StackRadar

CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.007
51st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,528
of 17,803 indexed, latest versions
Container images
5,282
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,528 of 17,803 indexed charts deploy, on 5,282 images.

Affected packageAffected versionsFixed inImages
git-lfsrpm2.13.3-3.el8_60:3.4.1-11.el8_101
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+190 more1.25.135,243
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more0.55.03,683
OSV records
RHSA-2026:30853GO-2026-5026

Charts affected

4,528 by stars
ChartLatestAffected imagesRadar Score
m365-exportercloudeteer-helm-chartsVerified publisher1.7.11 of 1See more

m365-exporter cloudeteer-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ghcr.io/cloudeteer/m365-exporter:3.9.3a13a11fe9558
stdlib@go1.26.5
1.25.13

Open the chart page →

84
passboltcnieg1.1.171 of 2See more

passbolt cnieg 1.1.17

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
passbolt/passbolt:3.4.0-ce-non-root655547e17263
stdlib@go1.14.4
1.25.13

Open the chart page →

3,554
codercoderOfficialVerified publisher1.44.61 of 2See more

coder coder 1.44.6

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
coderenvs/coder-service:1.44.61deffc4670e6
golang.org/x/net@v0.24.0
stdlib@go1.21.9
0.55.0
1.25.13

Open the chart page →

7,187
dronecommunity-chartsVerified publisher0.1.52 of 2See more

drone community-charts 0.1.5

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
drone/drone:2.28.255897c8fb22d
golang.org/x/net@v0.42.0
stdlib@go1.24.13
0.55.0
1.25.13
drone/drone-runner-kube:1.0.0-rc.34359bf2bb3dc
golang.org/x/net@v0.0.0-20211209124913-491a49abca63
stdlib@go1.16.15
0.55.0
1.25.13

Open the chart page →

2,737
cloudflare-operatorcontainerooVerified publisher1.10.71 of 1See more

cloudflare-operator containeroo 1.10.7

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ghcr.io/containeroo/cloudflare-operator:v1.10.60eda6d237a84
stdlib@go1.26.0
1.25.13

Open the chart page →

222
convoyconvoyVerified publisher3.7.132 of 3See more

convoy convoy 3.7.13

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
bitnamilegacy/redis:8.2.1-debian-12-r025bf63f3caf7
stdlib@go1.25.0
1.25.13
getconvoy/convoy:v26.7.6f4934cc05e31
stdlib@go1.26.2
1.25.13

Open the chart page →

6,128
cortexcortex3.3.81 of 4See more

cortex cortex 3.3.8

1 of the 4 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
quay.io/cortexproject/cortex:v1.21.18577eb292a01
golang.org/x/net@v0.49.0
stdlib@go1.25.8
0.55.0
1.25.13

Open the chart page →

4,014
whoamicowboysysopVerified publisher6.0.01 of 1See more

whoami cowboysysop 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
traefik/whoami:v1.11.0200689790a0a
stdlib@go1.24.1
1.25.13

Open the chart page →

353
doris-operatordorisVerified publisher25.8.01 of 1See more

doris-operator doris 25.8.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
apache/doris:operator-latest3a4422656592
golang.org/x/net@v0.33.0
stdlib@go1.23.12
0.55.0
1.25.13

Open the chart page →

438
uptime-kumaduyet0.1.81 of 1See more

uptime-kuma duyet 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.18.5a84767d7934f
golang.org/x/net@v0.0.0-20220812174116-3211cb980234
stdlib@go1.18.5
0.55.0
1.25.13

Open the chart page →

4,565
emqx-operatoremqx-operator2.3.22 of 2See more

emqx-operator emqx-operator 2.3.2

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
alpine/k8s:1.31.49c4976d47656
golang.org/x/net@v0.31.0
stdlib@go1.23.2
0.55.0
1.25.13
ghcr.io/emqx/emqx-operator:2.3.23333ed546165
golang.org/x/net@v0.47.0
stdlib@go1.24.13
0.55.0
1.25.13

Open the chart page →

4,706
kube-routerenixVerified publisher1.10.01 of 1See more

kube-router enix 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
cloudnativelabs/kube-router:v1.6.00ec7cd73f43f
golang.org/x/net@v0.4.0
stdlib@go1.19.5
0.55.0
1.25.13

