CVE-2026-19487

Medium

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.004; 36th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,505; of 17,828 indexed, latest versions
Container images: 2,511; deployed by those charts
Fix available: 1 of 1; affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 2,505 of 17,828 indexed charts deploy, on 2,511 images.

Affected package	Affected versions	Fixed in	Images
perldeb	5.18.2-2ubuntu1, 5.18.2-2ubuntu1.1, 5.18.2-2ubuntu1.4, 5.18.2-2ubuntu1.7+44 more	5.18.2-2ubuntu1.7+esm9, 5.22.1-9ubuntu0.9+esm4, 5.26.1-6ubuntu0.7+esm4, 5.30.0-9ubuntu0.5+esm4+4 more	2,511

OSV records: DEBIAN-CVE-2026-19487 UBUNTU-CVE-2026-19487 ECHO-f6c7-844b-6a34
Also known as: USN-8736-1, USN-8736-2

Charts affected

2,505 by stars

Chart

Latest

Affected images

Radar Score

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-19487.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	perl@5.36.0-7+deb12u1	no fix listed

Open the chart page →

2,709

changedetection-iozekker6

1.102.0

1 of 1 See more

changedetection-io zekker6 1.102.0

1 of the 1 container images this version deploys carry CVE-2026-19487.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.7	096dae27b5d6	perl@5.36.0-7+deb12u3	no fix listed

Open the chart page →

2,701

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-19487.

Container image	Digest	Package	Fixed in
library/nginx :latest	abe47724e466	perl@5.40.1-6+deb13u1	no fix listed

Open the chart page →

1,589

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-19487.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	perl@5.26.1-6ubuntu0.5	5.26.1-6ubuntu0.7+esm4
yandex/clickhouse-server :21.3.20	4eccfffb01d7	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm4

Open the chart page →

9,340

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-19487.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	perl@5.34.0-3ubuntu1.7	5.34.0-3ubuntu1.9

