StackRadar

CVE-2026-18938

Medium

Advisory

Published 7 Aug 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.2
base score, highest
EPSS
0.001
1st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,161
of 17,828 indexed, latest versions
Container images
2,128
deployed by those charts
Fix available
2 of 2
affected packages

CVE-2026-18938 affecting package p11-kit for versions less than 0.26.5-1

Carried by container images the latest versions of 2,161 of 17,828 indexed charts deploy, on 2,128 images.

Affected packageAffected versionsFixed inImages
p11-kitdeb0.23.9-2, 0.23.9-2ubuntu0.1, 0.23.20-1build1, 0.23.20-1ubuntu0.1+8 more0.23.9-2ubuntu0.1+esm1, 0.23.20-1ubuntu0.1+esm1, 0.24.0-6ubuntu0.1, 0.25.3-4ubuntu2.2+1 more2,127
p11-kitrpm0.25.0-1.azl30.26.5-11
OSV records
DEBIAN-CVE-2026-18938UBUNTU-CVE-2026-18938AZL-95481ECHO-09a0-891c-526d
Also known as
USN-8687-1

Charts affected

2,161 by stars
ChartLatestAffected imagesRadar Score
auth0-operatorauth0-operator1.4.121 of 1See more

auth0-operator auth0-operator 1.4.12

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/alethic/auth0-operator-image:1.4.122468990a8521
p11-kit@0.25.3-4ubuntu2.1
0.25.3-4ubuntu2.2

Open the chart page →

760
autopushautopushVerified publisher0.0.492 of 4See more

autopush autopush 0.0.49

2 of the 4 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/wrenix/autopush-rs/autoconnect:1.84.285f93ced88b2
p11-kit@0.24.1-2
no fix listed
ghcr.io/wrenix/autopush-rs/autoendpoint:1.84.2d95e9a124eed
p11-kit@0.24.1-2
no fix listed

Open the chart page →

3,094
istio-discoveryaveshaVerified publisher1.16.01 of 1See more

istio-discovery avesha 1.16.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
istio/pilot:1.16.0ac0284d75ec9
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1

Open the chart page →

6,981
webappavzi-webapp0.1.01 of 1See more

webapp avzi-webapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
avzini/web-app:latestf40b30210ed0
p11-kit@0.24.1-2
no fix listed

Open the chart page →

6,393
nas-appsawesomeVerified publisher2.0.01 of 8See more

nas-apps awesome 2.0.0

1 of the 8 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
p11-kit@0.25.5-3
no fix listed

Open the chart page →

5,935
aws9helmaws9helm0.1.04 of 4See more

aws9helm aws9helm 0.1.0

4 of the 4 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
kuzwolka/aws9:main1ad759b961b1
p11-kit@0.24.1-2
no fix listed
kuzwolka/aws9:news3e8880fbbb96
p11-kit@0.24.1-2
no fix listed
kuzwolka/aws9:blog4a7707410bf1
p11-kit@0.24.1-2
no fix listed
kuzwolka/aws9:shop84a9d9766345
p11-kit@0.24.1-2
no fix listed

Open the chart page →

18,724
aws-web-service-proxifiedaws-web-service-proxified1.8.01 of 2See more

aws-web-service-proxified aws-web-service-proxified 1.8.0

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/httpd:latest979c38c2228d
p11-kit@0.25.5-3
no fix listed

Open the chart page →

3,006
azp-agentazp-agent1.2.01 of 1See more

azp-agent azp-agent 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
cheveo/azp-agent:1.0.282240f890884
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1

Open the chart page →

3,333
ragflowbaboulinet0.1.11 of 5See more

ragflow baboulinet 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
infiniflow/infinity:v0.7.0992c87a68612
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1

Open the chart page →

6,089
backstage-pyactionsbackstage-pyactionsVerified publisher0.1.01 of 1See more

backstage-pyactions backstage-pyactions 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
mawad98/backstage-pyactions:demo99422c56a274
p11-kit@0.25.5-3
no fix listed

Open the chart page →

2,724
basic-auth-s3-nginxbasic-auth-s3-nginxVerified publisher1.0.01 of 1See more

basic-auth-s3-nginx basic-auth-s3-nginx 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
dachichang/basic-auth-s3-nginx:1.0.07ccac90a935e
p11-kit@0.24.1-2
no fix listed

Open the chart page →

6,311
bookinfobasictechno0.1.03 of 6See more

bookinfo basictechno 0.1.0

3 of the 6 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
istio/examples-bookinfo-reviews-v1:1.17.0b8f16a765eea
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
istio/examples-bookinfo-reviews-v2:1.17.072f25a55f078
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
istio/examples-bookinfo-reviews-v3:1.17.08f92fc1b6592
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

