deb13u574
python2.7deb2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 moreno fix listed54
python3.6deb3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 moreno fix listed44
python3.5deb3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9no fix listed25
python3.14deb3.14.4-1, 3.14.4-1ubuntu0.1, 3.14.4-1ubuntu0.2no fix listed9
python3.4deb3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7no fix listed7
python-3.14apk3.14.2-r2, 3.14.4-r2, 3.14.6-r03.14.6-r36
pythonbitnami3.11.11-0, 3.12.8-0, 3.13.5-13.10.213
python-3.13apk3.13.7-r0, 3.13.10-r0, 3.13.12-r23.13.14-r23
python-3.12apk3.12.0-r1, 3.12.9-r13.12.13-r102
python3rpm3.6.8-15.1.el8, 3.6.8-23.el8, 3.6.8-24.el8_2, 3.6.8-24.el8_2.2+27 more0:3.6.8-78.el8_10, 0:3.6.8-78.el8_10.rocky.0135
python3.9rpm3.9.16-1.el9, 3.9.16-1.el9_2.1, 3.9.16-1.el9_2.2, 3.9.18-1.el9_3.1+16 more0:3.9.25-7.el9_8.361
python3.12rpm3.12.5-2.el9_5.2, 3.12.13-2.el10_2.1, 3.12.13-3.el8_10, 3.12.13-3.el9_8.10:3.12.14-1.el8_10, 0:3.12.14-1.el9_8, 0:3.12.14-1.el10_26
OSV records
ALPINE-CVE-2026-11940BIT-python-2026-11940CGA-2877-fmjf-8j5qCGA-cr9q-h4v8-hfgpCGA-qmm2-954x-xmxrDEBIAN-CVE-2026-11940RHSA-2026:54268RHSA-2026:56219RHSA-2026:58902RHSA-2026:58971RHSA-2026:59009RLSA-2026:54268RLSA-2026:56219RLSA-2026:58902UBUNTU-CVE-2026-11940
Also known as
BIT-libpython-2026-11940, BIT-python-min-2026-11940, CGA-5363-9r7r-rr55, CGA-p86c-g5pg-rvpw, CGA-w3m6-c9vj-wm85, PSF-2026-30, RHSA-2026:64806, RHSA-2026:64816

Charts affected

887 by stars
ChartLatestAffected imagesRadar Score
signal-cli-rest-apigeek-cookbookVerified publisher1.2.21 of 1See more

signal-cli-rest-api geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
bbernhard/signal-cli-rest-api:0.57549ad08d7e14
python3.8@3.8.10-0ubuntu1~20.04.2
no fix listed

Open the chart page →

10,154
tautulligeek-cookbookVerified publisher11.4.21 of 1See more

tautulli geek-cookbook 11.4.2

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/tautulli:v2.7.74ea617c30397
python3.8@3.8.10-0ubuntu1~20.04.1
no fix listed

Open the chart page →

10,628
nacosgujunxiang0.1.51 of 1See more

nacos gujunxiang 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
python3.14@3.14.4-1ubuntu0.1
no fix listed

Open the chart page →

1,767
headscaleheadscaleVerified publisher1.0.191 of 3See more

headscale headscale 1.0.19

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
alpine/k8s:1.36.244ef4942e171
python3@3.14.5-r1
3.14.7-r0

Open the chart page →

3,383
coreinstill-aiOfficialVerified publisher0.1.754 of 15See more

core instill-ai 0.1.75

4 of the 15 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
instill/artifact-backend:b28766ac4a393e601ed
python3.13@3.13.5-2
3.13.5-2+deb13u5
instill/mgmt-backend:d0933d4ebe12f77a3f9
python3.13@3.13.5-2
3.13.5-2+deb13u5
instill/model-backend:611f0f2e980125e5ba5
python3.13@3.13.5-2
3.13.5-2+deb13u5
temporalio/admin-tools:1.28cfde8170c92f
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

