StackRadar

CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.007
51st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,643
of 17,821 indexed, latest versions
Container images
5,380
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,643 of 17,821 indexed charts deploy, on 5,380 images.

Affected packageAffected versionsFixed inImages
git-lfsrpm2.13.3-3.el8_60:3.4.1-11.el8_101
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+193 more1.25.135,337
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more0.55.03,758
OSV records
RHSA-2026:30853GO-2026-5026

Charts affected

4,643 by stars
ChartLatestAffected imagesRadar Score
online-boutiquekubesphere-testVerified publisher0.1.08 of 11See more

online-boutique kubesphere-test 0.1.0

8 of the 11 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
gcr.io/google-samples/microservices-demo/cartservice:v0.2.3566733b4d2d5
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
stdlib@go1.15.6
0.55.0
1.25.13
gcr.io/google-samples/microservices-demo/checkoutservice:v0.2.30fad1066de77
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
stdlib@go1.15.10
0.55.0
1.25.13
gcr.io/google-samples/microservices-demo/currencyservice:v0.2.349d458a3650f
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
stdlib@go1.15.6
0.55.0
1.25.13
gcr.io/google-samples/microservices-demo/frontend:v0.2.3ca5c0f0771c8
golang.org/x/net@v0.0.0-20190628185345-da137c7871d7
stdlib@go1.15.10
0.55.0
1.25.13
gcr.io/google-samples/microservices-demo/paymentservice:v0.2.36eb201217a8f
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
stdlib@go1.15.6
0.55.0
1.25.13
gcr.io/google-samples/microservices-demo/productcatalogservice:v0.2.35a4a0e54c6d0
golang.org/x/net@v0.0.0-20190628185345-da137c7871d7
stdlib@go1.15.10
0.55.0
1.25.13
gcr.io/google-samples/microservices-demo/recommendationservice:v0.2.35f60c4988859
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
stdlib@go1.15.6
0.55.0
1.25.13
gcr.io/google-samples/microservices-demo/shippingservice:v0.2.30cb1707fc503
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
stdlib@go1.15.6
0.55.0
1.25.13

Open the chart page →

25,927
openelbkubesphere-testVerified publisher0.2.42 of 2See more

openelb kubesphere-test 0.2.4

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kubesphere/openelb:v0.4.4ed7311a0f9e4
golang.org/x/net@v0.0.0-20200528225125-3c3fba18258b
stdlib@go1.15.15
0.55.0
1.25.13
kubespheredev/kube-webhook-certgen:v1.1.123a03c9c381f
golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023
stdlib@go1.16.9
0.55.0
1.25.13

Open the chart page →

4,339
porterkubesphere-testVerified publisher0.2.21 of 2See more

porter kubesphere-test 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kubesphere/porter:v0.4.38d1ed5ee1d2e
golang.org/x/net@v0.0.0-20200528225125-3c3fba18258b
stdlib@go1.15.15
0.55.0
1.25.13

Open the chart page →

2,793
snapshot-controllerkubesphere-testVerified publisher0.2.01 of 1See more

snapshot-controller kubesphere-test 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
csiplugin/snapshot-controller:v4.0.000fcc441ea9f
golang.org/x/net@v0.0.0-20201209123823-ac852fbbde11
stdlib@go1.15
0.55.0
1.25.13

Open the chart page →

2,221
kubestellar-consolekubestellar-consoleVerified publisher0.3.422 of 2See more

kubestellar-console kubestellar-console 0.3.42

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
alpine/k8s:1.32.47e1e7d5b7a96
golang.org/x/net@v0.34.0
stdlib@go1.20.4
0.55.0
1.25.13
ghcr.io/kubestellar/console:v0.3.4289610ec0cbda
golang.org/x/net@v0.23.0
stdlib@go1.26.3
0.55.0
1.25.13

Open the chart page →

4,393
kubestellar-uikubestellaruiVerified publisher0.1.12 of 4See more

kubestellar-ui kubestellarui 0.1.1

2 of the 4 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
library/redis:7.0-alpinec9d92d840fd0
stdlib@go1.18.2
1.25.13
mavrick1/kubestellar-b:latest45ca0429a1d4
golang.org/x/net@v0.26.0
stdlib@go1.20.3
0.55.0
1.25.13

