CVE-2026-39822

Unscored

Advisory

Published 7 Jul 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.002; 7th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,510; of 17,926 indexed, latest versions
Container images: 5,123; deployed by those charts
Fix available: 1 of 1; affected package

Root escape via symlink plus trailing slash in os

Carried by container images the latest versions of 4,510 of 17,926 indexed charts deploy, on 5,123 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+191 more	1.25.12	5,123

OSV records: GO-2026-4970
Also known as: BIT-golang-2026-39822

Charts affected

4,510 by stars

Chart

Latest

Affected images

Radar Score

gnp-stackgnp-stack

0.0.5

11 of 14 See more

gnp-stack gnp-stack 0.0.5

11 of the 14 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
grafana/grafana :12.2.1	35c41e0fd029	stdlib@go1.25.3	1.25.12
library/nats :2.12.1-alpine	b3f2bd84176a	stdlib@go1.25.3	1.25.12
natsio/nats-box :0.19.2	8031d190c7ee	stdlib@go1.25.2	1.25.12
natsio/nats-server-config-reloader :0.20.1	47094fcae2f4	stdlib@go1.24.8	1.25.12
natsio/prometheus-nats-exporter :0.17.3	26c826662ac8	stdlib@go1.24.2	1.25.12
rancher/local-path-provisioner :v0.0.32	9289da488b07	stdlib@go1.24.4	1.25.12
ghcr.io/openconfig/gnmic :0.45.0	d422a9ebd4a2	stdlib@go1.24.12	1.25.12
quay.io/prometheus-operator/prometheus-operator :v0.85.0	890b3bb05cf4	stdlib@go1.24.6	1.25.12
quay.io/prometheus/node-exporter :v1.9.1	d00a542e409e	stdlib@go1.23.7	1.25.12
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.6.3	3d671cf20a35	stdlib@go1.25.1	1.25.12
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.17.0	2bbc91556733	stdlib@go1.24.6	1.25.12

Open the chart page →

13,639

go-app-helmgo-app-helm

0.1.0

1 of 1 See more

go-app-helm go-app-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
manojchaulagain/go-k8s :0.1.0	f237b5f637ae	stdlib@go1.20.1	1.25.12

Open the chart page →

1,976

go-file-servergo-file-server

1.0.0

1 of 2 See more

go-file-server go-file-server 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
goccx/go-file-server :latest	f4b3ebea0303	stdlib@go1.21.10	1.25.12

Open the chart page →

2,268

gofitgofit

0.0.1

1 of 1 See more

gofit gofit 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/bamaas/gofit :0.0.1	32b6a174b419	stdlib@go1.22.11	1.25.12

Open the chart page →

643

googly-logingoogly-login

0.1.0

1 of 2 See more

googly-login googly-login 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/postgres :16	a3b7f434b2dc	stdlib@go1.24.6	1.25.12

Open the chart page →

1,316

gorsegorse-io

0.4.2

3 of 4 See more

gorse gorse-io 0.4.2

3 of the 4 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
zhenghaoz/gorse-master :0.4.12	033046b432ec	stdlib@go1.20.1	1.25.12
zhenghaoz/gorse-server :0.4.12	39c565685b01	stdlib@go1.20.1	1.25.12
zhenghaoz/gorse-worker :0.4.12	f7739f64c9b0	stdlib@go1.20.1	1.25.12

Open the chart page →

4,440

gotwaygotway

0.8.0

1 of 1 See more

gotway gotway 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/gotway/gotway :v0.0.13	7ed73c1979ee	stdlib@go1.18.3	1.25.12

Open the chart page →

1,831

Governify-Bluejaygovernify

0.1.0

2 of 12 See more

Governify-Bluejay governify 0.1.0

2 of the 12 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
governify/dashboard :latest	e83a17ba5038	stdlib@go1.17	1.25.12
library/mongo :latest	5d7043a4ffe0	stdlib@go1.24.6	1.25.12

Open the chart page →

22,167

Governify-Falcongovernify

0.1.0

2 of 10 See more

Governify-Falcon governify 0.1.0

2 of the 10 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
governify/dashboard :latest	e83a17ba5038	stdlib@go1.17	1.25.12
library/mongo :latest	5d7043a4ffe0	stdlib@go1.24.6	1.25.12

Open the chart page →

24,385

goweeklygoweekly

2.0.0

1 of 1 See more

goweekly goweekly 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
zufardhiyaulhaq/goweekly :v2.0.0	08dcc130fbea	stdlib@go1.17.12	1.25.12