30,816
dayz-dedicated-serverjespernohrVerified publisher0.1.21 of 3See more

dayz-dedicated-server jespernohr 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/jespernohr/dayz-dedicated-server:0.1.1ec01d3ac7887
python3.12@3.12.3-1ubuntu0.2
no fix listed

Open the chart page →

4,309
calibre-webk8s-home-lab-repo9.1.11 of 1See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
python3.12@3.12.3-1ubuntu0.15
no fix listed

Open the chart page →

4,477
kiali-operatorkiali2.31.01 of 1See more

kiali-operator kiali 2.31.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/kiali/kiali-operator:v2.31.0f837d8f25545
python3.12@3.12.13-3.el9_8.1
0:3.12.14-1.el9_8

Open the chart page →

1,157
kubearmorkubearmor1.7.42 of 4See more

kubearmor kubearmor 1.7.4

2 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
kubearmor/kubearmor:stablea08141311045
python3@3.12.13-r0
3.12.14-r0
kubearmor/kubearmor-init:stable236ade6e67b1
python3@3.12.13-r0
3.12.14-r0

Open the chart page →

1,355
kubeservice-lxcfs-webhookkubservice-chartsVerified publisher1.6.01 of 6See more

kubeservice-lxcfs-webhook kubservice-charts 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
dongjiang1989/lxcfs:v6.0.34bf9ae391948
python3.8@3.8.10-0ubuntu1~20.04.18
no fix listed

Open the chart page →

11,582
bitwarden-crd-operatorlerentisVerified publisher0.18.01 of 1See more

bitwarden-crd-operator lerentis 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/lerentis/bitwarden-crd-operator:0.17.00a608c6ead85
python3@3.12.12-r0
3.12.14-r0

Open the chart page →

2,003
lightsteplightstepsatellite1.2.41 of 1See more

lightstep lightstepsatellite 1.2.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
lightstep/collector:2021-01-26_23-02-36Z11c5569aaf3b
python3.5@3.5.2-2ubuntu0~16.04.5
no fix listed

Open the chart page →

15,330
memgraph-high-availabilitymemgraphVerified publisher1.4.01 of 2See more

memgraph-high-availability memgraph 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
memgraph/memgraph:3.13.0a1dc375774ed
python3.12@3.12.3-1ubuntu0.16
no fix listed

Open the chart page →

1,373
openclaw-with-brainopenclaw-with-brainVerified publisher0.1.671 of 3See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
python3.11@3.11.2-6+deb12u7
no fix listed

Open the chart page →

5,218
oesopsmxVerified publisher4.0.327 of 25See more

oes opsmx 4.0.32

7 of the 25 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/rabbitmq:4.2-management3408107e5cc4
python3.12@3.12.3-1ubuntu0.9
no fix listed
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
python3@3.6.8-71.el8_10
0:3.6.8-78.el8_10
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
python3@3.6.8-71.el8_10
0:3.6.8-78.el8_10
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
python3@3.6.8-71.el8_10
0:3.6.8-78.el8_10
quay.io/opsmxpublic/ubi8-oes-db:v3.0.089ee6493af89
python3@3.6.8-38.el8_4
0:3.6.8-78.el8_10
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
python3@3.6.8-71.el8_10
0:3.6.8-78.el8_10
quay.io/opsmxpublic/ubi8-oes-ui:isd-spin-2025.10.01-e6f6f01-2025121006405d934bb66884
python3@3.6.8-71.el8_10
0:3.6.8-78.el8_10

Open the chart page →

107,811
platzioplatz-ioVerified publisher0.6.51 of 2See more

platzio platz-io 0.6.5

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
platzio/backend:v0.6.5d5e5972f344b
python3@3.12.11-r0
3.12.14-r0

Open the chart page →

2,866
ipmi-exporterpnnl-miscscripts0.1.151 of 1See more

ipmi-exporter pnnl-miscscripts 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
pnnlmiscscripts/ipmi-exporter:1.2.0-181e18992d8e3
python3@3.6.8-56.el8_9.rocky.0
0:3.6.8-78.el8_10.rocky.0

