StackRadar

CVE-2026-18938

Medium

Advisory

Published 7 Aug 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.2
base score, highest
EPSS
0.001
1st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,197
of 17,813 indexed, latest versions
Container images
2,161
deployed by those charts
Fix available
2 of 2
affected packages

CVE-2026-18938 affecting package p11-kit for versions less than 0.26.5-1

Carried by container images the latest versions of 2,197 of 17,813 indexed charts deploy, on 2,161 images.

Affected packageAffected versionsFixed inImages
p11-kitdeb0.23.9-2, 0.23.9-2ubuntu0.1, 0.23.20-1build1, 0.23.20-1ubuntu0.1+8 more0.23.9-2ubuntu0.1+esm1, 0.23.20-1ubuntu0.1+esm1, 0.24.0-6ubuntu0.1, 0.25.3-4ubuntu2.2+1 more2,160
p11-kitrpm0.25.0-1.azl30.26.5-11
OSV records
DEBIAN-CVE-2026-18938UBUNTU-CVE-2026-18938AZL-95481ECHO-09a0-891c-526d
Also known as
USN-8687-1

Charts affected

2,197 by stars
ChartLatestAffected imagesRadar Score
lodestar-validatorstakewise1.2.01 of 1See more

lodestar-validator stakewise 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
chainsafe/lodestar:v1.27.07b9fe4aa8073
p11-kit@0.24.1-2
no fix listed

Open the chart page →

4,122
nethermindstakewise2.8.21 of 3See more

nethermind stakewise 2.8.2

1 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
nethermind/nethermind:1.31.893e57917371a
p11-kit@0.25.3-4ubuntu2.1
0.25.3-4ubuntu2.2

Open the chart page →

2,100
operatorstakewise2.1.11 of 5See more

operator stakewise 2.1.1

1 of the 5 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
sigp/lighthouse:v2.1.2ad501f02cfef
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

6,609
rethstakewise1.2.11 of 3See more

reth stakewise 1.2.1

1 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/paradigmxyz/reth:v1.3.121e5290e8b743
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1

Open the chart page →

2,039
ssv-nodestakewise2.2.01 of 2See more

ssv-node stakewise 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
bloxstaking/ssv-node:v2.2.0bf6d7d2fdc93
p11-kit@0.24.1-2
no fix listed

Open the chart page →

7,054
teku-validatorstakewise4.3.21 of 2See more

teku-validator stakewise 4.3.2

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
consensys/teku:25.4.1bf6ecd2ea716
p11-kit@0.25.3-4ubuntu2.1
0.25.3-4ubuntu2.2

Open the chart page →

3,249
verostakewise0.8.31 of 2See more

vero stakewise 0.8.3

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
p11-kit@0.24.1-2
no fix listed

Open the chart page →

3,512
stalwartstalwart-helmVerified publisher0.7.181 of 2See more

stalwart stalwart-helm 0.7.18

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
stalwartlabs/stalwart:v0.16.22388dcb75a707
p11-kit@0.25.5-3
no fix listed

Open the chart page →

1,450
unifistartechnicaVerified publisher0.1.31 of 2See more

unifi startechnica 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
jacobalberty/unifi:v7.1.664a3616625dda
p11-kit@0.23.9-2ubuntu0.1
0.23.9-2ubuntu0.1+esm1

Open the chart page →

14,628
trinostatcan1.23.41 of 2See more

trino statcan 1.23.4

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
trinodb/trino:405ee80ab5eeab2
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1

Open the chart page →

13,949
static-src-people-detector-appstatic-src-people-detector-chartVerified publisher1.5.51 of 6See more

static-src-people-detector-app static-src-people-detector-chart 1.5.5

1 of the 6 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/mongo:4.4.18d23ec07162ca
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

13,673
steadybit-agentsteadybit3.1.1691 of 6See more

steadybit-agent steadybit 3.1.169

1 of the 6 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/steadybit/agent:2.4.6d246bfa55f63
p11-kit@0.25.5-3
no fix listed

Open the chart page →

3,837
pagesstephendillondell1.0.02 of 3See more

pages stephendillondell 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
flyway/flyway:6.4.422d97ceb0c47
p11-kit@0.23.9-2
0.23.9-2ubuntu0.1+esm1

Open the chart page →

20,285
minkstoneshi-tscharts0.1.01 of 1See more

mink stoneshi-tscharts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
p11-kit@0.25.5-3
no fix listed

Open the chart page →

1,956
sn-platform-slimstreamnative1.11.441 of 6See more

sn-platform-slim streamnative 1.11.44

1 of the 6 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

66,879
wonder-mesh-netstrrl-helm2026.629.01 of 3See more

wonder-mesh-net strrl-helm 2026.629.0

1 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/strrl/wonder-mesh-net:v2026.629.0625b140372fd
p11-kit@0.24.1-2
no fix listed