Open the chart page →

1,233

harborgpg-dev

1.18.3

5 of 8 See more

harbor gpg-dev 1.18.3

5 of the 8 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :v2.14.3	a30e5a8be3d9	stdlib@go1.24.13	1.25.12
goharbor/harbor-jobservice :v2.14.3	e2b0298e894d	stdlib@go1.24.13	1.25.12
goharbor/harbor-registryctl :v2.14.3	ddf6bb429eb6	stdlib@go1.24.13	1.25.12
goharbor/registry-photon :v2.14.3	6533fc396cbc	stdlib@go1.24.13	1.25.12
goharbor/trivy-adapter-photon :v2.14.3	5c6f7162804c	stdlib@go1.25.7	1.25.12

Open the chart page →

3,492

ingress-nginxgpg-dev

4.9.0

2 of 2 See more

ingress-nginx gpg-dev 4.9.0

2 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/controller :v1.9.5	b3aba22b1da8	stdlib@go1.21.5	1.25.12
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20231011-8b53cabe0	a7943503b45d	stdlib@go1.21.3	1.25.12

Open the chart page →

2,322

jaegergpg-dev

3.3.3

4 of 5 See more

jaeger gpg-dev 3.3.3

4 of the 5 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-agent :1.53.0	0214a0ef24b1	stdlib@go1.21.5	1.25.12
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	stdlib@go1.18.2	1.25.12
jaegertracing/jaeger-collector :1.53.0	7f1269222903	stdlib@go1.21.5	1.25.12
jaegertracing/jaeger-query :1.53.0	049bb0d64ea3	stdlib@go1.21.5	1.25.12

Open the chart page →

19,806

kube-prometheus-stackgpg-dev

84.0.0

5 of 6 See more

kube-prometheus-stack gpg-dev 84.0.0

5 of the 6 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
grafana/grafana :13.0.1	0f86bada30d6	stdlib@go1.26.0	1.25.12
ghcr.io/jkroepke/kube-webhook-certgen :1.8.1	4f6da0256b1b	stdlib@go1.26.2	1.25.12
quay.io/prometheus-operator/prometheus-operator :v0.90.1	52a6a92d915e	stdlib@go1.25.8	1.25.12
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	stdlib@go1.26.1	1.25.12
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	stdlib@go1.25.5	1.25.12

Open the chart page →

4,408

kubernetes-dashboardgpg-dev

7.5.0

4 of 5 See more

kubernetes-dashboard gpg-dev 7.5.0

4 of the 5 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
kubernetesui/dashboard-api :1.7.0	60595892c2cf	stdlib@go1.22.3	1.25.12
kubernetesui/dashboard-auth :1.1.3	07135c09e9ff	stdlib@go1.22.2	1.25.12
kubernetesui/dashboard-metrics-scraper :1.1.1	7747d363c9fe	stdlib@go1.22.1	1.25.12
kubernetesui/dashboard-web :1.4.0	4445b31a2c25	stdlib@go1.22.3	1.25.12

Open the chart page →

6,226

metrics-servergpg-dev

3.12.1

1 of 1 See more

metrics-server gpg-dev 3.12.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
registry.k8s.io/metrics-server/metrics-server :v0.7.1	db3800085a09	stdlib@go1.21.8	1.25.12

Open the chart page →

1,087

opentelemetry-demogpg-dev

0.33.8

8 of 27 See more

opentelemetry-demo gpg-dev 0.33.8

8 of the 27 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
grafana/grafana :11.3.1	fa801ab6e1ae	stdlib@go1.23.1	1.25.12
jaegertracing/all-in-one :1.53.0	60e65bfffe1f	stdlib@go1.21.5	1.25.12
otel/opentelemetry-collector-contrib :0.114.0	37fa87091cfa	stdlib@go1.23.3	1.25.12
ghcr.io/open-feature/flagd :v0.11.1	a7ea52f87446	stdlib@go1.22.5	1.25.12
ghcr.io/open-telemetry/demo :1.12.0-productcatalogservice	008b9b662289	stdlib@go1.22.8	1.25.12
ghcr.io/open-telemetry/demo :1.12.0-checkoutservice	380eccdc29e9	stdlib@go1.22.8	1.25.12
ghcr.io/open-telemetry/demo :1.12.0-shippingservice	a3ca4c02a5df	stdlib@go1.21.5	1.25.12
quay.io/prometheus/prometheus :v3.0.0	3b9b2a15d376	stdlib@go1.23.3	1.25.12

