CVE-2026-42502

Unscored

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.002; 13th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 3,017; of 17,790 indexed, latest versions
Container images: 3,695; deployed by those charts
Fix available: 1 of 1; affected package

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Carried by container images the latest versions of 3,017 of 17,790 indexed charts deploy, on 3,695 images.

Affected package	Affected versions	Fixed in	Images
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more	0.55.0	3,695

OSV records: GO-2026-5027

Charts affected

3,017 by stars

Chart

Latest

Affected images

Radar Score

ceph-csi-rbdceph-csi

3.17.1

6 of 6 See more

ceph-csi-rbd ceph-csi 3.17.1

6 of the 6 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.17.1	0b62db8afc9b	golang.org/x/net@v0.53.0	0.55.0
registry.k8s.io/sig-storage/csi-attacher :v4.11.0	b74b05b39501	golang.org/x/net@v0.47.0	0.55.0
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.16.0	ab482308a492	golang.org/x/net@v0.49.0	0.55.0
registry.k8s.io/sig-storage/csi-provisioner :v6.2.0	6be9f63ca4ca	golang.org/x/net@v0.51.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v2.1.0	589e525cddef	golang.org/x/net@v0.48.0	0.55.0
registry.k8s.io/sig-storage/csi-snapshotter :v8.5.0	da081c27e8a6	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

4,103

chaos-meshchaos-mesh

2.8.4

4 of 4 See more

chaos-mesh chaos-mesh 2.8.4

4 of the 4 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
ghcr.io/chaos-mesh/chaos-coredns :v0.2.8	38bfdf5e3774	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e	0.55.0
ghcr.io/chaos-mesh/chaos-daemon :v2.8.4	0d28dbd95b03	golang.org/x/net@v0.52.0	0.55.0
ghcr.io/chaos-mesh/chaos-dashboard :v2.8.4	8a8ec8d4c9ea	golang.org/x/net@v0.52.0	0.55.0
ghcr.io/chaos-mesh/chaos-mesh :v2.8.4	9e48285bb44c	golang.org/x/net@v0.52.0	0.55.0

Open the chart page →

6,415

csi-driver-nfscsi-driver-nfs

4.13.4

4 of 6 See more

csi-driver-nfs csi-driver-nfs 4.13.4

4 of the 6 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.17.0	f9de845b1701	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v2.2.0	a2d40c1c3ccb	golang.org/x/net@v0.49.0	0.55.0
registry.k8s.io/sig-storage/csi-snapshotter :v8.6.0	42af0929bcd6	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/livenessprobe :v2.19.0	06da0d5b8908	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

3,391

mariadb-operatormariadb-operator

26.6.0

1 of 1 See more

mariadb-operator mariadb-operator 26.6.0

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
ghcr.io/mariadb-operator/mariadb-operator :26.6.0	a5e17b48f08e	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

377

atlantisatlantis

6.15.1

1 of 1 See more

atlantis atlantis 6.15.1

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
ghcr.io/runatlantis/atlantis :v0.47.1	511231955463	golang.org/x/net@v0.23.0	0.55.0

Open the chart page →

1,899

grafana-agentgrafana

0.44.2

1 of 2 See more

grafana-agent grafana 0.44.2

1 of the 2 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
grafana/agent :v0.44.2	3364714a2f64	golang.org/x/net@v0.33.0	0.55.0

Open the chart page →

3,526

vclusterloft

0.0.0-ci.3

1 of 2 See more

vcluster loft 0.0.0-ci.3

1 of the 2 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
rancher/k3s :v1.26.0-k3s1	9380f5dbae9a	golang.org/x/net@v0.1.1-0.20221027164007-c63010009c80	0.55.0

Open the chart page →

2,461

milvusmilvus

4.0.31

4 of 5 See more

milvus milvus 4.0.31

4 of the 5 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
milvusdb/etcd :3.5.5-r2	102aac62827b	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2	0.55.0
milvusdb/milvus :v2.2.13	a3a55e1c1497	golang.org/x/net@v0.10.0	0.55.0
milvusdb/milvus-config-tool :v0.1.1	2212dfb61401	golang.org/x/net@v0.0.0-20220706163947-c90051bbdb60	0.55.0
minio/minio :RELEASE.2023-03-20T20-16-18Z	6d770d7f255c	golang.org/x/net@v0.8.0	0.55.0