Open the chart page →

2,995
repoflowrepoflow-helm-public0.9.11 of 8See more

repoflow repoflow-helm-public 0.9.1

1 of the 8 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
hasura/graphql-engine:v2.48.10f6c1c4b957d2
python3.10@3.10.12-1~22.04.11
no fix listed

Open the chart page →

13,521
nominatimrobjuz6.4.11 of 4See more

nominatim robjuz 6.4.1

1 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
mediagis/nominatim:5.3.27923a8e67197
python3.12@3.12.3-1ubuntu0.13
no fix listed

Open the chart page →

8,690
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
python3.8@3.8.10-0ubuntu1~20.04
no fix listed

Open the chart page →

24,488
plausiblesinextraVerified publisher1.1.21 of 1See more

plausible sinextra 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/plausible/community-edition:v3.2.133e60bfb40f2
python3@3.12.13-r0
3.12.14-r0

Open the chart page →

859
freeradiusstartechnicaVerified publisher1.2.01 of 1See more

freeradius startechnica 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
freeradius/freeradius-server:3.2.8af6fd34a5b78
python2.7@2.7.18-13ubuntu1.5
python3.10@3.10.12-1~22.04.10
no fix listed
no fix listed

Open the chart page →

5,751
sn-platformstreamnative1.11.441 of 9See more

sn-platform streamnative 1.11.44

1 of the 9 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
python3.8@3.8.10-0ubuntu1~20.04.9
no fix listed

Open the chart page →

15,477
pretixtechwolf12Verified publisher2026.7.01 of 3See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
pretix/standalone:2026.7.05df3b7aa852e
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

9,770
vaultvaultVerified publisher1.22.01 of 4See more

vault vault 1.22.0

1 of the 4 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
alpine/k8s:1.35.5d870622d0040
python3@3.14.3-r0
3.14.7-r0

Open the chart page →

4,243
minio-operatorwenerme4.3.71 of 2See more

minio-operator wenerme 4.3.7

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
minio/operator:v4.3.754393e03f3b2
python3@3.6.8-41.el8
0:3.6.8-78.el8_10

Open the chart page →

6,085
wgerwgerOfficialVerified publisher1.0.01 of 8See more

wger wger 1.0.0

1 of the 8 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
wger/server:2.6997ead43aabd
python3.12@3.12.3-1ubuntu0.13
no fix listed

Open the chart page →

8,491
paperless-ngxadnoctemVerified publisher0.4.21 of 5See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.36.087c16b9f3642
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

19,691
github-actions-runneradwerx0.10.31 of 1See more

github-actions-runner adwerx 0.10.3

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
adwerx/github-actions-runner:2.276.1-20.04-1840d2b078682
python3.8@3.8.5-1~20.04
no fix listed

Open the chart page →

13,635
agentareaagentareaVerified publisher0.0.181 of 16See more

agentarea agentarea 0.0.18

1 of the 16 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
agentarea/agentarea-mcp-runner:latestd3c209a5d531
python3.11@3.11.2-6+deb12u8
no fix listed

Open the chart page →

14,914
akeyless-api-gatewayakeyless-services-helmVerified publisher1.62.221 of 1See more

akeyless-api-gateway akeyless-services-helm 1.62.22

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
akeyless/base:latest759e4289fae8
python3.12@3.12.3-1ubuntu0.13
no fix listed

Open the chart page →

2,358
clearml-agentallegroaiVerified publisher5.3.31 of 1See more

clearml-agent allegroai 5.3.3

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
allegroai/clearml-agent-k8s-base:1.24-21772827a01bb5
python3.6@3.6.9-1~18.04ubuntu1.7
no fix listed

Open the chart page →

12,046
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

5,880
upcloud-csiankra-chartsVerified publisher0.4.01 of 8See more

upcloud-csi ankra-charts 0.4.0

1 of the 8 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
alpine/k8s:1.31.137a319b15cfc9
python3@3.12.11-r0
3.12.14-r0