Open the chart page →

51,670

prometheusgpg-dev

29.2.1

6 of 6 See more

prometheus gpg-dev 29.2.1

6 of the 6 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
quay.io/prometheus-operator/prometheus-config-reloader :v0.90.1	693faa0b8724	stdlib@go1.25.8	1.25.12
quay.io/prometheus/alertmanager :v0.32.0	58e117eabcce	stdlib@go1.26.2	1.25.12
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	stdlib@go1.26.1	1.25.12
quay.io/prometheus/prometheus :v3.11.2	cd37346c9745	stdlib@go1.26.2	1.25.12
quay.io/prometheus/pushgateway :v1.11.2	49ed9fdf3780	stdlib@go1.25.3	1.25.12
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	stdlib@go1.25.5	1.25.12

Open the chart page →

3,281

prometheus-operator-admission-webhookgpg-dev

0.18.1

2 of 2 See more

prometheus-operator-admission-webhook gpg-dev 0.18.1

2 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
quay.io/prometheus-operator/admission-webhook :v0.79.2	d4c97a1b2d67	stdlib@go1.23.4	1.25.12
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20221220-controller-v1.5.1-58-g787ea74b6	4d99688e5573	stdlib@go1.19.4	1.25.12

Open the chart page →

1,695

thanosgpg-dev

0.5.3

1 of 1 See more

thanos gpg-dev 0.5.3

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
thanosio/thanos :v0.41.0	cf3e9b292e43	stdlib@go1.25.7	1.25.12

Open the chart page →

598

traefikgpg-dev

39.0.8

1 of 1 See more

traefik gpg-dev 39.0.8

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/traefik :v3.6.13	34d5089d0b41	stdlib@go1.25.8	1.25.12

Open the chart page →

1,335

velerogpg-dev

12.0.0

1 of 1 See more

velero gpg-dev 12.0.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
velero/velero :v1.18.0	e4d1e79be2ee	stdlib@go1.25.7	1.25.12

Open the chart page →

1,647

whoami-demogpg-dev

0.1.0

1 of 1 See more

whoami-demo gpg-dev 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
containous/whoami :latest	7d6a3c8f9147	stdlib@go1.14	1.25.12

Open the chart page →

1,281

cloudcost-exportergrafana

1.1.13

1 of 1 See more

cloudcost-exporter grafana 1.1.13

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
grafana/cloudcost-exporter :v1.12.0	eeb2cfecb23e	stdlib@go1.26.4	1.25.12

Open the chart page →

168

grafana-cloud-onboardinggrafana

0.4.7

5 of 5 See more

grafana-cloud-onboarding grafana 0.4.7

5 of the 5 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
grafana/beyla-k8s-cache :2	53b2f561cb1b	stdlib@go1.25.3	1.25.12
ghcr.io/grafana/alloy-operator :1.8.1	ae85d68749c7	stdlib@go1.25.8	1.25.12
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.1	c137478627cc	stdlib@go1.23.6	1.25.12
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	stdlib@go1.26.1	1.25.12
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	stdlib@go1.25.5	1.25.12

Open the chart page →

4,844

grafana-samplinggrafana

1.1.7

2 of 2 See more

grafana-sampling grafana 1.1.7

2 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
grafana/alloy :v1.11.3	8c7256f412fe	stdlib@go1.24.6	1.25.12
quay.io/prometheus-operator/prometheus-config-reloader :v0.81.0	959d47672fbf	stdlib@go1.23.7	1.25.12

Open the chart page →

3,527

mimir-openshift-experimentalgrafana

2.1.0

1 of 4 See more

mimir-openshift-experimental grafana 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
grafana/mimir :2.0.0	80c1a8eb24dd	stdlib@go1.17.8	1.25.12

Open the chart page →

4,261

pyroscope-monitoringgrafana

0.1.1

5 of 6 See more

pyroscope-monitoring grafana 0.1.1

5 of the 6 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	stdlib@go1.24.6	1.25.12
ghcr.io/grafana/alloy-operator :1.3.0	2088dcb22aaa	stdlib@go1.24.5	1.25.12
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.1	c137478627cc	stdlib@go1.23.6	1.25.12
quay.io/prometheus/node-exporter :v1.9.1	d00a542e409e	stdlib@go1.23.7	1.25.12
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.17.0	2bbc91556733	stdlib@go1.24.6	1.25.12

Open the chart page →

8,715

snyk-exportergrafana

0.1.0

1 of 1 See more

snyk-exporter grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
grafana/snyk_exporter :v1.4.1	d3c9093401ca	stdlib@go1.21.0	1.25.12