Open the chart page →

32,420

cockroachdbcockroachdb

22.0.3

1 of 3 See more

cockroachdb cockroachdb 22.0.3

1 of the 3 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
cockroachdb/cockroach-self-signer-cert :1.10	07a49acec18d	golang.org/x/net@v0.38.0	0.55.0

Open the chart page →

763

clearmlallegroai

7.15.0

1 of 4 See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
bitnamilegacy/mongodb :6.0.10-debian-11-r8	42319decb591	golang.org/x/net@v0.14.0	0.55.0

Open the chart page →

10,695

semaphoresemaphoreui

16.2.2

1 of 1 See more

semaphore semaphoreui 16.2.2

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
semaphoreui/semaphore :v2.18.3	e9260bfa8255	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

2,228

signozsignoz

0.141.1

2 of 5 See more

signoz signoz 0.141.1

2 of the 5 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.21.2	cd9252644ce0	golang.org/x/net@v0.7.0	0.55.0
altinity/metrics-exporter :0.21.2	df3d57215356	golang.org/x/net@v0.7.0	0.55.0

Open the chart page →

7,607

community-operatormongodb-helm-charts

0.13.0

1 of 1 See more

community-operator mongodb-helm-charts 0.13.0

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
quay.io/mongodb/mongodb-kubernetes-operator :0.13.0	2dcc6393e6f7	golang.org/x/net@v0.39.0	0.55.0

Open the chart page →

1,126

prometheus-kafka-exporterprometheus-community

4.0.0

1 of 1 See more

prometheus-kafka-exporter prometheus-community 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
danielqsj/kafka-exporter :v1.9.0	4150e46b2e96	golang.org/x/net@v0.34.0	0.55.0

Open the chart page →

716

node-local-dnsdeliveryhero

2.9.2

1 of 1 See more

node-local-dns deliveryhero 2.9.2

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
registry.k8s.io/dns/k8s-dns-node-cache :1.26.7	8b9a78d101a1	golang.org/x/net@v0.46.0	0.55.0

Open the chart page →

1,708

rancherrancher-latest

2.15.1

2 of 2 See more

rancher rancher-latest 2.15.1

2 of the 2 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
rancher/rancher :v2.15.1	5f6c4dc52a05	golang.org/x/net@v0.52.0	0.55.0
rancher/shell :v0.8.1	f293af9c635f	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

1,487

sealed-secretsbitnami

2.5.19

1 of 1 See more

sealed-secrets bitnami 2.5.19

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
bitnami/sealed-secrets-controller :0.31.0-debian-12-r0	74eaff41382b	golang.org/x/net@v0.42.0	0.55.0

Open the chart page →

643

difydouban

0.10.0

2 of 6 See more

dify douban 0.10.0

2 of the 6 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
langgenius/dify-plugin-daemon :0.5.1-local	8269050f192e	golang.org/x/net@v0.42.0	0.55.0
langgenius/dify-sandbox :0.2.12	4e65e8a351a2	golang.org/x/net@v0.40.0	0.55.0

Open the chart page →

19,544

dragonflydragonfly

1.8.4

1 of 3 See more

dragonfly dragonfly 1.8.4

1 of the 3 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
dragonflyoss/scheduler :v2.5.2-rc.0	6d710dc2bae0	golang.org/x/net@v0.48.0	0.55.0

Open the chart page →

3,830

secrets-store-csi-driversecret-store-csi-driver

1.6.1

2 of 4 See more

secrets-store-csi-driver secret-store-csi-driver 1.6.1

2 of the 4 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.16.0	ab482308a492	golang.org/x/net@v0.49.0	0.55.0
registry.k8s.io/sig-storage/livenessprobe :v2.18.0	c4cc074199c0	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

1,802

stackgres-operatorstackgres-charts

1.19.1

1 of 2 See more

stackgres-operator stackgres-charts 1.19.1

1 of the 2 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
quay.io/ongres/kubectl :v1.25.16-build-6.53	04dada9e4503	golang.org/x/net@v0.17.0	0.55.0

Open the chart page →

2,139

opensearch-operatoropensearch-operator

3.0.2

1 of 1 See more

opensearch-operator opensearch-operator 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-operator :3.0.0-alpha	f78bbdd1a386	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