Open the chart page →

14,917
antreaantreaVerified publisher2.7.01 of 2See more

antrea antrea 2.7.0

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
antrea/antrea-agent-ubuntu:v2.7.0c10bc45c6272
python3.12@3.12.3-1ubuntu0.15
no fix listed

Open the chart page →

3,231
apache-rangerapache-ranger0.1.01 of 2See more

apache-ranger apache-ranger 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
apache/ranger:2.7.076c176e8a0e4
python3.10@3.10.12-1~22.04.10
no fix listed

Open the chart page →

7,740
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-cas:latest6a107f224c34
python2.7@2.7.18-1~20.04.3
no fix listed

Open the chart page →

17,896
dltbrokerassist-iot-distributed-broker0.2.02 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

2 of the 9 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
hyperledger/fabric-ca-tools:latest4ce6f43ded2e
python2.7@2.7.12-1ubuntu0~16.04.3
python3.5@3.5.2-2ubuntu0~16.04.4
no fix listed
no fix listed
hyperledger/fabric-couchdb:0.4.15f6c724592abf
python2.7@2.7.12-1ubuntu0~16.04.4
python3.5@3.5.2-2ubuntu0~16.04.5
no fix listed
no fix listed

Open the chart page →

77,706
dltloggingassist-iot-logging-auditing0.2.02 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

2 of the 9 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
hyperledger/fabric-ca-tools:latest4ce6f43ded2e
python2.7@2.7.12-1ubuntu0~16.04.3
python3.5@3.5.2-2ubuntu0~16.04.4
no fix listed
no fix listed
hyperledger/fabric-couchdb:0.4.15f6c724592abf
python2.7@2.7.12-1ubuntu0~16.04.4
python3.5@3.5.2-2ubuntu0~16.04.5
no fix listed
no fix listed

Open the chart page →

77,687
music-assistantbdclark-helm-chartsVerified publisher0.4.131 of 1See more

music-assistant bdclark-helm-charts 0.4.13

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.3885872224fa5
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5

Open the chart page →

3,657
open-elevationbeeinventor0.1.01 of 2See more

open-elevation beeinventor 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
openelevation/open-elevation:latest82fb21612e86
python3.8@3.8.10-0ubuntu1~20.04
no fix listed

Open the chart page →

13,145
aramid-indexerbiatec-repoVerified publisher3.9.03 of 5See more

aramid-indexer biatec-repo 3.9.0

3 of the 5 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
scholtz2/aramid-algo-follow-node:v4.3.0-stable1ec63eca86b6
python3.12@3.12.3-1ubuntu0.8
no fix listed
scholtz2/aramid-conduit:v1.9.0-stable3a3b3d3277d2
python3.14@3.14.4-1
no fix listed
scholtz2/aramid-indexer:v3.9.0-stable6770214bc881
python3.14@3.14.4-1
no fix listed

Open the chart page →

13,357
aramid-participationbiatec-repoVerified publisher4.4.11 of 1See more

aramid-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-aramidmain-extended:4.4.1-stablef12ce1cfb72e
python3.10@3.10.12-1~22.04.6
no fix listed

Open the chart page →

7,190
aramid-relaybiatec-repoVerified publisher4.4.11 of 1See more

aramid-relay biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
scholtz2/aramid-algo-node:v4.4.1-stable70263d8fab5b
python3.12@3.12.3-1ubuntu0.8
no fix listed

Open the chart page →

5,059
voimain-participationbiatec-repoVerified publisher4.4.11 of 1See more

voimain-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-voimain-extended:4.4.1-stable64966de56d9f
python3.10@3.10.12-1~22.04.6
no fix listed

Open the chart page →

7,190
self-hostbitwarden2.4.01 of 11See more

self-host bitwarden 2.4.0

1 of the 11 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
mcr.microsoft.com/mssql/server:2025-CU5-ubuntu-24.04cee0f4db03b5
python3.12@3.12.3-1ubuntu0.13
no fix listed

