StackRadar

CVE-2026-13346

Medium

Advisory

Published 29 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,323
of 17,787 indexed, latest versions
Container images
1,275
deployed by those charts
Fix available
2 of 3
affected packages

Security update for python313-pip

Carried by container images the latest versions of 1,323 of 17,787 indexed charts deploy, on 1,275 images.

Affected packageAffected versionsFixed inImages
pippypi1.5.4, 8.1.1, 8.1.2, 9.0.0+68 more26.21,268
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+24 moreno fix listed139
python313-piprpm24.2-150700.1.124.2-150700.3.3.12
OSV records
DEBIAN-CVE-2026-13346PYSEC-2026-3721UBUNTU-CVE-2026-13346SUSE-SU-2026:4030-1
Also known as
GHSA-qwm4-qh6w-59xr

Charts affected

1,323 by stars
ChartLatestAffected imagesRadar Score
backstage-pyactionsbackstage-pyactionsVerified publisher0.1.01 of 1See more

backstage-pyactions backstage-pyactions 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
mawad98/backstage-pyactions:demo99422c56a274
pip@24.0
26.2

Open the chart page →

2,738
balance-registrationbalance-registration0.1.01 of 4See more

balance-registration balance-registration 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
conduction/balance-registration-varnish:dev07c44005da9d
pip@9.0.1
26.2

Open the chart page →

8,408
pvc-exporterbalihb-pvc-exporterVerified publisher0.2.42 of 2See more

pvc-exporter balihb-pvc-exporter 0.2.4

2 of the 2 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
balihb/block-pvc-scanner:0.2.45b95e1cf1158
pip@21.2.4
26.2
balihb/pod-pvc-mapping:0.2.4ee48e79f5d76
pip@21.2.4
26.2

Open the chart page →

2,765
bookinfobasictechno0.1.01 of 6See more

bookinfo basictechno 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.17.06668bcf42ef0
pip@20.1.1
26.2

Open the chart page →

20,671
mealiebdclark-helm-chartsVerified publisher0.1.151 of 1See more

mealie bdclark-helm-charts 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.25.16066c29eca95
pip@26.0.1
26.2

Open the chart page →

4,028
wyoming-piperbdclark-helm-chartsVerified publisher0.1.41 of 1See more

wyoming-piper bdclark-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
rhasspy/wyoming-piper:2.5.27d39aafac409
pip@25.1.1
python-pip@25.1.1+dfsg-1
26.2
no fix listed

Open the chart page →

1,170
helm-samplebehnambm-helm-chart1.0.12 of 3See more

helm-sample behnambm-helm-chart 1.0.1

2 of the 3 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
behnambm/docker-sample:v1bd3ad88afff9
pip@23.0.1
26.2
library/mysql:8b3b90af2a655
pip@25.3
26.2

Open the chart page →

2,727
pagesberrutig-pages1.0.01 of 3See more

pages berrutig-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.2

Open the chart page →

20,190
mx-nodebicarus-labs0.1.01 of 1See more

mx-node bicarus-labs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
bicarus/elrond-rosetta:v1.3.50.0b1dab0721e1c
pip@20.0.2
python-pip@20.0.2-5ubuntu1.6
26.2
no fix listed

Open the chart page →

7,956
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
pip@21.1.2
python-pip@9.0.1-2.3~ubuntu1.18.04.5
26.2
no fix listed

Open the chart page →

22,891
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
pip@23.0.1
python-pip@23.0.1+dfsg-1
26.2
no fix listed

Open the chart page →

10,145
bdbablackduck2026.6.31 of 9See more

bdba blackduck 2026.6.3

1 of the 9 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
blackducksoftware/bdba-frontend:2026.6.3b10eaea94fd3
pip@26.1.2
26.2

Open the chart page →

9,521
istio-bookinfobookinfo1.2.21 of 6See more

istio-bookinfo bookinfo 1.2.2

1 of the 6 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.15.00a5eb4795952
pip@19.1.1
26.2

Open the chart page →

18,980
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-rwd:log74ded2d92f07
pip@23.0.1
26.2

Open the chart page →

26,996
jenkinsbook-k8sinfra-v25.1.121 of 2See more

jenkins book-k8sinfra-v2 5.1.12

1 of the 2 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.26.2e271016441af
pip@24.0
26.2

