CVE-2026-27136

Unscored

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.002; 13th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 3,002; of 17,790 indexed, latest versions
Container images: 3,680; deployed by those charts
Fix available: 1 of 1; affected package

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Carried by container images the latest versions of 3,002 of 17,790 indexed charts deploy, on 3,680 images.

Affected package	Affected versions	Fixed in	Images
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more	0.55.0	3,680

OSV records: GO-2026-5030

Charts affected

3,002 by stars

Chart

Latest

Affected images

Radar Score

argo-cdargo

10.9.1

2 of 3 See more

argo-cd argo 10.9.1

2 of the 3 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.45.1	8499afd690c4	golang.org/x/net@v0.50.0	0.55.0
quay.io/argoproj/argocd :v3.5.3	dd3f47d5a5e4	golang.org/x/net@v0.40.0	0.55.0

Open the chart page →

2,989

ingress-nginxingress-nginx

4.15.1

2 of 2 See more

ingress-nginx ingress-nginx 4.15.1

2 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/controller :v1.15.1	594ceea76b01	golang.org/x/net@v0.52.0	0.55.0
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.6.9	01038e7de14b	golang.org/x/net@v0.52.0	0.55.0

Open the chart page →

1,548

harborharbor

1.19.2

2 of 8 See more

harbor harbor 1.19.2

2 of the 8 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
goharbor/harbor-registryctl :v2.15.2	223d5cb49d5d	golang.org/x/net@v0.54.0	0.55.0
goharbor/registry-photon :v2.15.2	c4ebef61ceb5	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

1,650

jenkinsjenkinsci

5.9.62

1 of 2 See more

jenkins jenkinsci 5.9.62

1 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
jenkins/jenkins :2.568.3-jdk21	c1e4c349365f	golang.org/x/net@v0.38.0	0.55.0

Open the chart page →

2,527

airflowapache-airflow

1.22.0

1 of 4 See more

airflow apache-airflow 1.22.0

1 of the 4 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/prometheus/statsd-exporter :v0.30.0	378cb79c4ac7	golang.org/x/net@v0.51.0	0.55.0

Open the chart page →

3,207

velerovmware-tanzu

12.1.0

1 of 1 See more

velero vmware-tanzu 12.1.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
velero/velero :v1.18.1	11459094b1b2	golang.org/x/net@v0.53.0	0.55.0

Open the chart page →

1,337

metallbmetallb

0.16.1

3 of 4 See more

metallb metallb 0.16.1

3 of the 4 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/metallb/controller :v0.16.1	f51ab515de9c	golang.org/x/net@v0.53.0	0.55.0
quay.io/metallb/frr-k8s :v0.0.25	1cb06fb2d553	golang.org/x/net@v0.39.0	0.55.0
quay.io/metallb/speaker :v0.16.1	16561e96531e	golang.org/x/net@v0.53.0	0.55.0

Open the chart page →

2,129

argo-workflowsargo

2.0.6

1 of 3 See more

argo-workflows argo 2.0.6

1 of the 3 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/argoproj/argo-workflows-crdinstaller :v4.1.3	94a031823f2a	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

259

rancherrancher-stable

2.15.1

2 of 2 See more

rancher rancher-stable 2.15.1

2 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
rancher/rancher :v2.15.1	5f6c4dc52a05	golang.org/x/net@v0.52.0	0.55.0
rancher/shell :v0.8.1	f293af9c635f	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

1,456

nfs-subdir-external-provisionernfs-subdir-external-provisioner

4.0.18

1 of 1 See more

nfs-subdir-external-provisioner nfs-subdir-external-provisioner 4.0.18

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.2	63d5e04551ec	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9	0.55.0

Open the chart page →

2,745

artifact-hubartifact-hub

1.23.0

3 of 7 See more

artifact-hub artifact-hub 1.23.0

3 of the 7 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
aquasec/trivy :0.69.3	bcc376de8d77	golang.org/x/net@v0.48.0	0.55.0
artifacthub/scanner :v1.23.0	2d8365601f0e	golang.org/x/net@v0.48.0	0.55.0
artifacthub/tracker :v1.23.0	5368d21a6e5c	golang.org/x/net@v0.44.0	0.55.0

Open the chart page →

10,782

alloygrafana

1.12.1

1 of 2 See more

alloy grafana 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/prometheus-operator/prometheus-config-reloader :v0.91.0	7d9e4eea5f11	golang.org/x/net@v0.53.0	0.55.0