Open the chart page →

5,190
easyhaproxybyjgVerified publisher2.0.41 of 1See more

easyhaproxy byjg 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
byjg/easy-haproxy:6.1.1230fdb7b00ae
python3@3.14.5-r0
3.14.7-r0

Open the chart page →

933
nacosbytectl0.1.61 of 1See more

nacos bytectl 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
python3.14@3.14.4-1ubuntu0.1
no fix listed

Open the chart page →

1,767
tensorflow-notebookcloudnativeapp0.1.21 of 1See more

tensorflow-notebook cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
tensorflow/tensorflow:1.6.0-devel1e3172090703
python2.7@2.7.12-1ubuntu0~16.04.3
python3.5@3.5.2-2ubuntu0~16.04.4
no fix listed
no fix listed

Open the chart page →

36,094
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-11940.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
python3.13@3.13.5-2
3.13.5-2+deb13u5

Open the chart page →

11,205

Container images carrying it

918 by charts deploying them

A fixed version is listed for 9 of the 18 affected packages.

Container imageDigestPackageFixed inUsed by
confluentinc/cp-kafka:latest0ad069035863
python3.9@3.9.25-7.el9_8.2
0:3.9.25-7.el9_8.3
1
confluentinc/cp-kafka:7.1.2.amd643bf359d5e340
python3@3.6.8-45.el8
0:3.6.8-78.el8_10
1
confluentinc/cp-kafka:7.6.683dbca3efd2a
python3@3.6.8-69.el8_10
0:3.6.8-78.el8_10
1
confluentinc/cp-kafka:7.8.0-3-ubi8adc392d28a1e
python3@3.6.8-69.el8_10
0:3.6.8-78.el8_10
1
confluentinc/cp-kafka:7.4.4c0224a1adf7a
python3@3.6.8-56.el8_9
0:3.6.8-78.el8_10
1
confluentinc/cp-kafka:7.5.1dc9b972db002
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10
1
confluentinc/cp-kafka-connect:6.1.04bc70a83ca6f
python3@3.6.8-31.el8
0:3.6.8-78.el8_10
1
confluentinc/cp-kafka-rest:6.1.0b0b7aa26254a
python3@3.6.8-31.el8
0:3.6.8-78.el8_10
1
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
python3@3.6.8-56.el8_9.3
0:3.6.8-78.el8_10
1
confluentinc/cp-ksqldb-server:6.1.0ee403d5b9090
python3@3.6.8-31.el8
0:3.6.8-78.el8_10
1
confluentinc/cp-schema-registry:6.1.0b651d4b6185a
python3@3.6.8-31.el8
0:3.6.8-78.el8_10
1
confluentinc/cp-schema-registry:latestf0cfd047a839
python3.9@3.9.25-7.el9_8.2
0:3.9.25-7.el9_8.3
1
confluentinc/cp-zookeeper:7.5.10bec03c1f3ce
python3@3.6.8-51.el8_8.1
0:3.6.8-78.el8_10
1
confluentinc/cp-zookeeper:7.8.0-3-ubi85ca5f3269814
python3@3.6.8-69.el8_10
0:3.6.8-78.el8_10
1
confluentinc/cp-zookeeper:6.1.078c190f4472c
python3@3.6.8-31.el8
0:3.6.8-78.el8_10
1
copyparty/ac:1.19.200a0a8605062c
python3@3.12.12-r0
3.12.14-r0
1
countly/countly-server:25.05.4e3c238248f99
python2.7@2.7.18-1~20.04.4
python3.8@3.8.10-0ubuntu1~20.04.2
no fix listed
no fix listed
1
ctron/hawkbit-operator:0.1.48fdea8f76499
python3@3.6.8-23.el8
0:3.6.8-78.el8_10
1
cybrarist/discount-bandit:v4.0.4e9e2447ac666