Open the chart page →

2,352
gethethereum-helm-chartsVerified publisher1.1.41 of 2See more

geth ethereum-helm-charts 1.1.4

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ethereum/client-go:stableb8ab3451a117
golang.org/x/net@v0.50.0
stdlib@go1.26.5
0.55.0
1.25.13

Open the chart page →

633
gotifygotifyVerified publisher0.8.11 of 1See more

gotify gotify 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
gotify/server:2.9.1a3af47067ce6
golang.org/x/net@v0.48.0
stdlib@go1.26.0
0.55.0
1.25.13

Open the chart page →

568
docmosthelmforgeVerified publisher1.2.121 of 4See more

docmost helmforge 1.2.12

1 of the 4 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie4ef4dbc939d6
stdlib@go1.24.6
1.25.13

Open the chart page →

4,206
wordpresshelmforgeVerified publisher3.0.61 of 3See more

wordpress helmforge 3.0.6

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
library/mysql:9.7.2257388edf9c8
stdlib@go1.24.6
1.25.13

Open the chart page →

4,261
korkorVerified publisher0.2.161 of 1See more

kor kor 0.2.16

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
yonahdissen/kor:latest1a85158c82bb
stdlib@go1.26.0
1.25.13

Open the chart page →

222
kubelet-csr-approverkubelet-csr-approverOfficialVerified publisher1.2.151 of 1See more

kubelet-csr-approver kubelet-csr-approver 1.2.15

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ghcr.io/postfinance/kubelet-csr-approver:v1.2.156469ef517d2b
golang.org/x/net@v0.49.0
0.55.0

Open the chart page →

64
logging-operatorkube-loggingVerified publisher4.2.31 of 1See more

logging-operator kube-logging 4.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ghcr.io/kube-logging/logging-operator:4.2.20dd85dcb1f73
golang.org/x/net@v0.10.0
stdlib@go1.20.5
0.55.0
1.25.13

Open the chart page →

880
myipkuossOfficialVerified publisher0.2.21 of 1See more

myip kuoss 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ghcr.io/kuoss/myip:v0.1.7760f5ccae493
golang.org/x/net@v0.38.0
stdlib@go1.23.8
0.55.0
1.25.13

Open the chart page →

660
keptnlifecycle-toolkitOfficialVerified publisher0.11.03 of 3See more

keptn lifecycle-toolkit 0.11.0

3 of the 3 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ghcr.io/keptn/certificate-operator:v3.0.0b82064b0e339
golang.org/x/net@v0.30.0
stdlib@go1.23.3
0.55.0
1.25.13
ghcr.io/keptn/lifecycle-operator:v2.0.0866ced256a8c
golang.org/x/net@v0.30.0
stdlib@go1.23.3
0.55.0
1.25.13
ghcr.io/keptn/metrics-operator:v2.1.0dc48471c7cf8
golang.org/x/net@v0.37.0
stdlib@go1.23.3
0.55.0
1.25.13

Open the chart page →

1,956
lightrun-helm-chartlightrun-helm-chartOfficialVerified publisher3.52.01 of 9See more

lightrun-helm-chart lightrun-helm-chart 3.52.0

1 of the 9 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
library/mysql:8.4.108dbcf531a03a
stdlib@go1.24.6
1.25.13

Open the chart page →

463
mattermost-operatormattermostVerified publisher1.0.51 of 1See more

mattermost-operator mattermost 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
mattermost/mattermost-operator:v1.25.4bac00a2bbd33
golang.org/x/net@v0.41.0
stdlib@go1.24.13
0.55.0
1.25.13

Open the chart page →

273
meshery-operatormesheryOfficialVerified publisher1.0.702 of 2See more

meshery-operator meshery 1.0.70

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
alpine/k8s:1.35.6b7a12c5ddf26
golang.org/x/net@v0.54.0
stdlib@go1.26.3
0.55.0
1.25.13
meshery/meshery-operator:1.0.50d245bc8b5c6
stdlib@go1.26.4
1.25.13

Open the chart page →

2,461
missing-container-metricsmissing-container-metrics0.1.11 of 1See more

missing-container-metrics missing-container-metrics 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
dmilhdef/missing-container-metrics:v0.21.0fada1a6e7638
golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110
stdlib@go1.16.2
0.55.0
1.25.13

Open the chart page →

2,418
tailscale-relaymvisonneau0.2.71 of 1See more

tailscale-relay mvisonneau 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
mvisonneau/tailscale:v1.68.1fc45ad8abf10
golang.org/x/net@v0.24.0
stdlib@go1.22.4
0.55.0
1.25.13