Open the chart page →

5,072
terraform-controllerkubevela0.8.01 of 1See more

terraform-controller kubevela 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
oamdev/terraform-controller:v0.8.070447f4d360a
golang.org/x/net@v0.0.0-20210614182718-04defd469f4e
stdlib@go1.16.4
0.55.0
1.25.13

Open the chart page →

3,820
vector-controllerkubevela0.2.32 of 2See more

vector-controller kubevela 0.2.3

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
oamdev/kube-webhook-certgen:v2.4.1231c423c2b17
golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781
stdlib@go1.17.11
0.55.0
1.25.13
oamdev/vector-controller:v0.2.39dd8be44ffc9
golang.org/x/net@v0.0.0-20210825183410-e898025ed96a
stdlib@go1.17.13
0.55.0
1.25.13

Open the chart page →

4,820
vela-prismkubevela1.6.03 of 3See more

vela-prism kubevela 1.6.0

3 of the 3 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
oamdev/cluster-gateway:v1.4.0dc97164c4c1f
golang.org/x/net@v0.0.0-20211209124913-491a49abca63
stdlib@go1.17.10
0.55.0
1.25.13
oamdev/kube-webhook-certgen:v2.331e0892f3583
golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781
stdlib@go1.16.9
0.55.0
1.25.13
oamdev/vela-prism:v1.6.06db6a937647d
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
stdlib@go1.19.3
0.55.0
1.25.13

Open the chart page →

6,107
vela-workflowkubevela0.7.21 of 1See more

vela-workflow kubevela 0.7.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
oamdev/kube-webhook-certgen:v2.4.1231c423c2b17
golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781
stdlib@go1.17.11
0.55.0
1.25.13

Open the chart page →

1,435
forkliftkubevirt-forkliftVerified publisher0.3.01 of 2See more

forklift kubevirt-forklift 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
quay.io/kubev2v/forklift-operator:release-2.1268657c36c086
stdlib@go1.26.3
1.25.13

Open the chart page →

1,462
kube-wordpress-mysqlkube-wordpress-mysql0.1.01 of 2See more

kube-wordpress-mysql kube-wordpress-mysql 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
stdlib@go1.18.2
1.25.13

Open the chart page →

8,944
kube-workload-restarterkube-workload-restarterVerified publisher0.0.41 of 1See more

kube-workload-restarter kube-workload-restarter 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
andreacioni/kube-workload-restarter:0.0.242938b310090a
golang.org/x/net@v0.7.0
stdlib@go1.20.2
0.55.0
1.25.13

Open the chart page →

1,816
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.48 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

8 of the 9 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
grafana/alloy:v1.5.101a63f4e032c
golang.org/x/net@v0.31.0
stdlib@go1.22.7
0.55.0
1.25.13
ghcr.io/jimmidyson/configmap-reload:v0.12.0a7c754986900
stdlib@go1.21.1
1.25.13
ghcr.io/kubiyabot/agent-manager:v0.4.13757bdd779345
golang.org/x/net@v0.39.0
stdlib@go1.23.12
0.55.0
1.25.13
ghcr.io/kubiyabot/kubernetes:1.32.0b5ade0d9cc6b
golang.org/x/net@v0.30.0
stdlib@go1.22.10
0.55.0
1.25.13
ghcr.io/kubiyabot/kubiya-operator:runner_v26bf945565865
golang.org/x/net@v0.28.0
stdlib@go1.25.1
0.55.0
1.25.13
ghcr.io/kubiyabot/tool-manager:0.5.80cca6760763a
golang.org/x/net@v0.42.0
stdlib@go1.21.5
0.55.0
1.25.13
ghcr.io/kubiyabot/workflow-engine:v1.46.2560a16a56d4e
golang.org/x/net@v0.39.0
stdlib@go1.23.12
0.55.0
1.25.13
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.037d841299325
golang.org/x/net@v0.29.0
stdlib@go1.23.3
0.55.0
1.25.13