610

pulsarapache

4.7.0

6 of 10 See more

pulsar apache 4.7.0

6 of the 10 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
alpine/k8s :1.32.12	048f8d9c8cc7	golang.org/x/net@v0.47.0	0.55.0
grafana/grafana :12.4.1	e932bd6ed0e0	golang.org/x/net@v0.49.0	0.55.0
rancher/kubectl :v1.25.0	85a0d1148784	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b	0.55.0
victoriametrics/operator :v0.68.3	f52e1bd679cb	golang.org/x/net@v0.49.0	0.55.0
quay.io/prometheus/node-exporter :v1.10.2	337ff1d356b6	golang.org/x/net@v0.44.0	0.55.0
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0	0.55.0

Open the chart page →

9,891

miniocloudpirates-minio

0.13.4

1 of 1 See more

minio cloudpirates-minio 0.13.4

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
cloudpirates/image-minio :RELEASE.2025-10-15T17-29-55Z-hardened	8dc02a7e5093	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

968

vertical-pod-autoscalercowboysysop

11.1.1

4 of 4 See more

vertical-pod-autoscaler cowboysysop 11.1.1

4 of the 4 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
bitnamilegacy/kubectl :1.29.3	f5fc0d561d9e	golang.org/x/net@v0.19.0	0.55.0
registry.k8s.io/autoscaling/vpa-admission-controller :1.5.1	9928d59477fb	golang.org/x/net@v0.43.0	0.55.0
registry.k8s.io/autoscaling/vpa-recommender :1.5.1	e629c61b75eb	golang.org/x/net@v0.43.0	0.55.0
registry.k8s.io/autoscaling/vpa-updater :1.5.1	cba2aa4b3239	golang.org/x/net@v0.43.0	0.55.0

Open the chart page →

6,960

difydify-helm

0.38.0

1 of 11 See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
langgenius/dify-sandbox :0.2.15	750e1111426e	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

22,214

pyroscopegrafana

2.3.1

2 of 3 See more

pyroscope grafana 2.3.1

2 of the 3 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
grafana/alloy :v1.12.2	f94b1c82957a	golang.org/x/net@v0.46.0	0.55.0
quay.io/prometheus-operator/prometheus-config-reloader :v0.81.0	959d47672fbf	golang.org/x/net@v0.37.0	0.55.0

Open the chart page →

3,214

botkubeinfracloudio

1.14.0

1 of 1 See more

botkube infracloudio 1.14.0

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
ghcr.io/kubeshop/botkube :v1.14.0	c6fe64c7bfcd	golang.org/x/net@v0.23.0	0.55.0

Open the chart page →

1,104

operatorminio-operator

7.1.1

1 of 1 See more

operator minio-operator 7.1.1

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
quay.io/minio/operator :v7.1.1	cd587f60c43d	golang.org/x/net@v0.38.0	0.55.0

Open the chart page →

874

ambassadordatawire

6.9.5

1 of 2 See more

ambassador datawire 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
datawire/aes :1.14.4	8588eafe6862	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777	0.55.0

Open the chart page →

4,093

oktetookteto

0.0.0-2026-08-17

3 of 10 See more

okteto okteto 0.0.0-2026-08-17

3 of the 10 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
ghcr.io/okteto/backend :0.0.0-2026-08-17	629bdce31b4d	golang.org/x/net@v0.47.0	0.55.0
ghcr.io/okteto/buildkit :0.0.0-2026-08-17	14527ca5d2a9	golang.org/x/net@v0.35.0	0.55.0
ghcr.io/okteto/okteto :3.22.0	4585017f52f6	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

5,532

hydraory

0.64.0

1 of 2 See more

hydra ory 0.64.0

1 of the 2 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
oryd/hydra :v26.2.0	ff67c7fb5f95	golang.org/x/net@v0.48.0	0.55.0

Open the chart page →

1,163

prometheus-msteamsprometheus-msteams

1.3.6

1 of 1 See more

prometheus-msteams prometheus-msteams 1.3.6

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
quay.io/prometheusmsteams/prometheus-msteams :v1.5.3	a9f4d31ab811	golang.org/x/net@v0.7.0	0.55.0