Open the chart page →

1,357
system-upgrade-controllernimbolus0.7.01 of 1See more

system-upgrade-controller nimbolus 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
rancher/system-upgrade-controller:v0.18.09813f85653c8
golang.org/x/net@v0.44.0
stdlib@go1.25.3
0.55.0
1.25.13

Open the chart page →

318
olmolmVerified publisher0.45.01 of 1See more

olm olm 0.45.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
quay.io/operator-framework/olm:v0.45.0f228c7a6b8c5
stdlib@go1.26.3
1.25.13

Open the chart page →

448
ketoory0.64.01 of 1See more

keto ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
oryd/keto:v26.2.0bfdb8b9e283a
golang.org/x/net@v0.48.0
stdlib@go1.26.0
0.55.0
1.25.13

Open the chart page →

978
oathkeeperory0.64.01 of 1See more

oathkeeper ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
oryd/oathkeeper:v26.2.0467329abde34
golang.org/x/net@v0.48.0
stdlib@go1.26.0
0.55.0
1.25.13

Open the chart page →

930
passboltpassbolt2.1.13 of 6See more

passbolt passbolt 2.1.1

3 of the 6 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
bitnamilegacy/mariadb:12.0.2-debian-12-r0888cdaae3cb9
stdlib@go1.25.0
1.25.13
bitnamilegacy/redis:8.2.1-debian-12-r025bf63f3caf7
stdlib@go1.25.0
1.25.13
library/mariadb:latestdd9b303aed4f
stdlib@go1.24.6
1.25.13

Open the chart page →

13,697
pmmpercona1.9.11 of 1See more

pmm percona 1.9.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
percona/pmm-server:3.9.1003f9c25f842
stdlib@go1.26.4
1.25.13

Open the chart page →

823
redis-enterprise-operatorredis-enterprise-operator-officialOfficialVerified publisher8.0.18-111 of 1See more

redis-enterprise-operator redis-enterprise-operator-official 8.0.18-11

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
redislabs/operator:8.0.18-119078e713bb6a
golang.org/x/net@v0.51.0
stdlib@go1.26.1
0.55.0
1.25.13

Open the chart page →

944
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
golang.org/x/net@v0.48.0
stdlib@go1.26.4
0.55.0
1.25.13

Open the chart page →

1,389
rekorsigstoreVerified publisher1.8.67 of 9See more

rekor sigstore 1.8.6

7 of the 9 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
library/redisdigest-pinned148bb5411c18
stdlib@go1.18.2
1.25.13
gcr.io/trillian-opensource-ci/db_serverdigest-pinned2a685a38dd01
stdlib@go1.18.2
1.25.13
ghcr.io/sigstore/rekor/rekor-server:v1.5.4100d793d68d0
stdlib@go1.26.4
1.25.13
ghcr.io/sigstore/scaffolding/createdbdigest-pinned3cee6c78973b
golang.org/x/net@v0.46.0
stdlib@go1.25.0
0.55.0
1.25.13
ghcr.io/sigstore/scaffolding/createtreedigest-pinnede5232e8c9122
golang.org/x/net@v0.46.0
stdlib@go1.25.0
0.55.0
1.25.13
ghcr.io/sigstore/scaffolding/trillian_log_serverdigest-pinned5a878e4e4f03
stdlib@go1.26.0
1.25.13
ghcr.io/sigstore/scaffolding/trillian_log_signerdigest-pinned28c5ff40963f
stdlib@go1.26.0
1.25.13

Open the chart page →

5,526
mssqlserver-2022simcube1.2.31 of 1See more

mssqlserver-2022 simcube 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
mcr.microsoft.com/mssql/server:2022-latestba4c8329f48f
stdlib@go1.26.1
1.25.13

Open the chart page →

2,975
snyk-monitorsnyk2.23.261 of 2See more

snyk-monitor snyk 2.23.26

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
snyk/kubernetes-monitor:2.23.26fb5ad76ce84e
golang.org/x/net@v0.54.0
stdlib@go1.25.10
0.55.0
1.25.13

