StackRadar

CVE-2026-27654

High

Advisory

Published 24 Mar 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.251
98th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
29
of 17,781 indexed, latest versions
Container images
30
deployed by those charts
Fix available
5 of 5
affected packages

NGINX ngx_http_dav_module vulnerability

Carried by container images the latest versions of 29 of 17,781 indexed charts deploy, on 30 images.

Affected packageAffected versionsFixed inImages
nginxdeb1.4.6-1ubuntu3.8ppa1, 1.18.0-0ubuntu1.2, 1.18.0-0ubuntu1.3, 1.18.0-0ubuntu1.4+10 more1.4.6-1ubuntu3.9+esm6, 1.18.0-0ubuntu1.7+esm1, 1.18.0-6ubuntu14.10, 1.22.1-9+deb12u5+2 more18
nginxapk1.28.0-r3, 1.28.1-r1, 1.28.2-r11.28.3-r07
nginxbitnami1.25.5-0, 1.27.1-2, 1.28.0-01.28.33
nginx-mainlineapk1.27.4-r0, 1.27.4-r21.29.7-r02
NGINX Open Sourcebitnami1.25.5-01.28.31
OSV records
ALPINE-CVE-2026-27654BIT-nginx-2026-27654CGA-272c-r2vx-c7h2DEBIAN-CVE-2026-27654UBUNTU-CVE-2026-27654
Also known as
BIT-nginx-gateway-2026-27654, CGA-m338-cq23-g3qv, USN-8210-1, USN-8375-1

Charts affected

29 by stars
ChartLatestAffected imagesRadar Score
zabbixzabbix-communityVerified publisher7.1.01 of 5See more

zabbix zabbix-community 7.1.0

1 of the 5 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
zabbix/zabbix-web-nginx-pgsql:ubuntu-7.0.237d4d58086515
nginx@1.24.0-2ubuntu7.5
1.24.0-2ubuntu7.7

Open the chart page →

13,664
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
nginx@1.22.1-9
1.22.1-9+deb12u5

Open the chart page →

10,622
dbrepodbrepo1.13.31 of 25See more

dbrepo dbrepo 1.13.3

1 of the 25 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
bitnamilegacy/nginx:1.28.0-debian-12-r0eaf9066e86f6
nginx@1.28.0-0
1.28.3

Open the chart page →

52,635
zabbix-server-mysqlfermosit3.0.21 of 4See more

zabbix-server-mysql fermosit 3.0.2

1 of the 4 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
zabbix/zabbix-web-nginx-mysql:ubuntu-6.4-latest0e5f69c4c54e
nginx@1.24.0-2ubuntu7.1
1.24.0-2ubuntu7.7

Open the chart page →

12,840
kubefarmkvaps0.13.41 of 6See more

kubefarm kvaps 0.13.4

1 of the 6 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
ghcr.io/kvaps/kubefarm-ltsp:v0.13.424efef013a53
nginx@1.18.0-0ubuntu1.2
1.18.0-0ubuntu1.7+esm1

Open the chart page →

12,422
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
nginx@1.22.1-9+deb12u4
1.22.1-9+deb12u5

Open the chart page →

5,482
galaxy-stablecloudve2.0.01 of 5See more

galaxy-stable cloudve 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
galaxy/galaxy-stable:v18.018e577a626dfd
nginx@1.4.6-1ubuntu3.8ppa1
1.4.6-1ubuntu3.9+esm6

Open the chart page →

70,895
wizarrdjjudas21Verified publisher0.1.51 of 1See more

wizarr djjudas21 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
nginx@1.22.1-9
1.22.1-9+deb12u5

Open the chart page →

14,627
duckdb-uiduckdb-ui0.5.21 of 1See more

duckdb-ui duckdb-ui 0.5.2

1 of the 1 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
ghcr.io/beslovas/duckdb-ui:1.3.272f35584026d
nginx@1.22.1-9+deb12u3
1.22.1-9+deb12u5

Open the chart page →

4,460
seafileeleksbai0.1.11 of 3See more

seafile eleksbai 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.106693911bcc40
nginx@1.18.0-0ubuntu1.4
1.18.0-0ubuntu1.7+esm1

Open the chart page →

25,122
dump1090fnzv0.2.81 of 1See more

dump1090 fnzv 0.2.8

1 of the 1 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
fnzv/dump1090:latestb3079b95c336
nginx@1.18.0-6ubuntu14.4
1.18.0-6ubuntu14.10