Open the chart page →

671

prometheusgrafana-uxadax

26.0.1

6 of 6 See more

prometheus grafana-uxadax 26.0.1

6 of the 6 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
prom/prometheus :v3.0.1	565ee8650122	stdlib@go1.23.3	1.25.12
quay.io/prometheus-operator/prometheus-config-reloader :v0.78.2	944b2c67345c	stdlib@go1.23.3	1.25.12
quay.io/prometheus/alertmanager :v0.27.0	e13b6ed5cb92	stdlib@go1.21.7	1.25.12
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.25.12
quay.io/prometheus/pushgateway :v1.10.0	7a4d0696a24e	stdlib@go1.23.1	1.25.12
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.25.12

Open the chart page →

5,289

grafregistratiecomponentgrafregistratiecomponent

1.0.0

1 of 3 See more

grafregistratiecomponent grafregistratiecomponent 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/grafregistratiecomponent-php :latest	35225eaa87ab	stdlib@go1.13.10	1.25.12

Open the chart page →

7,565

grapple-installergrapple-installer

0.3.22

1 of 1 See more

grapple-installer grapple-installer 0.3.22

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
grpl/grapple-cli :0.2.127	c00aafee6629	stdlib@go1.18.10	1.25.12

Open the chart page →

89,470

grayloggraylog

1.0.2

1 of 4 See more

5,286

fasttrackmlgresearch

0.1.0

1 of 1 See more

fasttrackml gresearch 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
gresearch/fasttrackml :latest	16d1228220fc	stdlib@go1.21.10	1.25.12

Open the chart page →

1,405

siembolgresearch

0.1.6

1 of 4 See more

siembol gresearch 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
alpine/k8s :1.18.16	a41efe02a041	stdlib@go1.15.2	1.25.12

Open the chart page →

14,390

act-runnergringolito

0.2.0

1 of 1 See more

act-runner gringolito 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
gitea/act_runner :0.2.11-dind-rootless	6120b1165f3a	stdlib@go1.22.7	1.25.12

Open the chart page →

2,633

loki-proxygroundcover

0.1.1

1 of 1 See more

loki-proxy groundcover 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
public.ecr.aws/groundcovercom/loki-proxy :0.1.1	783d550ad813	stdlib@go1.17.13	1.25.12

Open the chart page →

2,185

routergroundcover

1.12.397

2 of 7 See more

router groundcover 1.12.397

2 of the 7 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
public.ecr.aws/groundcovercom/postgres :18.1-20260208	b7d7910c0bb0	stdlib@go1.25.7	1.25.12
quay.io/groundcover/tools :20260719	b705e0cbe171	stdlib@go1.24.4	1.25.12

Open the chart page →

2,030

temporalgroundcover

1.12.397

1 of 2 See more

temporal groundcover 1.12.397

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
public.ecr.aws/groundcovercom/temporalio/server :1.29.6-mini-20260702-1	70f191d0a80e	stdlib@go1.26.3	1.25.12

Open the chart page →

2,319

mysqlgroundhog2k

3.1.4

1 of 1 See more

mysql groundhog2k 3.1.4

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/mysql :9.7.2	30a0abfa7b50	stdlib@go1.24.6	1.25.12

Open the chart page →

476

tailscale-subnet-routergtaylor

1.2.1

1 of 1 See more

tailscale-subnet-router gtaylor 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/tailscale/tailscale :v1.34.1	ce1862e6b3a5	stdlib@go1.19.2-ts3fd24dee31	1.25.12

Open the chart page →

1,831

minifluxhajowieland

1.0.0

1 of 1 See more

miniflux hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/miniflux/miniflux :2.2.8	3a11ac10969e	stdlib@go1.24.2	1.25.12

Open the chart page →

1,290

hakoniwahakoniwa

0.1.0

1 of 1 See more

hakoniwa hakoniwa 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
ghcr.io/aplulu/hakoniwa :0.1.0	accf0b921388	stdlib@go1.25.5	1.25.12

Open the chart page →

343

docker-authhalkeye

0.1.1

1 of 1 See more

docker-auth halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
cesanta/docker_auth :1.6.0	4d16885f3d4c	stdlib@go1.13.7	1.25.12

Open the chart page →

2,380

matrix-media-repohalkeye

1.0.5

1 of 1 See more

matrix-media-repo halkeye 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
turt2live/matrix-media-repo :v1.2.8	bfbd459f89a5	stdlib@go1.16.3	1.25.12

Open the chart page →

4,511

mautrix-signalhalkeye

0.3.0

1 of 2 See more

mautrix-signal halkeye 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
signald/signald :0.23.2	edbff058278c	stdlib@go1.18.10	1.25.12