Open the chart page →

20,417
lethe-stackkuossOfficialVerified publisher0.2.32 of 3See more

lethe-stack kuoss 0.2.3

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ghcr.io/kuoss/eventrouter:v0.4.1300b48beff3ae
golang.org/x/net@v0.38.0
stdlib@go1.23.12
0.55.0
1.25.13
ghcr.io/kuoss/lethe:v0.3.1c59f082ba8b2
golang.org/x/net@v0.41.0
stdlib@go1.23.12
0.55.0
1.25.13

Open the chart page →

1,762
ctrlmeshkusionstackVerified publisher0.2.01 of 1See more

ctrlmesh kusionstack 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kusionstack/ctrlmesh-manager:v0.2.065e3c32b64d7
golang.org/x/net@v0.17.0
stdlib@go1.20.14
0.55.0
1.25.13

Open the chart page →

3,489
kuperatorkusionstackVerified publisher0.7.41 of 1See more

kuperator kusionstack 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kusionstack/kuperator:v0.7.4d2f72ae1d2f2
golang.org/x/net@v0.28.0
stdlib@go1.24.13
0.55.0
1.25.13

Open the chart page →

980
kusionkusionstackVerified publisher0.14.12 of 3See more

kusion kusionstack 0.14.1

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kusionstack/kusion:v0.14.0126c8f0b0976
golang.org/x/net@v0.31.0
stdlib@go1.22.10
0.55.0
1.25.13
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.13

Open the chart page →

63,783
operatingkusionstackVerified publisher0.5.11 of 1See more

operating kusionstack 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kusionstack/operating:v0.5.0c28bd96b986b
golang.org/x/net@v0.17.0
stdlib@go1.19.13
0.55.0
1.25.13

Open the chart page →

1,882
sample-operatorkusionstackVerified publisher0.1.21 of 1See more

sample-operator kusionstack 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
chaerr/kridge:demo-operator-v0.1.266833deec017
golang.org/x/net@v0.7.0
stdlib@go1.20.7
0.55.0
1.25.13

Open the chart page →

2,524
azure-key-vault-helperkvalitetsitVerified publisher2.0.21 of 1See more

azure-key-vault-helper kvalitetsit 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kvalitetsit/go-loop:1.1.0d07f449d75ed
stdlib@go1.25.1
1.25.13

Open the chart page →

307
dynatrace-operatorkvalitetsitVerified publisher1.3.01 of 1See more

dynatrace-operator kvalitetsit 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
public.ecr.aws/dynatrace/dynatrace-operator:v1.3.0f68901a54664
golang.org/x/net@v0.28.0
stdlib@go1.22.5
0.55.0
1.25.13

Open the chart page →

1,320
kitarguskvalitetsitVerified publisher0.0.0-2026-03-09-091234-10013c41 of 1See more

kitargus kvalitetsit 0.0.0-2026-03-09-091234-10013c4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kvalitetsit/kitargus:2026-03-09-091234-10013c4c5cde2d9371c
golang.org/x/net@v0.49.0
stdlib@go1.25.8
0.55.0
1.25.13

Open the chart page →

962
krakendkvalitetsitVerified publisher0.0.31 of 1See more

krakend kvalitetsit 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
devopsfaith/krakend:latestf8bdaa8a1a43
golang.org/x/net@v0.36.0
stdlib@go1.24.2
0.55.0
1.25.13

Open the chart page →

1,519
longhornkvalitetsitVerified publisher1.1.1-01 of 2See more

longhorn kvalitetsit 1.1.1-0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.1.1ede61fe2a472
golang.org/x/net@v0.0.0-20200707034311-ab3426394381
stdlib@go1.14.1
0.55.0
1.25.13

Open the chart page →

16,735
metadockvalitetsitVerified publisher0.0.72 of 2See more

metadoc kvalitetsit 0.0.7

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kvalitetsit/metadoc-app:maine89e351733ad
golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023
stdlib@go1.19.5
0.55.0
1.25.13
kvalitetsit/metadoc-web:mainf57e7553f5bd
golang.org/x/net@v0.0.0-20210316092652-d523dce5a7f4
stdlib@go1.16
0.55.0
1.25.13