Open the chart page →

1,139

prometheus-blackbox-exporterprometheus-community

11.18.0

1 of 1 See more

prometheus-blackbox-exporter prometheus-community 11.18.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/prometheus/blackbox-exporter :v0.28.0	e753ff9f3fc4	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

594

deschedulerdescheduler

0.36.0

1 of 1 See more

descheduler descheduler 0.36.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/descheduler/descheduler :v0.36.0	7ca92c0a7b4f	golang.org/x/net@v0.52.0	0.55.0

Open the chart page →

569

argo-cdargo-cd-oci

10.9.1

2 of 3 See more

argo-cd argo-cd-oci 10.9.1

2 of the 3 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.45.1	8499afd690c4	golang.org/x/net@v0.50.0	0.55.0
quay.io/argoproj/argocd :v3.5.3	dd3f47d5a5e4	golang.org/x/net@v0.40.0	0.55.0

Open the chart page →

2,989

jupyterhubjupyterhub

4.4.2

1 of 7 See more

jupyterhub jupyterhub 4.4.2

1 of the 7 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/kube-scheduler :v1.30.14	74a5cf9cfa9f	golang.org/x/net@v0.23.0	0.55.0

Open the chart page →

7,909

mimir-distributedgrafana

6.2.0

2 of 6 See more

mimir-distributed grafana 6.2.0

2 of the 6 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/minio/mc :RELEASE.2024-11-21T17-21-54Z	993e8c454a7e	golang.org/x/net@v0.29.0	0.55.0
quay.io/minio/minio :RELEASE.2024-12-18T13-15-44Z	1dce27c494a1	golang.org/x/net@v0.29.0	0.55.0

Open the chart page →

4,519

natsnats

2.14.6

1 of 3 See more

nats nats 2.14.6

1 of the 3 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
natsio/nats-box :0.19.7	ffce8bd10338	golang.org/x/net@v0.53.0	0.55.0

Open the chart page →

2,315

dexdex

0.24.1

1 of 1 See more

dex dex 0.24.1

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.44.0	5d0656fce7d4	golang.org/x/net@v0.43.0	0.55.0

Open the chart page →

1,765

falcofalcosecurity

9.1.0

3 of 3 See more

falco falcosecurity 9.1.0

3 of the 3 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
falcosecurity/falco :0.44.1	d0cfe422d6ac	golang.org/x/net@v0.49.0	0.55.0
falcosecurity/falco-driver-loader :0.44.1	7df783d5269a	golang.org/x/net@v0.53.0	0.55.0
falcosecurity/falcoctl :0.13.0	0eeb79adc580	golang.org/x/net@v0.53.0	0.55.0

Open the chart page →

5,309

nfs-server-provisionerkvaps

1.8.0

1 of 1 See more

nfs-server-provisioner kvaps 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-provisioner :v4.0.8	c825f3d5e28b	golang.org/x/net@v0.0.0-20190923162816-aa69164e4478	0.55.0

Open the chart page →

2,315

chartmuseumchartmuseum

3.10.4

1 of 1 See more

chartmuseum chartmuseum 3.10.4

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/helm/chartmuseum :v0.16.3	c81f105c3682	golang.org/x/net@v0.38.0	0.55.0

Open the chart page →

1,360

argo-eventsargo

2.4.27

1 of 1 See more

argo-events argo 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/argoproj/argo-events :v1.9.11	fa07b2c9ece6	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

969

victoria-metrics-k8s-stackvictoriametrics

0.92.1

2 of 7 See more

victoria-metrics-k8s-stack victoriametrics 0.92.1

2 of the 7 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
grafana/grafana :13.1.1	7cb8c64c4d57	golang.org/x/net@v0.49.0	0.55.0
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	golang.org/x/net@v0.52.0	0.55.0

Open the chart page →

1,890

aws-node-termination-handleraws

0.21.0

1 of 1 See more

aws-node-termination-handler aws 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-ec2/aws-node-termination-handler :v1.19.0	844478ebd5b8	golang.org/x/net@v0.2.0	0.55.0