Open the chart page →

1,509

thunderdome-planning-pokerhalkeye

0.1.1

1 of 1 See more

thunderdome-planning-poker halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
stevenweathers/thunderdome-planning-poker :latest	c7eb7b10f186	stdlib@go1.26.4	1.25.12

Open the chart page →

430

whoamihalkeye

1.0.1

1 of 1 See more

whoami halkeye 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
containous/whoami :v1.5.0	7d6a3c8f9147	stdlib@go1.14	1.25.12

Open the chart page →

1,281

hcp-terraform-operatorhashicorp

2.12.1

1 of 2 See more

hcp-terraform-operator hashicorp 2.12.1

1 of the 2 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
quay.io/brancz/kube-rbac-proxy :v0.20.1	f5fbfec6a2b2	stdlib@go1.25.4	1.25.12

Open the chart page →

691

hatchet-apihatchet

0.19.0

1 of 4 See more

hatchet-api hatchet 0.19.0

1 of the 4 container images this version deploys carry CVE-2026-39822.

Container image	Digest	Package	Fixed in
library/postgres :latest	4ef4dbc939d6	stdlib@go1.24.6	1.25.12

Open the chart page →

1,822

Container images carrying it

5,123 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
registry.k8s.io/sig-storage/csi-resizer :v2.0.0	4a95d94e57ad	stdlib@go1.24.6	1.25.12	1
registry.k8s.io/sig-storage/csi-resizer :v1.10.1	4ecda2818f6d	stdlib@go1.21.5	1.25.12	1
registry.k8s.io/sig-storage/csi-resizer :v1.3.0	6e0546563b18	stdlib@go1.16.2	1.25.12	1
registry.k8s.io/sig-storage/csi-resizer :v1.12.0	ab774734705a	stdlib@go1.22.5	1.25.12	1
registry.k8s.io/sig-storage/csi-snapshotter :v6.1.0	291334908ddf	stdlib@go1.18	1.25.12	1
registry.k8s.io/sig-storage/csi-snapshotter :v8.0.2	5f051159c95f	stdlib@go1.22.5	1.25.12	1
registry.k8s.io/sig-storage/csi-snapshotter :v8.2.1	5f4bb469fec5	stdlib@go1.23.6	1.25.12	1
registry.k8s.io/sig-storage/csi-snapshotter :v4.2.1	818f35653f2e	stdlib@go1.16.2	1.25.12	1
registry.k8s.io/sig-storage/csi-snapshotter :v5.0.1	89e900a160a9	stdlib@go1.17.3	1.25.12	1
registry.k8s.io/sig-storage/hostpathplugin :v1.9.0	92257881c1d6	stdlib@go1.18	1.25.12	1
registry.k8s.io/sig-storage/livenessprobe :v2.9.0	2b10b24dafdc	stdlib@go1.19	1.25.12	1
registry.k8s.io/sig-storage/livenessprobe :v2.11.0	82adbebdf5d5	stdlib@go1.20.5	1.25.12	1
registry.k8s.io/sig-storage/local-volume-provisioner :v2.8.0	3e2bf2eaef9f	stdlib@go1.23.4	1.25.12	1
registry.k8s.io/sig-storage/local-volume-provisioner :v2.9.0	f9d65db8bda2	stdlib@go1.25.5	1.25.12	1
registry.k8s.io/sig-storage/nfsplugin :v4.13.4	1eb5a85180a4	stdlib@go1.26.4	1.25.12	1
registry.k8s.io/sig-storage/nfsplugin :v4.11.0	ce5b5ccd5eb0	stdlib@go1.23.6	1.25.12	1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.0	3ce0fdba4d8e	stdlib@go1.15	1.25.12	1
registry.k8s.io/sig-storage/objectstorage-sidecar :v0.2.2	c7166a73a303	stdlib@go1.24.11	1.25.12	1
registry.k8s.io/sig-storage/snapshot-controller :v8.2.1	472fa35a89da	stdlib@go1.23.6	1.25.12	1
registry.k8s.io/sig-storage/snapshot-controller :v4.2.1	95587f8777d7	stdlib@go1.16.2	1.25.12	1
registry.k8s.io/sig-storage/snapshot-controller :v6.2.1	98bab4eaf23c	stdlib@go1.19	1.25.12	1
registry.k8s.io/sig-storage/snapshot-controller :v6.3.1	ce6ca3c0e30b	stdlib@go1.20.5	1.25.12	1
registry.k8s.io/sig-storage/volume-data-source-validator :v1.0.0	d35884236461	stdlib@go1.17.3	1.25.12	1