Open the chart page →

4,036
myra-cert-manager-webhookkvalitetsitVerified publisher1.2.11 of 1See more

myra-cert-manager-webhook kvalitetsit 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kvalitetsit/myra-cert-manager-webhook:1.2.184ab59a1434e
stdlib@go1.26.4
1.25.13

Open the chart page →

178
nsp-prometheus-exporterkvalitetsitVerified publisher1.0.191 of 2See more

nsp-prometheus-exporter kvalitetsit 1.0.19

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kvalitetsit/nsp-prometheus-exporter:1.0.190b397ff954ec
stdlib@go1.15.3
1.25.13

Open the chart page →

2,064
oauth2-proxy-injectorkvalitetsitVerified publisher1.5.01 of 1See more

oauth2-proxy-injector kvalitetsit 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kvalitetsit/oauth2-proxy-injector:1.5.00c906908d632
golang.org/x/net@v0.49.0
stdlib@go1.26.3
0.55.0
1.25.13

Open the chart page →

301
openidkvalitetsitVerified publisher1.7.21 of 2See more

openid kvalitetsit 1.7.2

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
quay.io/oauth2-proxy/oauth2-proxy:v7.14.368336da945bd
golang.org/x/net@v0.49.0
stdlib@go1.25.7
0.55.0
1.25.13

Open the chart page →

592
stakitkvalitetsitVerified publisher0.3.111 of 3See more

stakit kvalitetsit 0.3.11

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kvalitetsit/stakit-frontend:0.2.5fd5c4f60ef80
golang.org/x/net@v0.0.0-20180906233101-161cd47e91fd
stdlib@go1.19.3
0.55.0
1.25.13

Open the chart page →

7,864
stakit-adapter-alertmanagerkvalitetsitVerified publisher0.2.61 of 1See more

stakit-adapter-alertmanager kvalitetsit 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kvalitetsit/stakit-adapter-alertmanager:0.2.6838db1e90c6b
stdlib@go1.26.5
1.25.13

Open the chart page →

85
kvkkvkservice0.1.01 of 4See more

kvk kvkservice 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
conduction/kvk-php:dev8f177f9f8a7b
golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9
stdlib@go1.13.10
0.55.0
1.25.13

Open the chart page →

8,546
ladeitladeit0.4.01 of 2See more

ladeit ladeit 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
kubeoperator/webkubectl:v2.4.0be8f0d624640
golang.org/x/net@v0.0.0-20200519113804-d87ec0cfa476
stdlib@go1.14
0.55.0
1.25.13

Open the chart page →

26,563
lagoon-docker-hostlagoon-chartsVerified publisher0.7.01 of 1See more

lagoon-docker-host lagoon-charts 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
uselagoon/docker-host:v3.6.12c89ed939b8b
golang.org/x/net@v0.39.0
stdlib@go1.24.3
0.55.0
1.25.13

Open the chart page →

2,281
everest-lakefs-csi-driverlakefsVerified publisher1.3.03 of 3See more

everest-lakefs-csi-driver lakefs 1.3.0

3 of the 3 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
treeverse/everest-lakefs-csi-driver:1.3.0bda61b3fe5d8
stdlib@go1.26.5
1.25.13
public.ecr.aws/csi-components/csi-node-driver-registrar:v2.16.0-eksbuild.3592d7034d6c7
golang.org/x/net@v0.49.0
stdlib@go1.26.1
0.55.0
1.25.13
public.ecr.aws/csi-components/livenessprobe:v2.18.0-eksbuild.38e307f4e5820
golang.org/x/net@v0.49.0
stdlib@go1.26.1
0.55.0
1.25.13

Open the chart page →

866
lambdapinglambdaping1.0.41 of 1See more

lambdaping lambdaping 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
udhos/lambdaping:1.0.46bd2cf2ac732
golang.org/x/net@v0.33.0
stdlib@go1.23.4
0.55.0
1.25.13

Open the chart page →

1,347
pageslatif-pages1.0.01 of 3See more

pages latif-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.13

Open the chart page →

20,287
cachelavaOfficialVerified publisher1.1.11 of 1See more

cache lava 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ghcr.io/lavanet/lava/lavap:v2.5.089028adefcff
golang.org/x/net@v0.23.0
stdlib@go1.20.14
0.55.0
1.25.13