Open the chart page →

1,445

openebsopenebs

4.6.1

15 of 35 See more

openebs openebs 4.6.1

15 of the 35 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
grafana/alloy :v1.8.1	7790f6f7fbd8	golang.org/x/net@v0.37.0	0.55.0
grafana/loki :3.4.2	58a6c186ce78	golang.org/x/net@v0.34.0	0.55.0
openebs/etcd :3.6.4-debian-12-r0	c86c06f1ce6a	golang.org/x/net@v0.38.0	0.55.0
openebs/lvm-driver :1.10.1	41f73aba7f31	golang.org/x/net@v0.48.0	0.55.0
quay.io/minio/mc :RELEASE.2024-11-21T17-21-54Z	993e8c454a7e	golang.org/x/net@v0.29.0	0.55.0
quay.io/minio/minio :RELEASE.2024-12-18T13-15-44Z	1dce27c494a1	golang.org/x/net@v0.29.0	0.55.0
quay.io/prometheus-operator/prometheus-config-reloader :v0.81.0	959d47672fbf	golang.org/x/net@v0.37.0	0.55.0
registry.k8s.io/sig-storage/csi-attacher :v4.8.1	69888dba5815	golang.org/x/net@v0.34.0	0.55.0
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.13.0	d7138bcc3aa5	golang.org/x/net@v0.32.0	0.55.0
registry.k8s.io/sig-storage/csi-provisioner :v5.2.0	d5e46da8aff7	golang.org/x/net@v0.34.0	0.55.0
registry.k8s.io/sig-storage/csi-provisioner :v6.1.0	e5900dc98b0d	golang.org/x/net@v0.43.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v2.0.0	4a95d94e57ad	golang.org/x/net@v0.39.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v1.13.2	8ddd178ba5d0	golang.org/x/net@v0.34.0	0.55.0
registry.k8s.io/sig-storage/csi-snapshotter :v8.2.0	dd788d79cf4c	golang.org/x/net@v0.31.0	0.55.0
registry.k8s.io/sig-storage/snapshot-controller :v8.2.0	9dade8f2f3ab	golang.org/x/net@v0.31.0	0.55.0

Open the chart page →

24,009

prometheus-adapterprometheus-community

5.3.0

1 of 1 See more

prometheus-adapter prometheus-community 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/prometheus-adapter/prometheus-adapter :v0.12.0	932eae60e2bc	golang.org/x/net@v0.24.0	0.55.0

Open the chart page →

930

actions-runner-controlleractions-runner-controller

0.23.7

2 of 2 See more

actions-runner-controller actions-runner-controller 0.23.7

2 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
summerwind/actions-runner-controller :v0.27.6	2128f81dbede	golang.org/x/net@v0.12.0	0.55.0
quay.io/brancz/kube-rbac-proxy :v0.13.1	738c854322f5	golang.org/x/net@v0.0.0-20221002022538-bcab6841153b	0.55.0

Open the chart page →

2,883

vpafairwinds-stable

5.0.1

1 of 4 See more

vpa fairwinds-stable 5.0.1

1 of the 4 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20230312-helm-chart-4.5.2-28-g66a760794	01d181618f27	golang.org/x/net@v0.7.0	0.55.0

Open the chart page →

1,233

terraformhashicorp

1.1.2

1 of 1 See more

terraform hashicorp 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
hashicorp/terraform-k8s :1.1.2	b19857bab620	golang.org/x/net@v0.0.0-20211020060615-d418f374d309	0.55.0

Open the chart page →

2,059

apisixapisix

2.17.0

1 of 3 See more

apisix apisix 2.17.0

1 of the 3 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
bitnamilegacy/etcd :latest	99b408c15272	golang.org/x/net@v0.38.0	0.55.0

Open the chart page →

3,096

zabbixzabbix-community

7.1.0

1 of 5 See more

zabbix zabbix-community 7.1.0

1 of the 5 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
zabbix/zabbix-agent2 :ubuntu-7.0.23	7322a94c5d7a	golang.org/x/net@v0.41.0	0.55.0

Open the chart page →

13,875

graylogkong-z

3.0.33

1 See more

graylog kong-z 3.0.33

1 container image this version deploys carries CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/mongodb/mongodb-kubernetes-operator :0.13.0	2dcc6393e6f7	golang.org/x/net@v0.39.0	0.55.0

Open the chart page →

—

connectonepassword-connect

2.4.1

2 of 2 See more

connect onepassword-connect 2.4.1

2 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
1password/connect-api :1.8.2	e915c0c84397	golang.org/x/net@v0.50.0	0.55.0
1password/connect-sync :1.8.2	6297ca6136c0	golang.org/x/net@v0.50.0	0.55.0

