CVE-2026-18938

Medium

Advisory

Published 7 Aug 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.2; base score, highest
EPSS: 0.001; 1st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,155; of 17,792 indexed, latest versions
Container images: 2,108; deployed by those charts
Fix available: 2 of 2; affected packages

CVE-2026-18938 affecting package p11-kit for versions less than 0.26.5-1

Carried by container images the latest versions of 2,155 of 17,792 indexed charts deploy, on 2,108 images.

Affected package	Affected versions	Fixed in	Images
p11-kitdeb	0.23.9-2, 0.23.9-2ubuntu0.1, 0.23.20-1build1, 0.23.20-1ubuntu0.1+8 more	0.23.9-2ubuntu0.1+esm1, 0.23.20-1ubuntu0.1+esm1, 0.24.0-6ubuntu0.1, 0.25.3-4ubuntu2.2+1 more	2,107
p11-kitrpm	0.25.0-1.azl3	0.26.5-1	1

OSV records: DEBIAN-CVE-2026-18938 UBUNTU-CVE-2026-18938 AZL-95481 ECHO-09a0-891c-526d
Also known as: USN-8687-1

Charts affected

2,155 by stars

Chart

Latest

Affected images

Radar Score

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	p11-kit@0.24.1-2	no fix listed

Open the chart page →

2,692

changedetection-iozekker6

1.99.0

1 of 1 See more

changedetection-io zekker6 1.99.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.4	7bb6963b730d	p11-kit@0.24.1-2	no fix listed

Open the chart page →

2,630

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-18938.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	p11-kit@0.25.5-3	no fix listed

Open the chart page →

1,861

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-18938.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	p11-kit@0.23.9-2ubuntu0.1	0.23.9-2ubuntu0.1+esm1
yandex/clickhouse-server :21.3.20	4eccfffb01d7	p11-kit@0.23.20-1ubuntu0.1	0.23.20-1ubuntu0.1+esm1

Open the chart page →

9,272

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-18938.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	p11-kit@0.24.0-6build1	0.24.0-6ubuntu0.1

