CVE-2026-35240

Medium

Advisory

Published 21 Apr 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.9; base score, highest
EPSS: 0.002; 15th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 55; of 17,781 indexed, latest versions
Container images: 56; deployed by those charts
Fix available: 2 of 5; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 55 of 17,781 indexed charts deploy, on 56 images.

Affected package	Affected versions	Fixed in	Images
mysql-8.0deb	8.0.23-0ubuntu0.20.04.1, 8.0.25-0ubuntu0.20.04.1, 8.0.26-0ubuntu0.20.04.2, 8.0.26-0ubuntu0.20.04.3+23 more	8.0.46-0ubuntu0.20.04.1+esm2, 8.0.46-0ubuntu0.22.04.2, 8.0.46-0ubuntu0.24.04.2	47
mysql-5.7deb	5.7.20-0ubuntu0.16.04.1, 5.7.29-0ubuntu0.18.04.1, 5.7.32-0ubuntu0.18.04.1, 5.7.33-0ubuntu0.18.04.1+2 more	no fix listed	6
mysql-5.5deb	5.5.60-0ubuntu0.14.04.1, 5.5.62-0ubuntu0.14.04.1	no fix listed	2
mariadb-10.3deb	1:10.3.34-0ubuntu0.20.04.1	no fix listed	1
mysql-8.4deb	8.4.8-0ubuntu1	8.4.9-0ubuntu0.26.04.1	1

OSV records: UBUNTU-CVE-2026-35240
Also known as: USN-8363-1, USN-8363-2

Charts affected

55 by stars

Chart

Latest

Affected images

Radar Score

freeradiussvtech-public-helm-charts

0.1.5

1 of 4 See more

freeradius svtech-public-helm-charts 0.1.5

1 of the 4 container images this version deploys carry CVE-2026-35240.

Container image	Digest	Package	Fixed in
ptthanh1511/freeradius-server :3.0.26-netdebug	5741cbde85ab	mysql-8.0@8.0.30-0ubuntu0.20.04.2	8.0.46-0ubuntu0.20.04.1+esm2

Open the chart page →

12,655

rundecksvtech-public-helm-charts

1.0.0

1 of 2 See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-35240.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	mysql-8.0@8.0.36-0ubuntu0.20.04.1	8.0.46-0ubuntu0.20.04.1+esm2

Open the chart page →

18,756

opencloudunxwares

0.2.3

1 of 13 See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-35240.

Container image	Digest	Package	Fixed in
apache/tika :2.9.2.1-full	ae0b86d3c4d0	mysql-8.0@8.0.36-2ubuntu3	8.0.46-0ubuntu0.24.04.2

Open the chart page →

45,239

twenty-crmvictorlane

0.0.1

1 of 3 See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-35240.

Container image	Digest	Package	Fixed in
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	mysql-8.0@8.0.41-0ubuntu0.22.04.1	8.0.46-0ubuntu0.22.04.2

Open the chart page →

13,459

wbaas-backupwbstack

0.1.0

1 of 1 See more

wbaas-backup wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-35240.

Container image	Digest	Package	Fixed in
ghcr.io/wmde/wbaas-backup :v0.1.7	8e6a9516eac0	mysql-5.7@5.7.38-0ubuntu0.18.04.1	no fix listed

Open the chart page →

9,743

Container images carrying it

56 by charts deploying them

A fixed version is listed for 2 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/kvaps/opennebula :v5.12.0.4-1	e28e0e7de11b	mysql-8.0@8.0.26-0ubuntu0.20.04.2	8.0.46-0ubuntu0.20.04.1+esm2	1
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4	01563adc95fd	mysql-8.0@8.0.25-0ubuntu0.20.04.1	8.0.46-0ubuntu0.20.04.1+esm2	1
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4-1	2b92df1143b9	mysql-8.0@8.0.26-0ubuntu0.20.04.2	8.0.46-0ubuntu0.20.04.1+esm2	1
ghcr.io/kvaps/opennebula-flow :v5.12.0.4-1	600221f0f43f	mysql-8.0@8.0.26-0ubuntu0.20.04.2	8.0.46-0ubuntu0.20.04.1+esm2	1
ghcr.io/kvaps/opennebula-gate :v5.12.0.4-1	a85e03d8bc1d	mysql-8.0@8.0.26-0ubuntu0.20.04.2	8.0.46-0ubuntu0.20.04.1+esm2	1
ghcr.io/wmde/wbaas-backup :v0.1.7	8e6a9516eac0	mysql-5.7@5.7.38-0ubuntu0.18.04.1	no fix listed	1