20,884
my-nginx-appbassant-nginx-app0.1.01 of 1See more

my-nginx-app bassant-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/nginx:stable0aa2d81d65bc
p11-kit@0.25.5-3
no fix listed

Open the chart page →

1,887
mealiebdclark-helm-chartsVerified publisher0.1.151 of 1See more

mealie bdclark-helm-charts 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.25.16066c29eca95
p11-kit@0.25.5-3
no fix listed

Open the chart page →

4,015
pangolinbdcode0.14.11 of 1See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
fosrl/pangolin:latest83a55f933b4d
p11-kit@0.24.1-2
no fix listed

Open the chart page →

1,958
immichbear0.1.12 of 2See more

immich bear 0.1.1

2 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v3.1.05a0839dc5303
p11-kit@0.24.1-2
no fix listed
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
p11-kit@0.25.5-3
no fix listed

Open the chart page →

6,690
helm-samplebehnambm-helm-chart1.0.11 of 3See more

helm-sample behnambm-helm-chart 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/redis:771da9275c5f3
p11-kit@0.24.1-2
no fix listed

Open the chart page →

2,702
webappbenc-uk1.4.31 of 1See more

webapp benc-uk 1.4.3

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/nginx:latestcfb8a89ac237
p11-kit@0.25.5-3
no fix listed

Open the chart page →

1,593
pagesberrutig-pages1.0.02 of 3See more

pages berrutig-pages 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
flyway/flyway:6.4.422d97ceb0c47
p11-kit@0.23.9-2
0.23.9-2ubuntu0.1+esm1

Open the chart page →

20,287
algorand-participationbiatec-repoVerified publisher4.4.11 of 1See more

algorand-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-mainnet-extended:4.4.1-stable5aaa5d4ab8b8
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1

Open the chart page →

7,438
algorand-relaybiatec-repoVerified publisher4.4.11 of 1See more

algorand-relay biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
scholtz2/algorand-relay-mainnet:4.4.1-stablee9af7d8ff6bb
p11-kit@0.25.3-4ubuntu2.1
0.25.3-4ubuntu2.2

Open the chart page →

5,308
mx-nodebicarus-labs0.1.01 of 1See more

mx-node bicarus-labs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
bicarus/elrond-rosetta:v1.3.50.0b1dab0721e1c
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

74,996
mx-notifierbicarus-labs1.1.91 of 1See more

mx-notifier bicarus-labs 1.1.9

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
bicarus/mx-notifier:1.1.8bed688d16762
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

3,785
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
p11-kit@0.23.9-2ubuntu0.1
0.23.9-2ubuntu0.1+esm1

Open the chart page →

87,479
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
p11-kit@0.24.1-2
no fix listed

Open the chart page →

10,240
bdbablackduck2026.6.34 of 9See more

bdba blackduck 2026.6.3

4 of the 9 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
blackducksoftware/bdba-frontend:2026.6.3b10eaea94fd3
p11-kit@0.25.5-3
no fix listed
fluent/fluent-bit:4.2.6a52221a2a3eb
p11-kit@0.25.5-3
no fix listed
library/postgres:15.18-bookworme8db9bd3e9e1
p11-kit@0.24.1-2
no fix listed
library/rabbitmq:4.2.87561d672fae4
p11-kit@0.25.3-4ubuntu2.1
0.25.3-4ubuntu2.2

Open the chart page →

9,974
firehoseblip-firehoseVerified publisher0.0.181 of 11See more

firehose blip-firehose 0.0.18

1 of the 11 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

13,551
bluespacebluespace0.3.01 of 1See more

bluespace bluespace 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
p11-kit@0.25.5-3
no fix listed

Open the chart page →

1,887
bnkrbnkr1.0.51 of 2See more

bnkr bnkr 1.0.5

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
engrmth/bnkr:2.1.06d8464e6f0e8
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

15,345
colosseumbook-k8sinfra-v21.0.183 of 5See more

colosseum book-k8sinfra-v2 1.0.18

3 of the 5 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-agg:logbc25b152d88e
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1
sysnet4admin/colosseum-cms:loge74b43c7f492
p11-kit@0.24.1-2
no fix listed
sysnet4admin/colosseum-prm:log5802bfcd7fed
p11-kit@0.24.1-2
no fix listed

Open the chart page →

27,611
csi-driver-nfsbook-k8sinfra-v24.12.11 of 6See more

csi-driver-nfs book-k8sinfra-v2 4.12.1

1 of the 6 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
p11-kit@0.24.1-2
no fix listed

Open the chart page →

6,312
jaegerbook-k8sinfra-v23.4.02 of 5See more

jaeger book-k8sinfra-v2 3.4.0

2 of the 5 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1
library/cassandra:3.11.65aa8400b4b3b
p11-kit@0.23.9-2
0.23.9-2ubuntu0.1+esm1