python3.13@3.13.5-2+deb13u2
3.13.5-2+deb13u5
1
cznic/knot-resolver:v6.4.2fe71c5214fdc
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
danialnabiyan1382/lsdisk:v2.0.8f96a7ebf1f42
python3.11@3.11.2-6+deb12u6
no fix listed
1
dariomader/twampy:v0.0.2d2f4a8c5e690
python-3.12@3.12.0-r1
3.12.13-r10
1
daskdev/dask-notebook:1.1.0052630f5ca04
python3.6@3.6.7-1~18.04
no fix listed
1
datamate/seafile-professional:11.0.202dd66b722464
python3.10@3.10.12-1~22.04.11
no fix listed
1
deconzcommunity/deconz:2.29.2062de2362641
python3.11@3.11.2-6+deb12u5
no fix listed
1
deimosfr/dnsmasq-k8s:1.4.1284c4040fc6d
python3.13@3.13.5-2
3.13.5-2+deb13u5
1
dellemc/csm-application-mobility-controller:v0.1.0148ada9060a9
python3@3.6.8-47.el8_6
0:3.6.8-78.el8_10
1
digitalist/matomo:5.12.0bc4aeeaea769
python3@3.14.5-r0
3.14.7-r0
1
docuseal/docuseal:2.4.17493fd7f6728
python3@3.12.12-r0
3.12.14-r0
1
dongjiang1989/lxcfs:v6.0.34bf9ae391948
python3.8@3.8.10-0ubuntu1~20.04.18
no fix listed
1
dpage/pgadmin4:9.252cb72a9e3da
python3@3.12.9-r0
3.12.14-r0
1
dragonflyoss/client:v1.5.4a1b52779c4dd
python3.11@3.11.2-6+deb12u8
no fix listed
1
dragonflyoss/client:v0.1.82edf3e921f4e0
python3.11@3.11.2-6
no fix listed
1
drumsergio/genieacs:1.2.16.028244054e1bf
python3.11@3.11.2-6+deb12u6
no fix listed
1
dserio83/velero-api:0.3.16b3d9115fee2
python3.11@3.11.2-6+deb12u6
no fix listed
1
eclipseaerios/iota-messages-api:lateste7f5ba0bc64d
python3.13@3.13.5-2
3.13.5-2+deb13u5
1
eftechcombr/glpi:php-fpm-12.0.0-rc1f3d0ed01709e
python3@3.12.12-r0
3.12.14-r0
1
elastictranscoder/transcoder:627e21dcb4a0327029e6
python3.6@3.6.9-1~18.04ubuntu1.4
no fix listed
1
elastictranscoder/transcoder-handler:627e21dc5b75d19e2733
python3.6@3.6.9-1~18.04ubuntu1.4
no fix listed
1
elautoestopista/aeneabot:4.2.1125ba620d528
python3@3.12.12-r0
3.12.14-r0
1
electriccoinco/lightwalletd:v0.5.42ae3a551e111
python3.13@3.13.5-2+deb13u4
3.13.5-2+deb13u5
1
esphome/esphome:2024.3.09ab8cc88b28c
python3.11@3.11.2-6
no fix listed
1
esphome/esphome:2024.12.2b2c6322700ac
python3.11@3.11.2-6+deb12u4
no fix listed
1
esphome/esphome:2025.3.0def8b6e4f517
python3.11@3.11.2-6+deb12u5
no fix listed
1
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
python2.7@2.7.12-1ubuntu0~16.04.2
no fix listed
1
ethpandaops/assertoor:latest1efa2fba6711
python3.13@3.13.5-2+deb13u2
3.13.5-2+deb13u5
1
extrim/perlite:1.5.99cb7eb5598b6
python3@3.12.9-r0
3.12.14-r0
1
felipecs8/app-db-connection-test:v129e06c9c6385
python3.11@3.11.2-6+deb12u4
no fix listed
1
firefart/requesttracker:5.0.40d6249906d8c
python3.11@3.11.2-6
no fix listed
1
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
python3.8@3.8.10-0ubuntu1~20.04.18
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.