Open the chart page →

1,386
pageslavanya-pages1.0.01 of 3See more

pages lavanya-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.13

Open the chart page →

20,287
express-botxlavr0.31.41 of 1See more

express-botx lavr 0.31.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
lavr/express-botx:0.39.0-rootlessf5035e0f1434
golang.org/x/net@v0.38.0
0.55.0

Open the chart page →

294
kubernetes-dashboardlbenicio-communityVerified publisher7.14.94 of 5See more

kubernetes-dashboard lbenicio-community 7.14.9

4 of the 5 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
lbenicio/kubernetes-dashboard-api:1.14.951d3d30206c8
golang.org/x/net@v0.46.0
stdlib@go1.25.11
0.55.0
1.25.13
lbenicio/kubernetes-dashboard-auth:1.4.1378c63efd9dcd
golang.org/x/net@v0.46.0
stdlib@go1.25.11
0.55.0
1.25.13
lbenicio/kubernetes-dashboard-scraper:1.2.69202e96ad403
golang.org/x/net@v0.46.0
stdlib@go1.25.11
0.55.0
1.25.13
lbenicio/kubernetes-dashboard-web:1.7.142797937bc2a5
golang.org/x/net@v0.46.0
stdlib@go1.25.11
0.55.0
1.25.13

Open the chart page →

1,945
listmonklbenicio-communityVerified publisher0.1.01 of 1See more

listmonk lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
listmonk/listmonk:latestf535d59e1499
golang.org/x/net@v0.47.0
stdlib@go1.26.1
0.55.0
1.25.13

Open the chart page →

720
pinglbenicio-communityVerified publisher0.1.11 of 1See more

ping lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
quay.io/prometheus/blackbox-exporter:v0.28.0e753ff9f3fc4
golang.org/x/net@v0.47.0
stdlib@go1.25.5
0.55.0
1.25.13

Open the chart page →

600
speedtestlbenicio-communityVerified publisher0.1.01 of 1See more

speedtest lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
ghcr.io/d0ugal/internet-perf-exporter:v0.2.91f5c9a96fe52a
stdlib@go1.26.4
1.25.13

Open the chart page →

307
uptime-kumalbenicio-communityVerified publisher0.1.11 of 1See more

uptime-kuma lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
golang.org/x/net@v0.40.0
stdlib@go1.20.5
0.55.0
1.25.13

Open the chart page →

33,946
whoamilbenicio-communityVerified publisher0.1.21 of 1See more

whoami lbenicio-community 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
traefik/whoami:latestc4717a8d1f01
stdlib@go1.26.5
1.25.13

Open the chart page →

93
metallblectures-k8sinfra0.10.22 of 2See more

metallb lectures-k8sinfra 0.10.2

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
quay.io/metallb/controller:v0.10.221164241c045
golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110
stdlib@go1.16.5
0.55.0
1.25.13
quay.io/metallb/speaker:v0.10.258cb99053bb3
golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110
stdlib@go1.16.5
0.55.0
1.25.13

Open the chart page →

5,408
prometheuslectures-k8sinfra15.8.55 of 6See more

prometheus lectures-k8sinfra 15.8.5

5 of the 6 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
jimmidyson/configmap-reload:v0.5.0904d08e9f701
stdlib@go1.15.7
1.25.13
prom/pushgateway:v1.4.2a684e7c830a4
golang.org/x/net@v0.0.0-20210525063256-abc453219eb5
stdlib@go1.16.9
0.55.0
1.25.13
quay.io/prometheus/alertmanager:v0.23.09ab73a421b65
golang.org/x/net@v0.0.0-20210726213435-c6fcb2dbf985
stdlib@go1.16.7
0.55.0
1.25.13
quay.io/prometheus/node-exporter:v1.3.023ff46c728b9
golang.org/x/net@v0.0.0-20210525063256-abc453219eb5
stdlib@go1.17.3
0.55.0
1.25.13
quay.io/prometheus/prometheus:v2.37.056e7f18e05dd
golang.org/x/net@v0.0.0-20220624214902-1bab6f366d9e
stdlib@go1.18.4
0.55.0
1.25.13