Open the chart page →

4,077
seafilegeek-cookbookVerified publisher3.2.01 of 1See more

seafile geek-cookbook 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
nginx@1.18.0-0ubuntu1.2
1.18.0-0ubuntu1.7+esm1

Open the chart page →

24,293
ibm-ucv-prodibm-helm5.2.61 of 16See more

ibm-ucv-prod ibm-helm 5.2.6

1 of the 16 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
bitnamilegacy/nginx:1.27.1934d1acd5ca8
nginx@1.27.1-2
1.28.3

Open the chart page →

12,105
label-studioinseefrlab2.3.11 of 3See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
heartexlabs/label-studio:latestaa461572e8f9
nginx@1.28.2-r1
1.28.3-r0

Open the chart page →

3,157
multimodal-data-visualizationintelVerified publisher3.0.01 of 2See more

multimodal-data-visualization intel 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
intel/multimodal-data-visualization-streaming:3.01a89327e499b
nginx@1.18.0-0ubuntu1.3
1.18.0-0ubuntu1.7+esm1

Open the chart page →

11,069
docker-mailservermailserverVerified publisher0.2.651 of 9See more

docker-mailserver mailserver 0.2.65

1 of the 9 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
jeboehm/mailserver-web:5.0.929da13edf5aa8
nginx@1.28.0-r3
1.28.3-r0

Open the chart page →

10,897
tinymediamanagermedia-servarrVerified publisher1.6.21 of 2See more

tinymediamanager media-servarr 1.6.2

1 of the 2 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
tinymediamanager/tinymediamanager:5.3.22b34dc85099e
nginx@1.26.3-3+deb13u2
1.26.3-3+deb13u3

Open the chart page →

7,944
outscale-s3-exploreroutscale-s3-explorer0.1.41 of 1See more

outscale-s3-explorer outscale-s3-explorer 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
nginx@1.28.0-r3
1.28.3-r0

Open the chart page →

1,811
seafilephybros-helm-charts4.0.11 of 1See more

seafile phybros-helm-charts 4.0.1

1 of the 1 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.97ac833196f60
nginx@1.18.0-0ubuntu1.3
1.18.0-0ubuntu1.7+esm1

Open the chart page →

22,084
kubecostradar-baseVerified publisher1.0.01 of 7See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
gcr.io/kubecost1/frontend:prod-2.6.3a535f7de024b
nginx-mainline@1.27.4-r0
1.29.7-r0

Open the chart page →

9,355
relfinder-reformedrelfinderreformed2.0.01 of 2See more

relfinder-reformed relfinderreformed 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
ghcr.io/woodenmaiden/relfinderreformedfront:latest344f53763b25
nginx@1.25.5-0
NGINX Open Source@1.25.5-0
1.28.3
1.28.3

Open the chart page →

6,282
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
nginx@1.28.0-r3
1.28.3-r0

Open the chart page →

4,499
synapse-adminschoenwald1.0.11 of 1See more

synapse-admin schoenwald 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
awesometechnologies/synapse-admin:0.11.4a1c1f4662875
nginx@1.28.2-r1
1.28.3-r0

Open the chart page →

1,802
tabixsinextraVerified publisher0.2.21 of 1See more

tabix sinextra 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/tabix:22.05.17a6e3e996a4ae
nginx@1.28.0-r3
1.28.3-r0

Open the chart page →

1,249
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
gcr.io/kubecost1/frontend:prod-2.5.5991c1465c658
nginx-mainline@1.27.4-r2
1.29.7-r0

Open the chart page →

7,901
mrasiftech-thinker1.0.41 of 1See more

mrasif tech-thinker 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
mrasif/mrasif.in:v4.6.0375a1ed8fdc0
nginx@1.28.1-r1
1.28.3-r0

Open the chart page →

2,043
tensor_apptensor-app0.2.22 of 3See more

tensor_app tensor-app 0.2.2

2 of the 3 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
xeladock/mysql_dns:latest4baf531453f1
nginx@1.18.0-6ubuntu14
1.18.0-6ubuntu14.10
xeladock/nginx2:latestc259a67b1dff
nginx@1.18.0-6ubuntu14
1.18.0-6ubuntu14.10

Open the chart page →

17,461
orchestra-login-portaltremolo2.3.971 of 1See more

orchestra-login-portal tremolo 2.3.97

1 of the 1 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
ghcr.io/openunison/openunison-k8s-react:1.0.2afb3e9282952
nginx@1.18.0-6ubuntu14.7
1.18.0-6ubuntu14.10

Open the chart page →

2,956
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-27654.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
nginx@1.22.1-9+deb12u2
1.22.1-9+deb12u5