Open the chart page →

8,105

Container images carrying it

2,511 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
apache/airflow :2.8.4-python3.9	64e58748b6b9	perl@5.36.0-7+deb12u1	no fix listed	1
apache/airflow :2.10.2-python3.9	ce90bdc3d2af	perl@5.36.0-7+deb12u1	no fix listed	1
apache/airflow :2.8.1	e5560ad0b86e	perl@5.36.0-7+deb12u1	no fix listed	1
apache/apisix :3.16.0-ubuntu	5e47692cac00	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.6	1
apache/camel-k :2.11.0	d173e7efe258	perl@5.40.1-7ubuntu0.1	5.40.1-7ubuntu0.2	1
apache/gravitino-iceberg-rest :1.3.0	80136ae753ee	perl@5.34.0-3ubuntu1.5	5.34.0-3ubuntu1.9	1
apache/hertzbeat :1.8.0	75d48a62748f	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.6	1
apache/hertzbeat-collector :1.8.0	a2bab1be574c	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.6	1
apache/iotdb :0.13.3-node	afa47bf1692a	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm4	1
apache/nifi-registry :1.27.0	63b8e3e40742	perl@5.34.0-3ubuntu1.3	5.34.0-3ubuntu1.9	1
apachepulsar/pulsar :3.1.0	16f9fdab3fa6	perl@5.34.0-3ubuntu1.2	5.34.0-3ubuntu1.9	1
apachepulsar/pulsar :2.10.0	3b262ab7a7d9	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm4	1
apachepulsar/pulsar :3.0.7	9c9947de139d	perl@5.34.0-3ubuntu1.3	5.34.0-3ubuntu1.9	1
apachepulsar/pulsar :2.9.0	d056c89b7131	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm4	1
apachepulsar/pulsar :2.8.2	d538416d5afe	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm4	1
apache/ranger :2.7.0	76c176e8a0e4	perl@5.34.0-3ubuntu1.4	5.34.0-3ubuntu1.9	1
apache/rocketmq :5.3.0	434d8398f996	perl@5.38.2-3.2build2	5.38.2-3.2ubuntu0.6	1
apache/rocketmq-exporter :0.0.2	c8fb51195444	perl@5.34.0-3ubuntu1.3	5.34.0-3ubuntu1.9	1
apache/skywalking-oap-server :9.2.0	133d35d2c263	perl@5.34.0-3ubuntu1	5.34.0-3ubuntu1.9	1
apache/skywalking-oap-server :8.9.1	b4ec8c18d079	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm4	1
apache/skywalking-ui :9.2.0	295f1dc87d98	perl@5.34.0-3ubuntu1	5.34.0-3ubuntu1.9	1
apache/skywalking-ui :8.9.1	80530f0308a5	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm4	1
apache/superset :4.0.1	ab9467fd712c	perl@5.36.0-7+deb12u1	no fix listed	1
apache/tika :latest-full	80072bb73dd3	perl@5.40.1-7ubuntu0.1	5.40.1-7ubuntu0.2	1
apache/tika :3.3.1.0	90b7fa1dc018	perl@5.40.1-7build1	5.40.1-7ubuntu0.2	1
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	perl@5.40.1-6	no fix listed	1
appwrite/new :1.1.96-self-hosted	af65a77db50e	perl@5.40.1-6	no fix listed	1
arbuzov/claude-code-api :0.1.0	2d7dd8070610	perl@5.36.0-7+deb12u2	no fix listed	1
archivebox/archivebox :0.7.4	1a5a37331091	perl@5.36.0-7+deb12u3	no fix listed	1
arilot/docker-bitcoind :0.17.1	27a4f7e0f9f1	perl@5.22.1-9ubuntu0.6	5.22.1-9ubuntu0.9+esm4	1
aristidetm/basic-notebook :3.6.5	469dbc951224	perl@5.36.0-7+deb12u1	no fix listed	1
arthurjguerra18/revwallet :v0.7.12	f540af20b307	perl@5.36.0-7+deb12u1	no fix listed	1
artifacthub/tracker :v1.23.0	5368d21a6e5c	perl@5.40.1-6	no fix listed	1
artur9010/wait-for :v1.0.0	6b4de3ce8b0e	perl@5.36.0-7+deb12u1	no fix listed	1
arunvelsriram/utils :latest	655ad18fd8d6	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.6	1
assistiot/cybersecurity-monitoring_ir-cas :latest	6a107f224c34	perl@5.30.0-9ubuntu0.4	5.30.0-9ubuntu0.5+esm4	1
assistiot/fl_orchestrator :dbmongo4-latest	d157fbe150e3	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm4	1
assistiot/identity-manager_db :latest	0d3e6d35f168	perl@5.36.0-7	no fix listed	1
assistiot/location_processing :latest	e9bae124095f	perl@5.34.0-3ubuntu1.1	5.34.0-3ubuntu1.9	1
assistiot/open_api_backend :1.1.2	30812ba93555	perl@5.34.0-3ubuntu1.3	5.34.0-3ubuntu1.9	1
assistiot/sdn_controller :2.4.0	ea254b6d8a31	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm4	1
assistiot/smart-orchestrator_mcs :latest	7d6a0d534c7f	perl@5.36.0-7+deb12u1	no fix listed	1
assistiot/smart-orchestrator_scheduler :latest	38b003e55ff3	perl@5.36.0-7+deb12u1	no fix listed	1
assistiot/smart-orchestrator_scheduler_mc :latest	b1dbe4d62a03	perl@5.36.0-7	no fix listed	1
assistiot/video_augmentation :runner-cpu-latest	e5ae539ce2cb	perl@5.30.0-9ubuntu0.3	5.30.0-9ubuntu0.5+esm4	1
athou/commafeed :6.2.0-postgresql	5e388351df1a	perl@5.40.1-6	no fix listed	1
atlassian/bamboo :12.1.11	4af4bb6c8d46	perl@5.38.2-3.2ubuntu0.4	5.38.2-3.2ubuntu0.6	1
atlassian/bamboo-agent-base :12.1.11	51c2d7274eef	perl@5.38.2-3.2ubuntu0.4	5.38.2-3.2ubuntu0.6	1
atlassian/bitbucket :10.2.7	05933f2b1cfd	perl@5.38.2-3.2ubuntu0.4	5.38.2-3.2ubuntu0.6	1
atlassian/confluence-server :7.10.0	3b9222ab32ef	perl@5.34.0-3ubuntu1.1	5.34.0-3ubuntu1.9	1