Open the chart page →

584
swo-k8s-collectorsolarwindsOfficialVerified publisher5.3.03 of 3See more

swo-k8s-collector solarwinds 5.3.0

3 of the 3 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
solarwinds/solarwinds-otel-collector:0.152.3-k8s3c1110e8bdfb
stdlib@go1.26.4-X:boringcrypto
1.25.13
ghcr.io/open-telemetry/opentelemetry-ebpf-instrumentation/ebpf-instrument:v0.9.026f82b148dfe
golang.org/x/net@v0.53.0
stdlib@go1.25.9
0.55.0
1.25.13
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.06b2f0b6f2f86
golang.org/x/net@v0.51.0
stdlib@go1.26.2
0.55.0
1.25.13

Open the chart page →

2,439
sops-operatorsops-operatorVerified publisher0.10.12 of 2See more

sops-operator sops-operator 0.10.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
clastix/kubectl:v1.3122918a06c253
golang.org/x/net@v0.26.0
stdlib@go1.22.5
0.55.0
1.25.13
ghcr.io/peak-scale/sops-operator:0.10.11da9b716b792
stdlib@go1.26.4
1.25.13

Open the chart page →

1,260
thehivestrangebee-helmOfficialVerified publisher1.0.74 of 7See more

thehive strangebee-helm 1.0.7

4 of the 7 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
golang.org/x/net@v0.42.0
stdlib@go1.24.6
0.55.0
1.25.13
bitnamilegacy/os-shell:12-debian-12-r5177e65e9d633e
golang.org/x/net@v0.42.0
stdlib@go1.25.0
0.55.0
1.25.13
minio/mc:RELEASE.2025-08-13T08-35-41Za7fe349ef4bd
golang.org/x/net@v0.42.0
stdlib@go1.24.6
0.55.0
1.25.13
minio/minio:RELEASE.2025-09-07T16-13-09Z14cea493d9a3
golang.org/x/net@v0.39.0
stdlib@go1.24.6
0.55.0
1.25.13

Open the chart page →

16,436
truenas-csptruenas-cspVerified publisher1.2.410 of 11See more

truenas-csp truenas-csp 1.2.4

10 of the 11 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
quay.io/hpestorage/csi-driver:v3.2.0ef7f4e1544fa
golang.org/x/net@v0.48.0
stdlib@go1.25.10
0.55.0
1.25.13
quay.io/hpestorage/csi-extensions:v1.2.1189146672a7ac
golang.org/x/net@v0.48.0
stdlib@go1.26.3
0.55.0
1.25.13
quay.io/hpestorage/volume-group-provisioner:v1.0.107bf9d8f16a5d
golang.org/x/net@v0.48.0
stdlib@go1.26.3
0.55.0
1.25.13
quay.io/hpestorage/volume-group-snapshotter:v1.0.10caeaaffe7e2b
golang.org/x/net@v0.48.0
stdlib@go1.26.3
0.55.0
1.25.13
quay.io/hpestorage/volume-mutator:v1.3.109e98b2e697bd
golang.org/x/net@v0.48.0
stdlib@go1.26.3
0.55.0
1.25.13
registry.k8s.io/sig-storage/csi-attacher:v4.12.0b9dc9a714a48
golang.org/x/net@v0.54.0
stdlib@go1.26.3
0.55.0
1.25.13
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0f9de845b1701
golang.org/x/net@v0.54.0
stdlib@go1.26.3
0.55.0
1.25.13
registry.k8s.io/sig-storage/csi-provisioner:v6.2.06be9f63ca4ca
golang.org/x/net@v0.51.0
stdlib@go1.25.7
0.55.0
1.25.13
registry.k8s.io/sig-storage/csi-resizer:v2.1.0589e525cddef
golang.org/x/net@v0.48.0
stdlib@go1.25.7
0.55.0
1.25.13
registry.k8s.io/sig-storage/csi-snapshotter:v8.5.0da081c27e8a6
golang.org/x/net@v0.49.0
stdlib@go1.25.7
0.55.0
1.25.13