Open the chart page →

19,390
jenkinsbook-k8sinfra-v25.1.121 of 2See more

jenkins book-k8sinfra-v2 5.1.12

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
jenkins/jenkins:2.440.3-jdk17de4fea113221
p11-kit@0.24.1-2
no fix listed

Open the chart page →

8,400
flaresolverrbrandan-schmitz-helm-chartsVerified publisher1.4.01 of 1See more

flaresolverr brandan-schmitz-helm-charts 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
flaresolverr/flaresolverr:v3.5.0139dfee1c6f8
p11-kit@0.24.1-2
no fix listed

Open the chart page →

27,831
tenantsbrbarmex-tenant2.0.01 of 1See more

tenants brbarmex-tenant 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
p11-kit@0.25.5-3
no fix listed

Open the chart page →

1,887
pagesbrian-pages1.0.02 of 3See more

pages brian-pages 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
flyway/flyway:6.4.422d97ceb0c47
p11-kit@0.23.9-2
0.23.9-2ubuntu0.1+esm1

Open the chart page →

20,287
pagesbrixton-mayuribhavsar23-pages1.0.02 of 3See more

pages brixton-mayuribhavsar23-pages 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
flyway/flyway:6.4.422d97ceb0c47
p11-kit@0.23.9-2
0.23.9-2ubuntu0.1+esm1

Open the chart page →

20,287
pagesbrixton-pages1.0.02 of 3See more

pages brixton-pages 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
flyway/flyway:6.4.422d97ceb0c47
p11-kit@0.23.9-2
0.23.9-2ubuntu0.1+esm1

Open the chart page →

20,287
ombibryanalves0.4.01 of 1See more

ombi bryanalves 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
linuxserver/ombi:3.0.4572-ls452fbb21fb4903
p11-kit@0.23.9-2
0.23.9-2ubuntu0.1+esm1

Open the chart page →

10,804
plexbryanalves0.5.01 of 1See more

plex bryanalves 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
plexinc/pms-docker:1.25.4.5487-648a8f9f946ea59b96f2b
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

6,779
tautullibryanalves0.1.01 of 1See more

tautulli bryanalves 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
tautulli/tautulli:latest670e68dd9efc
p11-kit@0.25.5-3
no fix listed

Open the chart page →

1,956
node-appbryopsida0.5.12 of 2See more

node-app bryopsida 0.5.1

2 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/node:lts64af3819f927
p11-kit@0.24.1-2
no fix listed
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
p11-kit@0.25.3-4ubuntu2.1
0.25.3-4ubuntu2.2

Open the chart page →

73,199
plexbryopsida0.2.01 of 1See more

plex bryopsida 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/plex:latest7f9a1d574958
p11-kit@0.26.2-2
no fix listed

Open the chart page →

876
nginx-chartbtrepoVerified publisher0.1.01 of 1See more

nginx-chart btrepo 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
p11-kit@0.25.5-3
no fix listed

Open the chart page →

1,593
category-microservicebusi-adsVerified publisher1.0.01 of 2See more

category-microservice busi-ads 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
dellcloud/category:distributed02fc234353a9
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

11,605
pages-microservicebusi-adsVerified publisher1.0.02See more

pages-microservice busi-ads 1.0.0

2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
flyway/flyway:6.4.422d97ceb0c47
p11-kit@0.23.9-2
0.23.9-2ubuntu0.1+esm1

Open the chart page →

—
bpabusiness-partner-agentVerified publisher0.12.41 of 3See more

bpa business-partner-agent 0.12.4

1 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
bcgovimages/aries-cloudagent:py36-1.16-1_0.7.4faa2e2d21916
p11-kit@0.23.9-2ubuntu0.1
0.23.9-2ubuntu0.1+esm1

Open the chart page →

11,658
gotenbergbysamioVerified publisher0.2.01 of 1See more

gotenberg bysamio 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8-chromium0d28ae9a9644
p11-kit@0.25.5-3
no fix listed

Open the chart page →

5,558
mariadbbysamioVerified publisher1.0.21 of 1See more

mariadb bysamio 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/mariadb:12.0.2607835cd628b
p11-kit@0.25.3-4ubuntu2.1
0.25.3-4ubuntu2.2

Open the chart page →

2,978
duoauthproxy-radius-simplecaerus0.1.01 of 1See more

duoauthproxy-radius-simple caerus 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ethanbergstrom/duoauthproxy:5.5.0345c2a46c103
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

3,036

Container images carrying it

2,128 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

No deployed image carries CVE-2026-18938.

syft 1.42.1 · advisories as of 21 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.