Open the chart page →

5,984

Container images carrying it

30 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
allegroai/clearml:2.0.0-613713ae38f7daf
nginx@1.22.1-9
1.22.1-9+deb12u5
1
awesometechnologies/synapse-admin:0.11.4a1c1f4662875
nginx@1.28.2-r1
1.28.3-r0
1
bitnamilegacy/nginx:1.27.1934d1acd5ca8
nginx@1.27.1-2
1.28.3
1
bitnamilegacy/nginx:1.28.0-debian-12-r0eaf9066e86f6
nginx@1.28.0-0
1.28.3
1
fnzv/dump1090:latestb3079b95c336
nginx@1.18.0-6ubuntu14.4
1.18.0-6ubuntu14.10
1
galaxy/galaxy-stable:v18.018e577a626dfd
nginx@1.4.6-1ubuntu3.8ppa1
1.4.6-1ubuntu3.9+esm6
1
heartexlabs/label-studio:latestaa461572e8f9
nginx@1.28.2-r1
1.28.3-r0
1
intel/multimodal-data-visualization-streaming:3.01a89327e499b
nginx@1.18.0-0ubuntu1.3
1.18.0-0ubuntu1.7+esm1
1
jeboehm/mailserver-web:5.0.929da13edf5aa8
nginx@1.28.0-r3
1.28.3-r0
1
mrasif/mrasif.in:v4.6.0375a1ed8fdc0
nginx@1.28.1-r1
1.28.3-r0
1
rocketadmin/rocketadmin:1.17.710955ef540b9
nginx@1.22.1-9+deb12u4
1.22.1-9+deb12u5
1
seafileltd/seafile-mc:9.0.106693911bcc40
nginx@1.18.0-0ubuntu1.4
1.18.0-0ubuntu1.7+esm1
1
seafileltd/seafile-mc:9.0.97ac833196f60
nginx@1.18.0-0ubuntu1.3
1.18.0-0ubuntu1.7+esm1
1
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
nginx@1.18.0-0ubuntu1.2
1.18.0-0ubuntu1.7+esm1
1
sigp/siren:v3.0.42c219b04758e
nginx@1.22.1-9+deb12u2
1.22.1-9+deb12u5
1
tinymediamanager/tinymediamanager:5.3.22b34dc85099e
nginx@1.26.3-3+deb13u2
1.26.3-3+deb13u3
1
vabene1111/recipes:2.3.50f8d061895e9
nginx@1.28.0-r3
1.28.3-r0
1
xeladock/mysql_dns:latest4baf531453f1
nginx@1.18.0-6ubuntu14
1.18.0-6ubuntu14.10
1
xeladock/nginx2:latestc259a67b1dff
nginx@1.18.0-6ubuntu14
1.18.0-6ubuntu14.10
1
zabbix/zabbix-web-nginx-mysql:ubuntu-6.4-latest0e5f69c4c54e
nginx@1.24.0-2ubuntu7.1
1.24.0-2ubuntu7.7
1
zabbix/zabbix-web-nginx-pgsql:ubuntu-7.0.237d4d58086515
nginx@1.24.0-2ubuntu7.5
1.24.0-2ubuntu7.7
1
gcr.io/kubecost1/frontend:prod-2.5.5991c1465c658
nginx-mainline@1.27.4-r2
1.29.7-r0
1
gcr.io/kubecost1/frontend:prod-2.6.3a535f7de024b
nginx-mainline@1.27.4-r0
1.29.7-r0
1
ghcr.io/beslovas/duckdb-ui:1.3.272f35584026d
nginx@1.22.1-9+deb12u3
1.22.1-9+deb12u5
1
ghcr.io/kvaps/kubefarm-ltsp:v0.13.424efef013a53
nginx@1.18.0-0ubuntu1.2
1.18.0-0ubuntu1.7+esm1
1
ghcr.io/openunison/openunison-k8s-react:1.0.2afb3e9282952
nginx@1.18.0-6ubuntu14.7
1.18.0-6ubuntu14.10
1
ghcr.io/sergelogvinov/tabix:22.05.17a6e3e996a4ae
nginx@1.28.0-r3
1.28.3-r0
1
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
nginx@1.28.0-r3
1.28.3-r0
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
nginx@1.22.1-9
1.22.1-9+deb12u5
1
ghcr.io/woodenmaiden/relfinderreformedfront:latest344f53763b25
nginx@1.25.5-0
NGINX Open Source@1.25.5-0
1.28.3
1.28.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.