Open the chart page →

2,562

node-problem-detectordeliveryhero

2.4.1

1 of 1 See more

node-problem-detector deliveryhero 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/node-problem-detector/node-problem-detector :v1.35.1	c380751accc5	golang.org/x/net@v0.48.0	0.55.0

Open the chart page →

1,901

miniominio-official

5.4.0

2 of 2 See more

minio minio-official 5.4.0

2 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/minio/mc :RELEASE.2024-11-21T17-21-54Z	993e8c454a7e	golang.org/x/net@v0.29.0	0.55.0
quay.io/minio/minio :RELEASE.2024-12-18T13-15-44Z	1dce27c494a1	golang.org/x/net@v0.29.0	0.55.0

Open the chart page →

2,483

openfaasopenfaas

15.0.13

1 of 6 See more

openfaas openfaas 15.0.13

1 of the 6 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/openfaas/faas-netes :0.18.17	6cfe35401d25	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

3,544

flux2fluxcd-community

2.19.0

1 of 7 See more

flux2 fluxcd-community 2.19.0

1 of the 7 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/fluxcd/flux-cli :v2.9.1	020edbaee890	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

2,957

jaeger-operatorjaegertracing

2.57.0

1 of 1 See more

jaeger-operator jaegertracing 2.57.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-operator :1.61.0	3f036ec60e61	golang.org/x/net@v0.29.0	0.55.0

Open the chart page →

566

netboxnetbox

8.3.77

1 See more

netbox netbox 8.3.77

1 container image this version deploys carries CVE-2026-27136.

Container image	Digest	Package	Fixed in
rancher/kubectl :v1.36.2	06c7a7a97727	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

—

vault-secrets-operatorhashicorp

1.5.1

1 of 2 See more

vault-secrets-operator hashicorp 1.5.1

1 of the 2 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/brancz/kube-rbac-proxy :v0.18.1	e6a323504999	golang.org/x/net@v0.28.0	0.55.0

Open the chart page →

1,040

linkerd-vizlinkerd2

30.12.11

1 of 5 See more

linkerd-viz linkerd2 30.12.11

1 of the 5 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
prom/prometheus :v2.48.0	b440bc0e8aa5	golang.org/x/net@v0.17.0	0.55.0

Open the chart page →

1,367

snapshot-controllerpiraeus-charts

5.2.0

1 of 1 See more

snapshot-controller piraeus-charts 5.2.0

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/snapshot-controller :v8.6.0	81e79f205083	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

228

rocketchatrocketchat-server

7.0.2

3 of 12 See more

rocketchat rocketchat-server 7.0.2

3 of the 12 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
bitnamilegacy/mongodb :6.0.10-debian-11-r8	42319decb591	golang.org/x/net@v0.14.0	0.55.0
bitnamilegacy/mongodb-exporter :0.39.0-debian-11-r106	de7256c7adcd	golang.org/x/net@v0.7.0	0.55.0
natsio/nats-box :0.19.2	8031d190c7ee	golang.org/x/net@v0.44.0	0.55.0

Open the chart page →

12,283

influxdb2influxdata

2.1.2

1 of 1 See more

influxdb2 influxdata 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
library/influxdb :2.7.4-alpine	a10d46445d68	golang.org/x/net@v0.17.0	0.55.0

Open the chart page →

2,102

solr-operatorapache-solr

0.9.1

2 of 3 See more

solr-operator apache-solr 0.9.1

2 of the 3 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
apache/solr-operator :v0.9.1	4db34508137f	golang.org/x/net@v0.33.0	0.55.0
pravega/zookeeper-operator :0.2.15	b2bc4042fdd8	golang.org/x/net@v0.7.0	0.55.0

Open the chart page →

2,943

ceph-csi-cephfsceph-csi

3.17.1

6 of 6 See more

ceph-csi-cephfs ceph-csi 3.17.1

6 of the 6 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.17.1	0b62db8afc9b	golang.org/x/net@v0.53.0	0.55.0
registry.k8s.io/sig-storage/csi-attacher :v4.11.0	b74b05b39501	golang.org/x/net@v0.47.0	0.55.0
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.16.0	ab482308a492	golang.org/x/net@v0.49.0	0.55.0
registry.k8s.io/sig-storage/csi-provisioner :v6.2.0	6be9f63ca4ca	golang.org/x/net@v0.51.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v2.1.0	589e525cddef	golang.org/x/net@v0.48.0	0.55.0
registry.k8s.io/sig-storage/csi-snapshotter :v8.5.0	da081c27e8a6	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