Open the chart page →

5,201
kurento_webrtc_demostunner0.1.01 of 2See more

kurento_webrtc_demo stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
kurento/kurento-media-server:latest03c0d34d0828
p11-kit@0.25.3-4ubuntu2.1
0.25.3-4ubuntu2.2

Open the chart page →

12,811
stunner-kurento-one2one-callstunner0.1.01 of 2See more

stunner-kurento-one2one-call stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
kurento/kurento-media-server:latest03c0d34d0828
p11-kit@0.25.3-4ubuntu2.1
0.25.3-4ubuntu2.2

Open the chart page →

12,811
artifactory-cleanupsubshellVerified publisher1.0.11 of 1See more

artifactory-cleanup subshell 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
devopshq/artifactory-cleanup:1.0.1830e093bffa91
p11-kit@0.24.1-2
no fix listed

Open the chart page →

2,585
group-challengesubshell-labVerified publisher2.1.01 of 2See more

group-challenge subshell-lab 2.1.0

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.29.17d12c7c8fc66
p11-kit@0.25.3-4ubuntu2.1
0.25.3-4ubuntu2.2

Open the chart page →

2,626
orchestratorsubstraVerified publisher8.8.01 of 3See more

orchestrator substra 8.8.0

1 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/postgres:1767f41722b7a8
p11-kit@0.25.5-3
no fix listed

Open the chart page →

3,071
substra-backendsubstraVerified publisher26.15.32 of 7See more

substra-backend substra 26.15.3

2 of the 7 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/postgres:1767f41722b7a8
p11-kit@0.25.5-3
no fix listed
ghcr.io/substra/substra-backend:1.0.121967f54ec86
p11-kit@0.25.3-4ubuntu2.1
0.25.3-4ubuntu2.2

Open the chart page →

4,874
substra-frontendsubstraVerified publisher1.2.31 of 1See more

substra-frontend substra 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/substra/substra-frontend:1.0.0e230e6ac0722
p11-kit@0.24.1-2
no fix listed

Open the chart page →

3,039
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
p11-kit@0.24.1-2
no fix listed

Open the chart page →

13,639
3d-printing-cost-calculatorssudo-kraken-3d-printing-cost-calculatorsVerified publisher0.1.41 of 1See more

3d-printing-cost-calculators sudo-kraken-3d-printing-cost-calculators 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/sudo-kraken/3d-printing-cost-calculators:v1.1.1220c5e4e1a3d
p11-kit@0.24.1-2
no fix listed

Open the chart page →

2,724
authentik-webfinger-proxysudo-kraken-authentik-webfinger-proxyVerified publisher0.1.41 of 1See more

authentik-webfinger-proxy sudo-kraken-authentik-webfinger-proxy 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/sudo-kraken/authentik-webfinger-proxy:v1.1.1e1351a977607
p11-kit@0.24.1-2
no fix listed

Open the chart page →

2,804
fantasy-dice-chambersudo-kraken-fantasy-dice-chamberVerified publisher0.1.31 of 1See more

fantasy-dice-chamber sudo-kraken-fantasy-dice-chamber 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/sudo-kraken/fantasy-dice-chamber:v1.3.299fd4cb0f4fe
p11-kit@0.24.1-2
no fix listed

Open the chart page →

2,836
finances-trackersudo-kraken-finances-trackerVerified publisher0.1.51 of 1See more

finances-tracker sudo-kraken-finances-tracker 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/sudo-kraken/finances-tracker:v1.1.1c73527cde81c
p11-kit@0.24.1-2
no fix listed

Open the chart page →

2,804
flaresolverrsudo-kraken-flaresolverrVerified publisher2.1.41 of 1See more

flaresolverr sudo-kraken-flaresolverr 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/flaresolverr/flaresolverr:v3.4.67962759d99d7
p11-kit@0.24.1-2
no fix listed

Open the chart page →

34,253
jellyfinsudo-kraken-jellyfinVerified publisher2.1.31 of 1See more

jellyfin sudo-kraken-jellyfin 2.1.3

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
jellyfin/jellyfin:10.11.6333b64771663
p11-kit@0.25.5-3
no fix listed

Open the chart page →

3,457
jf-pushover-webhooksudo-kraken-jf-pushover-webhookVerified publisher0.1.31 of 1See more

jf-pushover-webhook sudo-kraken-jf-pushover-webhook 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/sudo-kraken/jf-pushover-webhook:v1.1.0ee9cf22a39ab
p11-kit@0.24.1-2
no fix listed

Open the chart page →

2,804
nginx-chartsuin-nginx0.1.01 of 1See more

nginx-chart suin-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
p11-kit@0.25.5-3
no fix listed