Open the chart page →

941

proxmox-csi-pluginproxmox-csi

0.5.12

3 of 7 See more

proxmox-csi-plugin proxmox-csi 0.5.12

3 of the 7 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.12.0	b9dc9a714a48	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.17.0	f9de845b1701	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/livenessprobe :v2.19.0	06da0d5b8908	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

1,828

volsyncbackube-helm-charts

0.16.0

1 of 1 See more

volsync backube-helm-charts 0.16.0

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
quay.io/backube/volsync :0.16.0	0d03a6aad575	golang.org/x/net@v0.40.0	0.55.0

Open the chart page →

1,386

concourseconcourse

20.3.0

1 of 2 See more

concourse concourse 20.3.0

1 of the 2 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
concourse/concourse :8.3.0	40a143ce5873	golang.org/x/net@v0.50.0	0.55.0

Open the chart page →

2,054

san-iscsi-csienix

4.0.2

1 of 7 See more

san-iscsi-csi enix 4.0.2

1 of the 7 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
enix/san-iscsi-csi :v4.0.2	f963da81ecf7	golang.org/x/net@v0.0.0-20210610132358-84b48f89b13b	0.55.0

Open the chart page →

4,168

headscalegabe565

0.16.0

1 of 2 See more

headscale gabe565 0.16.0

1 of the 2 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
ghcr.io/juanfont/headscale :v0.25.0	97febecbe6cb	golang.org/x/net@v0.34.0	0.55.0

Open the chart page →

2,003

oncallgrafana

1.16.5

7 of 12 See more

oncall grafana 1.16.5

7 of the 12 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
grafana/grafana :11.1.4	886b56d5534e	golang.org/x/net@v0.26.0	0.55.0
quay.io/jetstack/cert-manager-cainjector :v1.8.0	e7b6203ccb37	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7	0.55.0
quay.io/jetstack/cert-manager-controller :v1.8.0	e1642bf8e933	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7	0.55.0
quay.io/jetstack/cert-manager-ctl :v1.8.0	595c548dee6f	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7	0.55.0
quay.io/jetstack/cert-manager-webhook :v1.8.0	fd798a5a773e	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7	0.55.0
registry.k8s.io/ingress-nginx/controller :v1.2.1	5516d103a9c2	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f	0.55.0
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.1.1	64d8c73dca98	golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023	0.55.0

Open the chart page →

16,282

k8sgpt-operatork8sgpt

0.2.29

2 of 2 See more

k8sgpt-operator k8sgpt 0.2.29

2 of the 2 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
ghcr.io/k8sgpt-ai/k8sgpt-operator :v0.2.29	82d0adcce816	golang.org/x/net@v0.53.0	0.55.0
quay.io/brancz/kube-rbac-proxy :v0.19.1	9f21034731c7	golang.org/x/net@v0.39.0	0.55.0

Open the chart page →

980

openbaoopenbao

0.29.4

1 of 2 See more

openbao openbao 0.29.4

1 of the 2 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
hashicorp/vault-k8s :1.7.2	ae3d307658b7	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

1,516

kratosory

0.64.0

1 of 1 See more

kratos ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
oryd/kratos :v26.2.0	2a13bb8d362c	golang.org/x/net@v0.48.0	0.55.0

Open the chart page →

873

wazuhwazuh-helm-morgoved

2.0.7

1 of 5 See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
wazuh/wazuh-manager :4.14.3	f09282d281f6	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2	0.55.0

Open the chart page →

11,431

aws-cloudwatch-metricsaws

0.0.11

1 of 1 See more

aws-cloudwatch-metrics aws 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
amazon/cloudwatch-agent :1.300032.2b361	73b79b02f03a	golang.org/x/net@v0.17.0	0.55.0

Open the chart page →

1,563

zabbixcetic

3.1.3

1 of 5 See more

zabbix cetic 3.1.3

1 of the 5 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
zabbix/zabbix-agent2 :ubuntu-6.0.8	e5b594057c9c	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110	0.55.0

Open the chart page →

33,928

csi-driver-smbcsi-driver-smb

1.20.3

3 of 6 See more

csi-driver-smb csi-driver-smb 1.20.3

3 of the 6 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.17.0	f9de845b1701	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v2.2.0	a2d40c1c3ccb	golang.org/x/net@v0.49.0	0.55.0
registry.k8s.io/sig-storage/livenessprobe :v2.19.0	06da0d5b8908	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