Open the chart page →

6,027
uffizzi-controlleruffizzi-controller2.4.68 of 11See more

uffizzi-controller uffizzi-controller 2.4.6

8 of the 11 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
uffizzi/controller:latest0344805f267b
golang.org/x/net@v0.12.0
stdlib@go1.20.14
0.55.0
1.25.13
uffizzi/uffizzi-cluster-operator:v1.6.55ca448a08783
golang.org/x/net@v0.8.0
stdlib@go1.19.13
0.55.0
1.25.13
quay.io/jetstack/cert-manager-cainjector:v1.14.54ffda7facb4d
golang.org/x/net@v0.24.0
stdlib@go1.21.9
0.55.0
1.25.13
quay.io/jetstack/cert-manager-controller:v1.14.59c0527cab629
golang.org/x/net@v0.24.0
stdlib@go1.21.9
0.55.0
1.25.13
quay.io/jetstack/cert-manager-startupapicheck:v1.14.50f5b104bdd1b
golang.org/x/net@v0.24.0
stdlib@go1.21.9
0.55.0
1.25.13
quay.io/jetstack/cert-manager-webhook:v1.14.5ef419261a209
golang.org/x/net@v0.24.0
stdlib@go1.21.9
0.55.0
1.25.13
registry.k8s.io/ingress-nginx/controller:v1.10.1e24f39d3eed6
golang.org/x/net@v0.22.0
stdlib@go1.22.2
0.55.0
1.25.13
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.136d05b4077fb
golang.org/x/net@v0.22.0
stdlib@go1.22.2
0.55.0
1.25.13

Open the chart page →

14,356
filebrowserutkuozdemirVerified publisher1.0.01 of 1See more

filebrowser utkuozdemir 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.23.086e8449ff8ff
golang.org/x/net@v0.0.0-20220412020605-290c469a71a5
stdlib@go1.18.3
0.55.0
1.25.13

Open the chart page →

3,075
vsphere-csivsphere-tmm3.8.17 of 7See more

vsphere-csi vsphere-tmm 3.8.1

7 of the 7 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
registry.k8s.io/csi-vsphere/driver:v3.5.04bb8350a5a62
golang.org/x/net@v0.38.0
stdlib@go1.24.4
0.55.0
1.25.13
registry.k8s.io/csi-vsphere/syncer:v3.5.0bb88468fff2a
golang.org/x/net@v0.38.0
stdlib@go1.24.4
0.55.0
1.25.13
registry.k8s.io/sig-storage/csi-attacher:v4.8.169888dba5815
golang.org/x/net@v0.34.0
stdlib@go1.23.1
0.55.0
1.25.13
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.13.0d7138bcc3aa5
golang.org/x/net@v0.32.0
stdlib@go1.23.1
0.55.0
1.25.13
registry.k8s.io/sig-storage/csi-provisioner:v4.0.1bf5a235b67d8
golang.org/x/net@v0.19.0
stdlib@go1.21.5
0.55.0
1.25.13
registry.k8s.io/sig-storage/csi-resizer:v1.14.05e7cbb63fd49
golang.org/x/net@v0.39.0
stdlib@go1.24.2
0.55.0
1.25.13
registry.k8s.io/sig-storage/livenessprobe:v2.15.02c5f9dc4ea5a
golang.org/x/net@v0.32.0
stdlib@go1.23.1
0.55.0
1.25.13

Open the chart page →

3,960
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
golang.org/x/net@v0.0.0-20200202094626-16171245cfb2
stdlib@go1.14.12
0.55.0
1.25.13

Open the chart page →

6,181
aad-pod-identityaad-pod-identity4.1.182 of 2See more

aad-pod-identity aad-pod-identity 4.1.18

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
mcr.microsoft.com/oss/azure/aad-pod-identity/mic:v1.8.173004b93fcb74
golang.org/x/net@v0.7.0
stdlib@go1.19.10
0.55.0
1.25.13
mcr.microsoft.com/oss/azure/aad-pod-identity/nmi:v1.8.1777788bf38938
golang.org/x/net@v0.7.0
stdlib@go1.19.10
0.55.0
1.25.13

Open the chart page →

2,860
abcdesktopabcdesktopOfficialVerified publisher4.4.121 of 9See more

abcdesktop abcdesktop 4.4.12

1 of the 9 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ghcr.io/abcdesktopio/keysgenerator:4.4ca0662bc92a4
golang.org/x/net@v0.49.0
0.55.0

Open the chart page →

827
agonesagones1.60.01 of 5See more

agones agones 1.60.0

1 of the 5 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
alpine/kubectl:1.35.49ccd82364762
golang.org/x/net@v0.47.0
stdlib@go1.25.9
0.55.0
1.25.13

Open the chart page →

1,116
photoprismandrenarchyVerified publisher8.15.01 of 1See more

photoprism andrenarchy 8.15.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
photoprism/photoprism:260728958642220223
stdlib@go1.26.5
1.25.13