Open the chart page →

9,115
grafanaleechistest5.3.01 of 1See more

grafana leechistest 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container imageDigestPackageFixed in
grafana/grafana:7.0.3d72946c8e5d5
golang.org/x/net@v0.0.0-20200202094626-16171245cfb2
stdlib@go1.14.3
0.55.0
1.25.13

Open the chart page →

3,200

Container images carrying it

5,380 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
pravega/zookeeper-operator:0.2.15b2bc4042fdd8
golang.org/x/net@v0.7.0
stdlib@go1.19.7
0.55.0
1.25.13
1
pritunl/pritunl-zero:1.0.3648.460f2943e0d41b
golang.org/x/net@v0.42.0
stdlib@go1.25.4
0.55.0
1.25.13
1
probely/farcaster-onprem-agent:v3741b34e8166f
stdlib@go1.26.5
1.25.13
1
prodrigestivill/postgres-backup-local:12-alpine-8d72d2d6ed2afadc326
stdlib@go1.16
1.25.13
1
prodrigestivill/postgres-backup-local:latestf70742ebe42b
stdlib@go1.22.6
1.25.13
1
projecthami/volcano-vgpu-device-plugin:v1.9.40c94118d1d98
golang.org/x/net@v0.0.0-20200421231249-e086a090c8fd
stdlib@go1.19.3
0.55.0
1.25.13
1
prom/blackbox-exporter:v0.22.0608acee5704a
golang.org/x/net@v0.0.0-20220728211354-c7608f3a8462
stdlib@go1.18.5
0.55.0
1.25.13
1
prom/blackbox-exporter:v0.25.0b04a9fef4fa0
golang.org/x/net@v0.24.0
stdlib@go1.22.2
0.55.0
1.25.13
1
prom/blackbox-exporter:v0.23.0ca04aa9d9093
golang.org/x/net@v0.2.0
stdlib@go1.19.3
0.55.0
1.25.13
1
prom/consul-exporter:v0.13.04e4cfd809e96
golang.org/x/net@v0.29.0
stdlib@go1.23.2
0.55.0
1.25.13
1
prometheuscommunity/elasticsearch-exporter:v1.3.0fe735268fbdc
stdlib@go1.16.9
1.25.13
1
prometheuscommunity/postgres-exporter:v0.17.0f8381eb4326a
golang.org/x/net@v0.33.0
stdlib@go1.23.6
0.55.0
1.25.13
1
prometheuscommunity/stackdriver-exporter:v0.19.0c0a0cbf76570
stdlib@go1.26.4
1.25.13
1
prom/graphite-exporter:v0.16.0e54bca6645ea
golang.org/x/net@v0.30.0
stdlib@go1.23.2
0.55.0
1.25.13
1
prom/influxdb-exporter:v0.11.427e33e18634a
stdlib@go1.19.9
1.25.13
1
prom/influxdb-exporter:v0.9.0f63fd77c05ee
stdlib@go1.17.8
1.25.13
1
prom/memcached-exporter:v0.9.001267317c95d
golang.org/x/net@v0.0.0-20200625001655-4c5254603344
stdlib@go1.16.2
0.55.0
1.25.13
1
prom/memcached-exporter:v0.15.592a6ad5a3d3e
golang.org/x/net@v0.47.0
stdlib@go1.25.6
0.55.0
1.25.13
1
prom/memcached-exporter:v0.15.0bb01ad25e9fc
golang.org/x/net@v0.29.0
stdlib@go1.23.3
0.55.0
1.25.13
1
prom/node-exporter:v1.10.23ac34ce007ac
golang.org/x/net@v0.44.0
stdlib@go1.25.3
0.55.0
1.25.13
1
prom/node-exporter:v1.6.0d2e48098c364
golang.org/x/net@v0.10.0
stdlib@go1.20.4
0.55.0
1.25.13
1
prom/prometheus:v2.51.24f6c47e39a90
golang.org/x/net@v0.22.0
stdlib@go1.22.2
0.55.0
1.25.13
1
prom/prometheus:v2.18.15880ec936055
golang.org/x/net@v0.0.0-20200421231249-e086a090c8fd