Open the chart page →

8,323
kube-prometheus-stackbook-k8sinfra-v265.5.11 of 6See more

kube-prometheus-stack book-k8sinfra-v2 65.5.1

1 of the 6 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.28.04166a019eeaf
pip@24.2
26.2

Open the chart page →

6,036
puppetboardbootcVerified publisher0.1.41 of 1See more

puppetboard bootc 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
bootc/puppetboard:1.1.0f1383295e7be
pip@19.2.3
26.2

Open the chart page →

1,292
flaresolverrbrandan-schmitz-helm-chartsVerified publisher1.4.01 of 1See more

flaresolverr brandan-schmitz-helm-charts 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
flaresolverr/flaresolverr:v3.5.0139dfee1c6f8
pip@24.0
26.2

Open the chart page →

27,274
pagesbrian-pages1.0.01 of 3See more

pages brian-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.2

Open the chart page →

20,190
pagesbrixton-mayuribhavsar23-pages1.0.01 of 3See more

pages brixton-mayuribhavsar23-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.2

Open the chart page →

20,190
pagesbrixton-pages1.0.01 of 3See more

pages brixton-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.2

Open the chart page →

20,190
couchpotatobryanalves0.3.01 of 1See more

couchpotato bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
linuxserver/couchpotato:75e576ee-ls32c4d2766b9eb7
pip@19.3.1
26.2

Open the chart page →

2,018
medusabryanalves0.1.01 of 1See more

medusa bryanalves 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
linuxserver/medusa:v0.3.9-ls340a5f5114128b
pip@19.2.3
26.2

Open the chart page →

147
sickchillbryanalves0.3.01 of 1See more

sickchill bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
pip@19.3.1
26.2

Open the chart page →

2,504
sickragebryanalves0.1.01 of 1See more

sickrage bryanalves 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
bryanalves/sickrage:latest42f0a130001d
pip@9.0.0
26.2

Open the chart page →

923
frigatebryopsida0.2.11 of 2See more

frigate bryopsida 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
blakeblackshear/frigate:0.11.18330b0a265b8
pip@20.3.4
26.2

Open the chart page →

2,573
pagescamden-pages1.0.01 of 3See more

pages camden-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.2

Open the chart page →

20,190
camerahubcamerahub0.10.211 of 2See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
camerahub/camerahub:0.36.23a5af37dd6e1b
pip@22.0.4
26.2

Open the chart page →

2,507
bucket-clonercamptocamp31.0.41 of 1See more

bucket-cloner camptocamp3 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
camptocamp/bucket-cloner:latestacfafc308d88
pip@21.2.1
26.2

Open the chart page →

4,518
ekorrecamptocamp30.1.11 of 1See more

ekorre camptocamp3 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
camptocamp/ekorre:0.1.035c91d5fda04
pip@20.0.2
26.2

Open the chart page →

3,891
pghoardcamptocamp35.8.11 of 1See more

pghoard camptocamp3 5.8.1

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
camptocamp/pghoard:10bff736b15623
pip@18.1
26.2

Open the chart page →

2,813
prometheus-operatorcamptocamp35.15.11 of 5See more

prometheus-operator camptocamp3 5.15.1

1 of the 5 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:0.0.16899ccd0b1f54
pip@19.0.3
26.2

Open the chart page →

2,490
snow-webhookcamptocamp31.0.01 of 1See more

snow-webhook camptocamp3 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
camptocamp/snow-webhook:latest2924b43dbf40
pip@18.1
26.2

Open the chart page →

1,310
tetragon-policy-buildercamptocamp30.1.11 of 1See more

tetragon-policy-builder camptocamp3 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
ghcr.io/camptocamp/tetragon-policy-builder:master0e99f12bb040
pip@24.3.1
26.2

Open the chart page →

10,776
pagescarina-pages1.0.01 of 3See more

pages carina-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.2

Open the chart page →

20,190
pagescarmel-pages-dell1.0.01 of 3See more

pages carmel-pages-dell 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.2

Open the chart page →

20,190
castai-hibernatecastaiVerified publisher0.2.121 of 1See more

castai-hibernate castai 0.2.12

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
castai/hibernate:v0.14da62858c8381
pip@23.0.1
26.2