Open the chart page →

37,025
kubedbappscodeVerified publisher2026.7.107 of 8See more

kubedb appscode 2026.7.10

7 of the 8 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
golang.org/x/net@v0.38.0
stdlib@go1.24.13
0.55.0
1.25.13
ghcr.io/appscode/petset:v0.1.093fa0daf603c
golang.org/x/net@v0.47.0
stdlib@go1.25.10
0.55.0
1.25.13
ghcr.io/appscode/sidekick:v0.0.15d1036b07e348
golang.org/x/net@v0.47.0
stdlib@go1.25.11
0.55.0
1.25.13
ghcr.io/kubedb/kubedb-autoscaler:v0.51.05d1182ac21f0
stdlib@go1.25.12
1.25.13
ghcr.io/kubedb/kubedb-crd-manager:v0.21.09506a6cb98d1
stdlib@go1.25.12
1.25.13
ghcr.io/kubedb/kubedb-ops-manager:v0.53.06d4c9fe66e4f
stdlib@go1.25.12
1.25.13
ghcr.io/kubedb/kubedb-webhook-server:v0.42.0f7dcade6523b
stdlib@go1.25.12
1.25.13

Open the chart page →

4,489

Container images carrying it

5,282 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
stdlib@go1.19.8
1.25.13
1
opencsghq/csgbot:v0.6.9-ee7d0271e26521
stdlib@go1.24.4
1.25.13
1
opencsghq/csghub-portal:v2.5.0-ee1cb36b49151e
golang.org/x/net@v0.28.0
stdlib@go1.23.3
0.55.0
1.25.13
1
opencsghq/csghub-server:v2.5.0-ee587046575c2c
stdlib@go1.26.0
1.25.13
1
opencsghq/csghub-xnet:v2.5.0-ee86ea22f495c7
golang.org/x/net@v0.39.0
stdlib@go1.24.10
0.55.0
1.25.13
1
opencsghq/gitlab-gitaly:v17.5.0bdd2c58b9744
golang.org/x/net@v0.29.0
stdlib@go1.22.7
0.55.0
1.25.13
1
opencsghq/gitlab-shell:v19.2.580a65ac370da
golang.org/x/net@v0.48.0
stdlib@go1.26.4
0.55.0
1.25.13
1
opencsghq/kube-state-metrics:v2.19.15ea147562ec8
stdlib@go1.26.4
1.25.13
1
opencsghq/lws:v0.6.1de15437db41b
golang.org/x/net@v0.37.0
stdlib@go1.24.0
0.55.0
1.25.13
1
opencsghq/prometheus:v3.13.00aac0d04749e
stdlib@go1.26.4
1.25.13
1
opencsghq/prometheus-config-reloader:v0.92.144e6ec00729b
stdlib@go1.26.4
1.25.13
1
opendatacube/explorer:latest120457ffcd69
stdlib@go1.22.2
1.25.13
1
openebs/lvm-driver:1.10.141f73aba7f31
golang.org/x/net@v0.48.0
stdlib@go1.24.7
0.55.0
1.25.13
1
openebs/provisioner-nfs:0.11.04f41dd782761
golang.org/x/net@v0.10.0
stdlib@go1.19.13
0.55.0
1.25.13
1
openebs/zfs-driver:2.11.116f1a74bb249
stdlib@go1.26.2
1.25.13
1
openenergyprojects/modbus_exporter:20230617_a14455158990f24fb25
golang.org/x/net@v0.8.0
stdlib@go1.20.5
0.55.0
1.25.13
1
openfga/openfga:v1.18.036097b960f66
stdlib@go1.26.4
1.25.13
1
openfga/openfga:v1.9.25e94966c11df
golang.org/x/net@v0.40.0
stdlib@go1.24.5
0.55.0
1.25.13
1
openkruise/agent-sandbox-controller:v0.3.0e0a3bf7c0dc5
golang.org/x/net@v0.47.0
stdlib@go1.25.10
0.55.0
1.25.13
1
openkruise/kruise-game-manager:v1.1.0d3c6d69d2c39
golang.org/x/net@v0.43.0
stdlib@go1.23.4
0.55.0
1.25.13
1
openkruise/kruise-manager:v1.8.30482722b4e56
golang.org/x/net@v0.33.0
stdlib@go1.22.11
0.55.0
1.25.13
1