4,061

ceph-csi-rbdceph-csi

3.17.1

6 of 6 See more

ceph-csi-rbd ceph-csi 3.17.1

6 of the 6 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.17.1	0b62db8afc9b	golang.org/x/net@v0.53.0	0.55.0
registry.k8s.io/sig-storage/csi-attacher :v4.11.0	b74b05b39501	golang.org/x/net@v0.47.0	0.55.0
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.16.0	ab482308a492	golang.org/x/net@v0.49.0	0.55.0
registry.k8s.io/sig-storage/csi-provisioner :v6.2.0	6be9f63ca4ca	golang.org/x/net@v0.51.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v2.1.0	589e525cddef	golang.org/x/net@v0.48.0	0.55.0
registry.k8s.io/sig-storage/csi-snapshotter :v8.5.0	da081c27e8a6	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

4,061

chaos-meshchaos-mesh

2.8.4

4 of 4 See more

chaos-mesh chaos-mesh 2.8.4

4 of the 4 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
ghcr.io/chaos-mesh/chaos-coredns :v0.2.8	38bfdf5e3774	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e	0.55.0
ghcr.io/chaos-mesh/chaos-daemon :v2.8.4	0d28dbd95b03	golang.org/x/net@v0.52.0	0.55.0
ghcr.io/chaos-mesh/chaos-dashboard :v2.8.4	8a8ec8d4c9ea	golang.org/x/net@v0.52.0	0.55.0
ghcr.io/chaos-mesh/chaos-mesh :v2.8.4	9e48285bb44c	golang.org/x/net@v0.52.0	0.55.0

Open the chart page →

6,362

csi-driver-nfscsi-driver-nfs

4.13.4

4 of 6 See more

csi-driver-nfs csi-driver-nfs 4.13.4

4 of the 6 container images this version deploys carry CVE-2026-27136.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.17.0	f9de845b1701	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v2.2.0	a2d40c1c3ccb	golang.org/x/net@v0.49.0	0.55.0
registry.k8s.io/sig-storage/csi-snapshotter :v8.6.0	42af0929bcd6	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/livenessprobe :v2.19.0	06da0d5b8908	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