Open the chart page →

1,146
temporalcastaiVerified publisher0.54.21 of 14See more

temporal castai 0.54.2

1 of the 14 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.26.237e2e33dbd7b
pip@24.0
26.2

Open the chart page →

16,198
catalyst-agentscatalyst-agents0.1.302 of 18See more

catalyst-agents catalyst-agents 0.1.30

2 of the 18 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
alpine/k8s:1.32.3eec354133193
pip@25.0.1
26.2
kiwigrid/k8s-sidecar:2.10.17eac5c4fed71
pip@26.1.2
26.2

Open the chart page →

15,027
kube-ceemsceemsOfficialVerified publisher1.40.01 of 5See more

kube-ceems ceems 1.40.0

1 of the 5 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
pip@26.1.2
26.2

Open the chart page →

640
tsoragecetic0.4.111 of 8See more

tsorage cetic 0.4.11

1 of the 8 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:5.0.1c87b1c07fb53
pip@8.1.2
26.2

Open the chart page →

12,018
opencvecfi20170.1.22 of 7See more

opencve cfi2017 0.1.2

2 of the 7 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
pip@24.3.1
26.2
ghcr.io/cfi2017/opencve-web:3.0.06961eab190a2
pip@25.0.1
26.2

Open the chart page →

15,371
pypi-servercgsimmons0.1.01 of 1See more

pypi-server cgsimmons 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
pypiserver/pypiserver:v1.3.2303ac89b2aa2
pip@19.3.1
26.2

Open the chart page →

506
ctk-walkthroughchaostoolkit-walkthrough0.1.03 of 3See more

ctk-walkthrough chaostoolkit-walkthrough 0.1.0

3 of the 3 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
chaostoolkit/back:latest734f3af86125
pip@20.2.4
26.2
chaostoolkit/front:latest7f4a7eb9f7df
pip@20.2.4
26.2
chaostoolkit/middle:latestb95ba4961cfc
pip@20.3
26.2

Open the chart page →

5,557
suggestarrcharliecharts0.4.41 of 1See more

suggestarr charliecharts 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
ciuse99/suggestarr:v1.0.20d72768245ef5
pip@24.3.1
26.2

Open the chart page →

1,126
chart-appchart-app0.3.01 of 2See more

chart-app chart-app 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
library/mysql:8b3b90af2a655
pip@25.3
26.2

Open the chart page →

1,775
chart-dnazarenochart-dnazareno0.1.01 of 3See more

chart-dnazareno chart-dnazareno 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
library/mysql:8b3b90af2a655
pip@25.3
26.2

Open the chart page →

5,778
kitchenowlchart-kitchenowl0.1.121 of 2See more

kitchenowl chart-kitchenowl 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
pip@26.0.1
26.2

Open the chart page →

4,803
calibre-webcharts-derwitt-devVerified publisher1.1.21 of 1See more

calibre-web charts-derwitt-dev 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
ghcr.io/wittdennis/calibre-web:1.1.1aa7d5d5dd6be
pip@25.0.1
26.2

Open the chart page →

4,911
home-assistant-otbrcharts-derwitt-devVerified publisher2.1.31 of 1See more

home-assistant-otbr charts-derwitt-dev 2.1.3

1 of the 1 container images this version deploys carry CVE-2026-13346.

Container imageDigestPackageFixed in
ghcr.io/wittdennis/homeassistant-otbr:4.2.31b53b0b3488e
pip@25.1.1
python-pip@25.1.1+dfsg-1
26.2
no fix listed

