StackRadar

CVE-2026-18938

Medium

Advisory

Published 7 Aug 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.2
base score, highest
EPSS
0.001
1st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,154
of 17,803 indexed, latest versions
Container images
2,107
deployed by those charts
Fix available
2 of 2
affected packages

CVE-2026-18938 affecting package p11-kit for versions less than 0.26.5-1

Carried by container images the latest versions of 2,154 of 17,803 indexed charts deploy, on 2,107 images.

Affected packageAffected versionsFixed inImages
p11-kitdeb0.23.9-2, 0.23.9-2ubuntu0.1, 0.23.20-1build1, 0.23.20-1ubuntu0.1+8 more0.23.9-2ubuntu0.1+esm1, 0.23.20-1ubuntu0.1+esm1, 0.24.0-6ubuntu0.1, 0.25.3-4ubuntu2.2+1 more2,106
p11-kitrpm0.25.0-1.azl30.26.5-11
OSV records
DEBIAN-CVE-2026-18938UBUNTU-CVE-2026-18938AZL-95481ECHO-09a0-891c-526d
Also known as
USN-8687-1

Charts affected

2,154 by stars
ChartLatestAffected imagesRadar Score
changedetection-iozekker6Verified publisher1.101.01 of 1See more

changedetection-io zekker6 1.101.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.6eb4a9f718801
p11-kit@0.24.1-2
no fix listed

Open the chart page →

2,649
NEW_APPzekker6Verified publisher0.0.01 of 1See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
p11-kit@0.25.5-3
no fix listed

Open the chart page →

1,879
clickhousezloi-space1.2.02 of 3See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
yandex/clickhouse-client:21.3863f94a0f607
p11-kit@0.23.9-2ubuntu0.1
0.23.9-2ubuntu0.1+esm1
yandex/clickhouse-server:21.3.204eccfffb01d7
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

9,280
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1

Open the chart page →

7,949

Container images carrying it

2,107 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
socialmediamacroscope/collect_reddit_comment:0.1.219d3d26d53ee
p11-kit@0.23.9-2ubuntu0.1
0.23.9-2ubuntu0.1+esm1
1
socialmediamacroscope/histogram:0.1.26418f9bdb4d2
p11-kit@0.24.1-2
no fix listed
1
socialmediamacroscope/image_crawler:0.1.2f508216be63c
p11-kit@0.23.9-2ubuntu0.1
0.23.9-2ubuntu0.1+esm1
1
socialmediamacroscope/network_analysis:0.1.3b351c21422e6
p11-kit@0.24.1-2
no fix listed
1
socialmediamacroscope/preprocessing:0.1.3ca863306314b
p11-kit@0.24.1-2
no fix listed
1
socialmediamacroscope/topic_modeling:0.1.3fa490acac2f8
p11-kit@0.24.1-2
no fix listed
1
softwaremill/bootzooka:latest845b5e8f8056
p11-kit@0.26.2-2
no fix listed
1
solarwinds/solarwinds-otel-collector:0.152.3-k8s3c1110e8bdfb
p11-kit@0.24.1-2
no fix listed
1
soldevelo/kafka:4.0.0-debian-12-r0cfdc08c2f577
p11-kit@0.24.1-2
no fix listed
1
soldevelo/pgpool:4.6.3-debian-12-r0044d16a65129
p11-kit@0.24.1-2
no fix listed
1
soldevelo/postgresql-repmgr:17.6.0-debian-12-r03eaab21e40e5
p11-kit@0.24.1-2
no fix listed
1
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
1
somnathmore/custom-nginx:v2bdfc06cad4ec
p11-kit@0.24.1-2
no fix listed
1
sondresjo/altinnendata-app:v1.9.1c2707839d8a3
p11-kit@0.24.1-2
no fix listed
1
sondresjo/bobby-api:latestfe534731909a
p11-kit@0.24.1-2
no fix listed
1
sondresjo/garge-app:v1.20.70382ebf9dfc8
p11-kit@0.24.1-2
no fix listed
1
sondresjo/garge-operator:v1.9.416cb6643dae6
p11-kit@0.25.3-4ubuntu2.1
0.25.3-4ubuntu2.2
1
sondresjo/nstuning-app:v1.6.113a6795bf36da
p11-kit@0.24.1-2
no fix listed
1
sonroyaalmerol/docker-sogo:5.12.43f60f3abe990
p11-kit@0.25.5-3
no fix listed
1
speckle/speckle-preview-service:2.26.3092384dba45d
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-preview-service:2.23.14-branch.testing6.334655-b4e04ee6dee853ba74a
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-preview-service:2.25.10-branch.testing6.645-b125c1e787adcb20a3a
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
p11-kit@0.24.1-2
no fix listed
1
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
p11-kit@0.24.1-2
no fix listed
1
spy86/rabbitmq-stomp:latestea649101b9fb
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
1
sslhep/servicex_app:v1.8.51d12f943cec5
p11-kit@0.25.5-3
no fix listed
1
sslhep/servicex_code_gen_atlas_xaod:v1.8.5e7aff7f97b89
p11-kit@0.25.5-3
no fix listed
1
sslhep/servicex_code_gen_func_adl_uproot:v1.8.5b01b8ee966ed
p11-kit@0.25.5-3
no fix listed
1
sslhep/servicex_code_gen_python:v1.8.50e4175a4e1eb
p11-kit@0.25.5-3
no fix listed
1
sslhep/servicex_code_gen_raw_uproot:v1.8.5671980005c57
p11-kit@0.25.5-3
no fix listed
1
sslhep/servicex_code_gen_topcp:v1.8.5596db2abdd09
p11-kit@0.25.5-3
no fix listed
1
sslhep/servicex-did-finder-atlasopenmagic:v1.8.554aaf1721d03
p11-kit@0.25.5-3
no fix listed
1
sslhep/servicex-did-finder-cernopendata:v1.8.52cb88ceab5bb
p11-kit@0.25.5-3
no fix listed
1
sslhep/servicex-did-finder-xrootd:v1.8.5c284442b44e3
p11-kit@0.25.5-3
no fix listed
1
stackstorm/st2actionrunner:3.888235ba70cad
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
1
stackstorm/st2api:3.86f56d239d280
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
1
stackstorm/st2auth:3.833ecfda16608
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
1
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
1
stackstorm/st2notifier:3.8f190a6212195
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.