3,331

Container images carrying it

3,680 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
pritunl/pritunl-zero :1.0.3648.46	0f2943e0d41b	golang.org/x/net@v0.42.0	0.55.0	1
projecthami/volcano-vgpu-device-plugin :v1.9.4	0c94118d1d98	golang.org/x/net@v0.0.0-20200421231249-e086a090c8fd	0.55.0	1
prom/blackbox-exporter :v0.22.0	608acee5704a	golang.org/x/net@v0.0.0-20220728211354-c7608f3a8462	0.55.0	1
prom/blackbox-exporter :v0.25.0	b04a9fef4fa0	golang.org/x/net@v0.24.0	0.55.0	1
prom/blackbox-exporter :v0.23.0	ca04aa9d9093	golang.org/x/net@v0.2.0	0.55.0	1
prom/consul-exporter :v0.13.0	4e4cfd809e96	golang.org/x/net@v0.29.0	0.55.0	1
prometheuscommunity/postgres-exporter :v0.17.0	f8381eb4326a	golang.org/x/net@v0.33.0	0.55.0	1
prom/graphite-exporter :v0.16.0	e54bca6645ea	golang.org/x/net@v0.30.0	0.55.0	1
prom/memcached-exporter :v0.9.0	01267317c95d	golang.org/x/net@v0.0.0-20200625001655-4c5254603344	0.55.0	1
prom/memcached-exporter :v0.15.5	92a6ad5a3d3e	golang.org/x/net@v0.47.0	0.55.0	1
prom/memcached-exporter :v0.15.0	bb01ad25e9fc	golang.org/x/net@v0.29.0	0.55.0	1
prom/node-exporter :v1.6.0	d2e48098c364	golang.org/x/net@v0.10.0	0.55.0	1
prom/prometheus :v2.51.2	4f6c47e39a90	golang.org/x/net@v0.22.0	0.55.0	1
prom/prometheus :v2.18.1	5880ec936055	golang.org/x/net@v0.0.0-20200421231249-e086a090c8fd	0.55.0	1
prom/prometheus :v2.48.0	b440bc0e8aa5	golang.org/x/net@v0.17.0	0.55.0	1
prom/prometheus :v2.19.2	cd134bd4fca0	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9	0.55.0	1
prom/prometheus :v2.16.0	e4ca62c0d62f	golang.org/x/net@v0.0.0-20190724013045-ca1201d0de80	0.55.0	1
prom/prometheus :v2.22.2	f7ffebdd428b	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0	0.55.0	1
prom/pushgateway :v1.5.1	28fe26c8b8b1	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591	0.55.0	1
prom/pushgateway :v1.4.3	3496e0f85943	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f	0.55.0	1
prom/snmp-exporter :v0.20.0	9d226d7de223	golang.org/x/net@v0.0.0-20200625001655-4c5254603344	0.55.0	1
prom/statsd-exporter :v0.24.0	61d866e93b56	golang.org/x/net@v0.10.0	0.55.0	1
prom/statsd-exporter :v0.29.0	632f70580492	golang.org/x/net@v0.48.0	0.55.0	1
promzeus/redis-sentinel-gateway :v1	82f6d56e280b	golang.org/x/net@v0.26.0	0.55.0	1
prowlercloud/prowler-api :5.31.1	4f252d579be2	golang.org/x/net@v0.54.0	0.55.0	1
pulumi/pulumi-kubernetes-operator :v2.5.1	7dace4491358	golang.org/x/net@v0.49.0	0.55.0	1
qmcgaw/gluetun :v3.41.1	1a5bf4b4820a	golang.org/x/net@v0.47.0	0.55.0	1
qmcgaw/gluetun :v3.40.0	2b42bfa04675	golang.org/x/net@v0.31.0	0.55.0	1
qonstrukt/php :8.4-v8-apache	089af7925aa1	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e	0.55.0	1
qoveryrd/digital-mobius :0.1.4	b30a9398a83c	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7	0.55.0	1
quiq/docker-registry-ui :0.9.4	91281da47036	golang.org/x/net@v0.0.0-20211015210444-4f30a5c0130f	0.55.0	1
qumine/ingress-controller :v0.8.5	f2c8a2148381	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b	0.55.0	1
qumine/minecraft-server :v0.1.15	c0b650d51132	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591	0.55.0	1
rabbitmqoperator/cluster-operator :1.8.3	231e7ce0e905	golang.org/x/net@v0.0.0-20210510120150-4163338589ed	0.55.0	1
rabbitmqoperator/cluster-operator :2.19.2	840be4bad78e	golang.org/x/net@v0.51.0	0.55.0	1
rabbitmqoperator/cluster-operator :2.6.0	8651dd3cec51	golang.org/x/net@v0.18.0	0.55.0	1
rancher/hardened-calico :v3.13.3	6d2cd61a338b	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9	0.55.0	1
rancher/hardened-calico :v3.13.3-build20210223	c678c25d47c8	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9	0.55.0	1
rancher/hardened-flannel :v0.13.0-rancher1	42784bb38ed3	golang.org/x/net@v0.0.0-20190311183353-d8887717615a	0.55.0	1
rancher/hardened-flannel :v0.14.1-build20211022	d6a47d394c03	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b	0.55.0	1
rancher/hardened-multus-cni :v3.7.1-build20210416	8eb8092f0728	golang.org/x/net@v0.0.0-20201021035429-f5854403a974	0.55.0	1
rancher/harvester-csi-driver :v0.2.9	f9099b5ef8cb	golang.org/x/net@v0.49.0	0.55.0	1
rancher/k3s :v1.28.2-k3s1	8c2599ecfca8	golang.org/x/net@v0.13.0	0.55.0	1
rancher/k3s :v1.25.3-k3s1	eaa270df79cc	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd	0.55.0	1
rancher/kubectl :v1.25.0	85a0d1148784	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b	0.55.0	1
rancher/kube-webhook-certgen :v1.14.5-hardened2	6bb869baf40b	golang.org/x/net@v0.52.0	0.55.0	1
rancher/local-path-provisioner :v0.0.36	1eba82e9c386	golang.org/x/net@v0.38.0	0.55.0	1
rancher/local-path-provisioner :v0.0.32	9289da488b07	golang.org/x/net@v0.38.0	0.55.0	1
rancher/local-path-provisioner :v0.0.30	9b9148811700	golang.org/x/net@v0.27.0	0.55.0	1
rancher/local-path-provisioner :v0.0.20	d5999b20a1b1	golang.org/x/net@v0.0.0-20201021035429-f5854403a974	0.55.0	1