Open the chart page →

1,956
pagessunilb2590-pages1.0.02 of 3See more

pages sunilb2590-pages 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
flyway/flyway:6.4.422d97ceb0c47
p11-kit@0.23.9-2
0.23.9-2ubuntu0.1+esm1

Open the chart page →

20,285
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
p11-kit@0.24.1-2
no fix listed

Open the chart page →

3,522
convert-datasvtechVerified publisher0.13.21 of 3See more

convert-data svtech 0.13.2

1 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
svtechnmaa/svtech_debuger:v1.0.3a934ffd63d25
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1

Open the chart page →

7,830
netforge-besvtechVerified publisher0.0.21 of 3See more

netforge-be svtech 0.0.2

1 of the 3 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
conductoross/conductor:3.31.09fba127693e6
p11-kit@0.25.5-3
no fix listed

Open the chart page →

4,783
elasticsearchsvtech-public-helm-charts1.0.01 of 1See more

elasticsearch svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
svtechnmaa/svtech_debuger:v1.0.0b2987abe57d3
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1

Open the chart page →

12,299
freeradiussvtech-public-helm-charts0.1.51 of 4See more

freeradius svtech-public-helm-charts 0.1.5

1 of the 4 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ptthanh1511/freeradius-server:3.0.26-netdebug5741cbde85ab
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

12,748
grafanasvtech-public-helm-charts1.0.01 of 2See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

11,020
icinga2svtech-public-helm-charts1.0.01 of 4See more

icinga2 svtech-public-helm-charts 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/redis:7.2.3a7cee7c8178f
p11-kit@0.24.1-2
no fix listed

Open the chart page →

5,570
maxscalesvtech-public-helm-charts1.0.01 of 2See more

maxscale svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
svtechnmaa/svtech_maxscale:v1.0.3410a25b51f9f
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1

Open the chart page →

75,790
nagvissvtech-public-helm-charts1.0.01 of 1See more

nagvis svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
svtechnmaa/svtech_nagvis:v1.2.118394b08e6c3
p11-kit@0.24.1-2
no fix listed

Open the chart page →

9,311
preparationsvtech-public-helm-charts1.0.01 of 1See more

preparation svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
svtechnmaa/svtech_debuger:v1.0.0b2987abe57d3
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1

Open the chart page →

12,299
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

76,156
stash-boxswuuper-githubVerified publisher0.1.11 of 2See more

stash-box swuuper-github 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
stashapp/stash-box:latesta534c8afdf39
p11-kit@0.25.3-4ubuntu2.1
0.25.3-4ubuntu2.2

Open the chart page →

8,312
explorersynapse0.2.161 of 6See more

explorer synapse 0.2.16

1 of the 6 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
yandex/clickhouse-server:latest1cbf75aabe1e
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1

Open the chart page →

8,615
app-startersynkubeVerified publisher1.4.11 of 1See more

app-starter synkube 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/nginx:latest6e23479198b9
p11-kit@0.25.5-3
no fix listed

Open the chart page →

3,374
topolvmsyself1.3.01 of 1See more

topolvm syself 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
ghcr.io/topolvm/topolvm-with-sidecar:0.35.0b354978c440d
p11-kit@0.24.0-6build1
0.24.0-6ubuntu0.1

Open the chart page →

3,622
vaultwardensyself1.0.01 of 1See more

vaultwarden syself 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
vaultwarden/server:latest094b5689ed81
p11-kit@0.25.5-3
no fix listed

Open the chart page →

1,792
cronjobt3n0.1.01 of 1See more

cronjob t3n 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container imageDigestPackageFixed in
library/python:3.8d41127070014
p11-kit@0.24.1-2
no fix listed

Open the chart page →

11,431

Container images carrying it

2,161 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
p11-kit@0.23.20-1ubuntu0.1
0.23.20-1ubuntu0.1+esm1
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
p11-kit@0.24.1-2
no fix listed
1
registry.k8s.io/csi-secrets-store/driver:v1.6.1b48d7d13dd06
p11-kit@0.24.1-2
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
p11-kit@0.25.5-3
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.1.0fd9722fd02e3
p11-kit@0.24.1-2
no fix listed
1
registry.k8s.io/node-problem-detector/node-problem-detector:v0.8.2052f0618e9bc2
p11-kit@0.24.1-2
no fix listed
1
registry.k8s.io/node-problem-detector/node-problem-detector:v1.35.1c380751accc5
p11-kit@0.24.1-2
no fix listed
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
p11-kit@0.24.1-2
no fix listed
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.9.0f9d65db8bda2
p11-kit@0.24.1-2
no fix listed
1
registry.k8s.io/sig-storage/nfsplugin:v4.13.41eb5a85180a4
p11-kit@0.24.1-2
no fix listed
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
p11-kit@0.24.1-2
no fix listed
1

syft 1.42.1 · advisories as of 20 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.