Open the chart page →

7,936

Container images carrying it

2,108 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
vdiogov/glpi-conteiner :latest	6945f84f0058	p11-kit@0.24.1-2	no fix listed	2
wolveix/satisfactory-server :latest :v1.9.10	e103700ae6ae	p11-kit@0.24.0-6build1	0.24.0-6ubuntu0.1	2
zabbix/zabbix-agent :ubuntu-6.4-latest	349b924472a7	p11-kit@0.25.3-4ubuntu2.1	0.25.3-4ubuntu2.2	2
ghcr.io/api7/adc :0.27.1	f65f53dd9668	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/appscode/inbox-server :latest :postgres-latest	536358d7b17e	p11-kit@0.24.0-6build1	0.24.0-6ubuntu0.1	2
ghcr.io/astriaorg/conductor :latest	3ea8164b0eae	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	p11-kit@0.25.3-4ubuntu2.1	0.25.3-4ubuntu2.2	2
ghcr.io/codingducksrl/laravel :8.1	5be52524664c	p11-kit@0.24.0-6build1	0.24.0-6ubuntu0.1	2
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	p11-kit@0.24.0-6build1	0.24.0-6ubuntu0.1	2
ghcr.io/flaresolverr/flaresolverr :v3.4.6	7962759d99d7	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/flaresolverr/flaresolverr :v3.5.2	c80ae007ce2c	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/flyteorg/flyte-connectors :py3.12-v2.3.6	896fc7b18b1b	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/games-on-whales/pulseaudio :1.0.0	f34f98405c10	p11-kit@0.23.20-1ubuntu0.1	0.23.20-1ubuntu0.1+esm1	2
ghcr.io/games-on-whales/retroarch :1.0.0	103fbcec2314	p11-kit@0.23.20-1ubuntu0.1	0.23.20-1ubuntu0.1+esm1	2
ghcr.io/games-on-whales/steam :1.0.0	9b6105be7ad0	p11-kit@0.23.20-1ubuntu0.1	0.23.20-1ubuntu0.1+esm1	2
ghcr.io/google/fleetspeak :v0.1.17	cd264d33efd4	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/immich-app/postgres :14-vectorchord0.4.3-pgvectors0.2.0	bcf63357191b	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/linuxserver/openvpn-as :version-2.8.6-916f8e7d-ubuntu18	4ee0764310e7	p11-kit@0.23.9-2	0.23.9-2ubuntu0.1+esm1	2
ghcr.io/lissy93/web-check :latest	a4e021c0f6a9	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/mumble-voip/mumble-server :v1.6.870	02fd613b6a35	p11-kit@0.25.3-4ubuntu2.1	0.25.3-4ubuntu2.2	2
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway :unprivileged-oss :unprivileged-oss-20250331	3db8145349a3	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/nucleuscloud/neosync/api :0.5.41	e2abb798f29f	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/nucleuscloud/neosync/worker :0.5.41	96f42450c5b1	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/postgresml/pgcat :main	245f9d2f5f5b	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/rss3-network/agentdata :0.1.0	fd8d3e6e4cdf	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/salaboy/fmtok8s-frontend :v0.1.1	03fd01b4f56e	p11-kit@0.24.0-6build1	0.24.0-6ubuntu0.1	2
ghcr.io/smarter-project/home-ha-mock :main	95ee018cf558	p11-kit@0.24.1-2	no fix listed	2
ghcr.io/smarter-project/hydra/isolated-vm :main	4457b79b24cd	p11-kit@0.24.1-2	no fix listed	2
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	p11-kit@0.23.20-1ubuntu0.1	0.23.20-1ubuntu0.1+esm1	2
public.ecr.aws/aktosecurity/akto-api-security-dashboard :1.69.2 :latest	b53a854bd7c1	p11-kit@0.25.3-4ubuntu2.1	0.25.3-4ubuntu2.2	2
quay.io/argoproj/argocd :v2.14.11	5fc69e31c755	p11-kit@0.25.3-4ubuntu2.1	0.25.3-4ubuntu2.2	2
registry.k8s.io/sig-storage/smbplugin :v1.20.3	dc7746bb081e	p11-kit@0.24.1-2	no fix listed	2
1dev/server :11.9.0	cd5b12fe5471	p11-kit@0.25.3-4ubuntu2.1	0.25.3-4ubuntu2.2	1
48n6e/camellia-redis-proxy :1.4.0-jdk-21-0.0.1	a6ed886fddfc	p11-kit@0.24.1-2	no fix listed	1
5200710/hadoop :3.2.3-java8	092d3088a5fb	p11-kit@0.23.20-1ubuntu0.1	0.23.20-1ubuntu0.1+esm1	1
a10networks/acos-prometheus-exporter :latest	8dc58d434d71	p11-kit@0.23.9-2	0.23.9-2ubuntu0.1+esm1	1
aapjeisbaas/wp-frankenphp :v0.2.2	6b261abc7fb0	p11-kit@0.25.5-3	no fix listed	1
aboogie/login_test_backend :new	9c41a4483ac8	p11-kit@0.24.1-2	no fix listed	1
actualbudget/actual-server :25.3.1	58fecd9088b7	p11-kit@0.24.1-2	no fix listed	1
adamzammit/limesurvey :7.1.1	fdb06d62c22e	p11-kit@0.25.5-3	no fix listed	1
adorsys/keycloak-config-cli :6.3.0-26.1.0	85be7a45a94c	p11-kit@0.25.3-4ubuntu2.1	0.25.3-4ubuntu2.2	1
adorsys/keycloak-config-cli :6.1.6-25.0.1	eb49a2dcbbb8	p11-kit@0.25.3-4ubuntu2	0.25.3-4ubuntu2.2	1
adwerx/github-actions-runner :2.276.1-20.04-1	840d2b078682	p11-kit@0.23.20-1ubuntu0.1	0.23.20-1ubuntu0.1+esm1	1
agentarea/agentarea-api :latest	9e15e16fa758	p11-kit@0.25.5-3	no fix listed	1
agentarea/agentarea-mcp-runner :latest	d3c209a5d531	p11-kit@0.24.1-2	no fix listed	1
ahmetfurkandemir/iceberg-rest-fixture-postgresql :1.10.0	142231a0b8b7	p11-kit@0.24.0-6build1	0.24.0-6ubuntu0.1	1
aibrix/metadata-service :v0.7.0	63fb81a64377	p11-kit@0.24.1-2	no fix listed	1
airbyte/manifest-server :7.28.2	deec511b51c3	p11-kit@0.24.1-2	no fix listed	1
airbyte/pod-sweeper :1.5.1	98d2c39d512e	p11-kit@0.24.1-2	no fix listed	1
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	p11-kit@0.23.20-1ubuntu0.1	0.23.20-1ubuntu0.1+esm1	1