stdlib@go1.14.2
0.55.0
1.25.13
1
prom/prometheus:v3.12.069f524141883
stdlib@go1.26.3
1.25.13
1
prom/prometheus:v2.48.0b440bc0e8aa5
golang.org/x/net@v0.17.0
stdlib@go1.21.4
0.55.0
1.25.13
1
prom/prometheus:v2.19.2cd134bd4fca0
golang.org/x/net@v0.0.0-20200602114024-627f9648deb9
stdlib@go1.14.4
0.55.0
1.25.13
1
prom/prometheus:v3.8.0d936808bdea5
golang.org/x/net@v0.46.0
stdlib@go1.25.4
0.55.0
1.25.13
1
prom/prometheus:v2.22.2f7ffebdd428b
golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0
stdlib@go1.15.5
0.55.0
1.25.13
1
prom/promlens:v0.4.04a377d1a0eaa
stdlib@go1.26.5
1.25.13
1
prom/pushgateway:v1.5.128fe26c8b8b1
golang.org/x/net@v0.0.0-20220909164309-bea034e7d591
stdlib@go1.19.3
0.55.0
1.25.13
1
prom/pushgateway:v1.4.33496e0f85943
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
stdlib@go1.18.2
0.55.0
1.25.13
1
prom/snmp-exporter:v0.20.09d226d7de223
golang.org/x/net@v0.0.0-20200625001655-4c5254603344
stdlib@go1.15.8
0.55.0
1.25.13
1
prom/statsd-exporter:v0.24.061d866e93b56
golang.org/x/net@v0.10.0
stdlib@go1.19.9
0.55.0
1.25.13
1
prom/statsd-exporter:v0.29.0632f70580492
golang.org/x/net@v0.48.0
stdlib@go1.26.0
0.55.0
1.25.13
1
prom/statsd-exporter:v0.22.48be660470961
stdlib@go1.17.3
1.25.13
1
promzeus/redis-sentinel-gateway:v182f6d56e280b
golang.org/x/net@v0.26.0
stdlib@go1.22.6
0.55.0
1.25.13
1
prowlercloud/prowler-api:5.31.14f252d579be2
golang.org/x/net@v0.54.0
stdlib@go1.26.3-X:jsonv2
0.55.0
1.25.13
1
pschiffe/pdns-admin:0.4.137ebba8c2b8f
stdlib@go1.21.5
1.25.13
1
pschiffe/pdns-mysql:alpined196c796cafb
stdlib@go1.21.5
1.25.13
1
pschiffe/pdns-pgsql:5.0a227d41bc665
stdlib@go1.21.5
1.25.13
1
pubeldev/prusa_exporter:2.0.01091665a020a
stdlib@go1.25.5
1.25.13
1
pulumi/pulumi-kubernetes-operator:v2.5.17dace4491358
golang.org/x/net@v0.49.0
stdlib@go1.24.13
0.55.0
1.25.13
1
pysga1996/redis:latest3af6d0c7db19
stdlib@go1.18.2
1.25.13
1
qichenxu4pd/mysqlweb:1.2d758d41d9c6b
stdlib@go1.18.2
1.25.13
1
qmcgaw/gluetun:v3.41.11a5bf4b4820a
golang.org/x/net@v0.47.0
stdlib@go1.25.7
0.55.0
1.25.13
1
qmcgaw/gluetun:v3.40.02b42bfa04675
golang.org/x/net@v0.31.0
stdlib@go1.23.4
0.55.0
1.25.13
1
qonstrukt/php:8.4-v8-apache089af7925aa1
golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e
stdlib@go1.26.4
0.55.0
1.25.13
1
qoveryrd/digital-mobius:0.1.4b30a9398a83c
golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7
stdlib@go1.15.5
0.55.0
1.25.13
1
qualys/qscanner:5.1.0-59ff255352422
stdlib@go1.26.5-X:jsonv2
1.25.13
1
quiq/docker-registry-ui:0.9.491281da47036
golang.org/x/net@v0.0.0-20211015210444-4f30a5c0130f
stdlib@go1.18
0.55.0
1.25.13
1

syft 1.42.1 · advisories as of 21 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.