StackRadar

CVE-2026-18477

Medium

Advisory

Published 3 Aug 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.4
base score, highest
EPSS
0.001
0th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,442
of 17,797 indexed, latest versions
Container images
2,413
deployed by those charts
Fix available
1 of 1
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 2,442 of 17,797 indexed charts deploy, on 2,413 images.

Affected packageAffected versionsFixed inImages
tardeb1.27.1-1, 1.27.1-1ubuntu0.1, 1.28-2.1ubuntu0.1, 1.28-2.1ubuntu0.2+31 more1.35+dfsg-3.1+e52,413
OSV records
DEBIAN-CVE-2026-18477UBUNTU-CVE-2026-18477ECHO-b8d2-238f-d46b

Charts affected

2,442 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

2,413 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
boxcutter/meshcmd:1.1.384e13f01bcab
tar@1.34+dfsg-1ubuntu0.1.22.04.1
no fix listed
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
tar@1.30+dfsg-7ubuntu0.20.04.1
no fix listed
1
btcpayserver/tor:0.4.8.10e9585b68dc6b
tar@1.34+dfsg-1.2
no fix listed
1
budibase/database:2.1.0d90f656261c9
tar@1.34+dfsg-1.2+deb12u1
no fix listed
1
budibase/proxy:3.41.38d780b6ee602
tar@1.35+dfsg-3.1
no fix listed
1
bugsink/bugsink:2ecdd84587746
tar@1.35+dfsg-3.1
no fix listed
1
burakince/mlflow:3.16.0ab4b566644b9
tar@1.35+dfsg-3.1
no fix listed
1
calltelemetry/web:0.8.1-rc7205d13269e350
tar@1.34+dfsg-1.2+deb12u1
no fix listed
1
camptocamp/mapserver:latestbf2e8e118c9b
tar@1.35+dfsg-3ubuntu0.4
no fix listed
1
camunda/zeebe:8.4.5ab5abc09e407
tar@1.34+dfsg-1ubuntu0.1.22.04.2
no fix listed
1
carbone/carbone-ee:full-5.11.0518172cbad49
tar@1.35+dfsg-3.1
no fix listed
1
carlosmz87/test_helm_backend:latest8ffa63aa995d
tar@1.34+dfsg-1.2+deb12u1
no fix listed
1
castai/hibernate:v0.14da62858c8381
tar@1.35+dfsg-3.1
no fix listed
1
castlemock/castlemock:latestb7f3f1527ba9
tar@1.35+dfsg-3build1
no fix listed
1
castopod/castopod:1.12.101fd37280cbb2
tar@1.34+dfsg-1.2+deb12u1
no fix listed
1
castopod/castopod:1.15.54e4f0440520f
tar@1.35+dfsg-3.1
no fix listed
1
cbioportal/cbioportal:6.4.1-web-shenandoah08debbd2dbf9
tar@1.35+dfsg-3build1
no fix listed
1
cccs/assemblyline-core:4.7.4.stable20098127270065
tar@1.34+dfsg-1.2+deb12u1
no fix listed
1
cccs/assemblyline-rust:4.7.4.stable202be5e6a57427
tar@1.34+dfsg-1.2+deb12u1
no fix listed
1
cccs/assemblyline-socketio:4.7.4.stable202b88493b62f7
tar@1.34+dfsg-1.2+deb12u1
no fix listed
1
cccs/assemblyline-ui:4.7.4.stable20efa75509b854
tar@1.34+dfsg-1.2+deb12u1
no fix listed
1
chaerr/kridge:demo-operator-v0.1.266833deec017
tar@1.30+dfsg-7ubuntu0.20.04.3
no fix listed
1
chainsafe/lodestar:latest5593f6e97912
tar@1.34+dfsg-1.2+deb12u1
no fix listed
1
chainsafe/lodestar:v1.27.07b9fe4aa8073
tar@1.34+dfsg-1.2+deb12u1
no fix listed
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
tar@1.34+dfsg-1ubuntu0.1.22.04.2
no fix listed
1
chetangautamm/repo:Opensips_Buildb4b94155ff5a
tar@1.27.1-1ubuntu0.1
no fix listed
1
chetangautamm/repo:sipp.v3e7f7049e1544
tar@1.30+dfsg-7ubuntu0.20.04.1
no fix listed
1
cheveo/azp-agent:1.0.282240f890884
tar@1.34+dfsg-1ubuntu0.1.22.04.2
no fix listed
1
cheyang/distributed-tf:1.6.046cc34755493
tar@1.28-2.1ubuntu0.1
no fix listed
1
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
tar@1.35+dfsg-3.1
no fix listed
1
chocobozzz/peertube:v8.1.5052712130691
tar@1.35+dfsg-3.1
no fix listed
1
chriseaton/adventureworks:latest54c3384ce701
tar@1.34+dfsg-1ubuntu0.1.22.04.2
no fix listed
1
chromadb/chroma:1.5.7fc8dc8e11fb2
tar@1.35+dfsg-3.1
no fix listed
1
circleci/runner:launch-agent9bdc62f02162
tar@1.30+dfsg-7ubuntu0.20.04.4
no fix listed
1
ciscolabs/msm-nc:0710202336d02faad958
tar@1.34+dfsg-1ubuntu0.1.22.04.1
no fix listed
1
citizenstig/httpbin:latestb81c818ccb86
tar@1.28-2.1ubuntu0.1
no fix listed
1
ckan/ckan-base:2.12.087ecf3f27ad6
tar@1.34+dfsg-1.2+deb12u1
no fix listed
1
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
tar@1.34+dfsg-1ubuntu0.1.22.04.2
no fix listed
1
ckulka/baikal:0.10.1-nginx434bdd162247
tar@1.34+dfsg-1.2+deb12u1
no fix listed
1
clickhouse/clickhouse-server:24.81ffa82edee00
tar@1.30+dfsg-7ubuntu0.20.04.4
no fix listed
1
clickhouse/clickhouse-server:24.4.12e6587b81a26
tar@1.30+dfsg-7ubuntu0.20.04.4
no fix listed
1
clickhouse/clickhouse-server:23.8512bb8a21483
tar@1.30+dfsg-7ubuntu0.20.04.4
no fix listed
1
clickhouse/clickhouse-server:26.3810861a2e2d0
tar@1.34+dfsg-1ubuntu0.1.22.04.6
no fix listed
1
clickhouse/clickhouse-server:25.3.2.398745843b17f9
tar@1.34+dfsg-1ubuntu0.1.22.04.2
no fix listed
1
clickhouse/clickhouse-server:26.3.1092098d3b31dd
tar@1.34+dfsg-1ubuntu0.1.22.04.2
no fix listed
1
clickhouse/clickhouse-server:24.12.6a65ca89ddbe8
tar@1.34+dfsg-1ubuntu0.1.22.04.2
no fix listed
1
clickhouse/clickhouse-server:25.3.14.14b627d7a9bc0e
tar@1.34+dfsg-1ubuntu0.1.22.04.2
no fix listed
1
clickhouse/clickhouse-server:26.7c28b8916e10e
tar@1.34+dfsg-1ubuntu0.1.22.04.6
no fix listed
1
clickhouse/clickhouse-server:26.8.3d73903d1b61d
tar@1.34+dfsg-1ubuntu0.1.22.04.6
no fix listed
1
clickhouse/clickhouse-server:23.4.2.11dc5658853ce1
tar@1.34+dfsg-1ubuntu0.1.22.04.1
no fix listed
1

syft 1.42.1 · advisories as of 17 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.