openkruise/kruise-manager:v1.9.1f81ae78a36a4
golang.org/x/net@v0.38.0
stdlib@go1.23.9
0.55.0
1.25.13
1
openkruise/kruise-rollout:v0.6.2a75e6739ea7d
golang.org/x/net@v0.7.0
stdlib@go1.19.13
0.55.0
1.25.13
1
openkruise/kruise-state-metrics:v0.2.0a8108f771287
golang.org/x/net@v0.8.0
stdlib@go1.18.10
0.55.0
1.25.13
1
openmined/syft-frontend:0.9.5d11524a3854a
stdlib@go1.20.5
1.25.13
1
openmined/syft-seaweedfs:0.9.53a4144c0bb82
golang.org/x/net@v0.21.0
stdlib@go1.22.1
0.55.0
1.25.13
1
opennms/sentinel:36.0.288869082a14f
golang.org/x/net@v0.29.0
stdlib@go1.22.2
0.55.0
1.25.13
1
openpolicyagent/gatekeeper:v3.17.1b7b4d7cfdd52
golang.org/x/net@v0.27.0
stdlib@go1.22.7
0.55.0
1.25.13
1
openpolicyagent/gatekeeper-crds:v3.17.177bc9bf3d163
golang.org/x/net@v0.23.0
stdlib@go1.22.5
0.55.0
1.25.13
1
openpolicyagent/kube-mgmt:11.0.123a8b1bacbcd8
stdlib@go1.25.0
1.25.13
1
openpolicyagent/opa:0.53.16a58dea59933
golang.org/x/net@v0.10.0
stdlib@go1.20.4
0.55.0
1.25.13
1
openpolicyagent/opa:1.19.0852359995443
stdlib@go1.26.5
1.25.13
1
openproject/community:12.0.2734743d11094
stdlib@go1.17
1.25.13
1
openruntimes/executor:0.11.42228f186dcbb
stdlib@go1.21.10
1.25.13
1
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
stdlib@go1.20.6
1.25.13
1
opensearchproject/opensearch-operator:3.0.0-alphaf78bbdd1a386
golang.org/x/net@v0.47.0
stdlib@go1.24.11
0.55.0
1.25.13
1
openvino/model_server:2025.2.11e7cd1d70cc1
golang.org/x/net@v0.38.0
stdlib@go1.24.4
0.55.0
1.25.13
1
opsgenie/kubernetes-event-exporter:0.9ecb246e4d260
golang.org/x/net@v0.0.0-20200520182314-0ba52f642ac2
stdlib@go1.14.7
0.55.0
1.25.13
1
optimizely/agent:4.0.09d0096cabd63
golang.org/x/net@v0.17.0
stdlib@go1.21.6
0.55.0
1.25.13
1
oranhack7/solidproject:77c6453942223f
stdlib@go1.21.7
1.25.13
1
orbitalreg/orbitalreg-api:0.1.045f2620337af
golang.org/x/net@v0.28.0
stdlib@go1.22.12
0.55.0
1.25.13
1
oryd/hydra:v2.3.0b94007e19a1f
golang.org/x/net@v0.33.0
stdlib@go1.23.4
0.55.0
1.25.13
1
oryd/hydra:v26.2.0ff67c7fb5f95
golang.org/x/net@v0.48.0
stdlib@go1.26.0
0.55.0
1.25.13
1
oryd/keto:v26.2.0bfdb8b9e283a
golang.org/x/net@v0.48.0
stdlib@go1.26.0
0.55.0
1.25.13
1
oryd/kratos:v26.2.02a13bb8d362c
golang.org/x/net@v0.48.0
stdlib@go1.26.0
0.55.0
1.25.13
1
oryd/kratos:v1.1.08f15006a080d
golang.org/x/net@v0.20.0
stdlib@go1.21.5
0.55.0
1.25.13
1
oryd/oathkeeper:v26.2.0467329abde34
golang.org/x/net@v0.48.0
stdlib@go1.26.0
0.55.0
1.25.13
1
oryd/oathkeeper-maester:v0.1.140942e9fe9b1a
golang.org/x/net@v0.53.0
stdlib@go1.26.3
0.55.0
1.25.13
1
otel/opentelemetry-collector:0.153.06ed874ea083d
stdlib@go1.26.3
1.25.13
1
otel/opentelemetry-collector:0.100.09e36620d6c2c
golang.org/x/net@v0.24.0
stdlib@go1.22.2
0.55.0
1.25.13
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.