Open the chart page →

2,346

Container images carrying it

1,275 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
ilum/api:6.7.3624fd09528c8
pip@25.0.1
26.2
2
istio/examples-bookinfo-productpage-v1:1.15.00a5eb4795952
pip@19.1.1
26.2
2
istio/examples-bookinfo-productpage-v1:1.14.022a0410f35a8
pip@19.1
26.2
2
jvstein/bitcoin-prometheus-exporter:v0.6.07645ba790ea8
pip@21.1.2
26.2
2
kiwigrid/k8s-sidecar:1.24.44138bea678f0
pip@23.1.2
26.2
2
kiwigrid/k8s-sidecar:1.24.35af76eebbba7
pip@22.3.1
26.2
2
kiwigrid/k8s-sidecar:1.30.98c06e1ba643a
pip@25.2
26.2
2
kodekloud/examplevotingapp_vote:v13a856afb02a3
pip@22.0.4
26.2
2
langgenius/dify-sandbox:0.2.009b7e8705673
pip@23.0.1
26.2
2
larribas/mlflow:1.9.105ccb0b46bfb
pip@20.1
26.2
2
library/mysql:8.2.0212fe73edca5
pip@20.2.4
26.2
2
library/mysql:9.7.2b2cf29815e62
pip@25.3
26.2
2
library/python:3.7.0-alpine3.8e12594db7297
pip@18.1
26.2
2
library/python:3.7eedf63967cdb
pip@23.0.1
26.2
2
library/python:3.7-alpinef3d31c8677d0
pip@23.0.1
26.2
2
lncm/specter-desktop:v1.10.536eaa06f99f4
pip@21.2.4
26.2
2
locustio/locust:2.32.2a0d4b88e42c1
pip@24.0
26.2
2
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
pip@21.2.4
26.2
2
minio/operator:v4.3.754393e03f3b2
pip@9.0.3
26.2
2
nachomillangarcia/prometheus_aws_cost_exporter:lateste4ce056f2d6d
pip@18.0
26.2
2
ncsa/checks:1.0.0abf6300b57b7
pip@20.2.1
26.2
2
neilpeterson/azure-vote-front:v384062718347c
pip@9.0.1
26.2
2
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
pip@21.3.1
26.2
2
omecproject/kubernetes-synchronizer:comac-1.0.07c17a7b1d1ef
pip@18.1
26.2
2
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
pip@8.1.1
python-pip@8.1.1-2ubuntu0.4
26.2
no fix listed
2
opea/embedding-tei:1.05c9639de61c1
pip@24.0
26.2
2
opea/reranking-tei:1.0e48613afb191
pip@24.2
26.2
2
opea/retriever-redis:1.0eb746b263705
pip@24.0
26.2
2
pypiserver/pypiserver:v1.3.2303ac89b2aa2
pip@19.3.1
26.2
2
qichenxu4pd/pythonexample:1.0f3a8502bc21b
pip@24.0
26.2
2
safeglobal/safe-config-service:latest09a5e495c219
pip@26.1.1
26.2
2
sealife/fritzbox-exporter:1.0f5cc2f0f4c9b
pip@20.3.3
26.2
2
smartedge/generic-multi-access-network-virtualization:1.04cd63c22ce36
pip@20.0.2
python-pip@20.0.2-5ubuntu1.6
26.2
no fix listed
2
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
pip@20.0.2
python-pip@20.0.2-5ubuntu1.10
26.2
no fix listed
2
taigaio/taiga-back:latest4beed8f62c9f
pip@26.1.2
26.2
2
taigaio/taiga-protected:latestfd4568a97a59
pip@26.1.1
26.2
2
tzahi12345/youtubedl-material:4.3.2:latest2f943d584711
pip@22.0.2
python-pip@22.0.2+dfsg-1ubuntu0.2
26.2
no fix listed
2
weblate/weblate:4.2.2-169c160d37a3c
pip@20.2.2
26.2
2
gcr.io/k8s-staging-sig-storage/nfs-provisioner:v3.0.02de1d15fc1f2
pip@19.0.3
26.2
2
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
pip@24.0
python-pip@24.0+dfsg-1ubuntu1.3
26.2
no fix listed
2
ghcr.io/dgtlmoon/changedetection.io:0.60.3:latestecacd9fd0c66
pip@24.0
26.2
2
ghcr.io/flaresolverr/flaresolverr:v3.4.67962759d99d7
pip@25.2
26.2
2
ghcr.io/flaresolverr/flaresolverr:v3.5.2c80ae007ce2c
pip@24.0
26.2
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
pip@25.0.1
26.2
2
ghcr.io/home-assistant/home-assistant:2026.9.1:latest612d76760b54
pip@26.0.1
26.2
2
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
pip@26.0.1
26.2
2
ghcr.io/kiwigrid/k8s-sidecar:1.29.142002d66ddb3
pip@24.3.1
26.2
2
ghcr.io/miguelndecarvalho/speedtest-exporter:v3.5.4f1064d49124c
pip@22.3
26.2
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
pip@24.0
26.2
2
ghcr.io/smarter-project/home-ha-mock:main95ee018cf558
pip@25.0.1
26.2
2

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.