3,005

emissary-ingressdatawire

7.1.8-ea

1 of 1 See more

emissary-ingress datawire 7.1.8-ea

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
datawire/emissary :2.0.2-ea	9716efbdd24b	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777	0.55.0

Open the chart page →

4,925

hpe-csi-driverhpe-storage

3.3.0

3 of 14 See more

hpe-csi-driver hpe-storage 3.3.0

3 of the 14 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.12.0	b9dc9a714a48	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.17.0	f9de845b1701	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/csi-snapshotter :v8.6.0	42af0929bcd6	golang.org/x/net@v0.54.0	0.55.0

Open the chart page →

1,700

imgproxyimgproxy

1.1.0

1 of 1 See more

imgproxy imgproxy 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
ghcr.io/imgproxy/imgproxy :v3.30.0	74c1bee92e04	golang.org/x/net@v0.44.0	0.55.0

Open the chart page →

2,373

cloudflaredkubitodev

1.7.9

1 of 1 See more

cloudflared kubitodev 1.7.9

1 of the 1 container images this version deploys carry CVE-2026-42502.

Container image	Digest	Package	Fixed in
cloudflare/cloudflared :2026.3.0	6b599ca3e974	golang.org/x/net@v0.40.0	0.55.0

Open the chart page →

1,460

Container images carrying it

3,695 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	golang.org/x/net@v0.23.0	0.55.0	1
ghcr.io/crashappsec/chalk-operator :v0.1.1	28eee62e9bfa	golang.org/x/net@v0.38.0	0.55.0	1
ghcr.io/crazygit/cert-manager-alidns-webhook :0.1.4	976be6506eb6	golang.org/x/net@v0.47.0	0.55.0	1
ghcr.io/crazy-max/cloudflared :2025.9.1	9b4e856d18f6	golang.org/x/net@v0.40.0	0.55.0	1
ghcr.io/cronschedules/cronjob-scale-down-operator :0.4.4	1c4e803d7169	golang.org/x/net@v0.52.0	0.55.0	1
ghcr.io/csepulveda/trivy-webhook-aws-security-hub :v0.1.20	6836b779b060	golang.org/x/net@v0.50.0	0.55.0	1
ghcr.io/ctron/kubectl :1.25	e37d61b5277c	golang.org/x/net@v0.17.0	0.55.0	1
ghcr.io/cubefs/cfs-csi-driver :3.2.0.150.0	8723616a976a	golang.org/x/net@v0.0.0-20211209124913-491a49abca63	0.55.0	1
ghcr.io/cybozu-go/accurate :1.9.0	7877e91ed723	golang.org/x/net@v0.53.0	0.55.0	1
ghcr.io/danieldonoghue/vault-sync-operator :v0.0.1-beta.3	8d7ec69a193c	golang.org/x/net@v0.52.0	0.55.0	1
ghcr.io/daocloud/crproxy/crproxy :v0.8.0	ee1eb3c9c9a1	golang.org/x/net@v0.26.0	0.55.0	1
ghcr.io/dapr/injector :1.17.0-rc.3	7a2fd888ed5f	golang.org/x/net@v0.48.0	0.55.0	1
ghcr.io/dapr/operator :1.17.0-rc.3	d5cc61cbe735	golang.org/x/net@v0.48.0	0.55.0	1
ghcr.io/dapr/placement :1.17.0-rc.3	a237b43cd5c6	golang.org/x/net@v0.48.0	0.55.0	1
ghcr.io/dapr/scheduler :1.17.0-rc.3	6c62e01e736b	golang.org/x/net@v0.48.0	0.55.0	1
ghcr.io/dapr/sentry :1.17.0-rc.3	bf79b03591e0	golang.org/x/net@v0.48.0	0.55.0	1
ghcr.io/dask/dask-notebook :2024.1.0	f53bde3acd4f	golang.org/x/net@v0.17.0	0.55.0	1
ghcr.io/davidkarlsen/flyway-operator :0.2.13	66f60b461c0d	golang.org/x/net@v0.38.0	0.55.0	1
ghcr.io/dcristobalhmad/kube-secrets-exporter :latest	a9043737cb73	golang.org/x/net@v0.23.0	0.55.0	1
ghcr.io/debridmediamanager/zurg-testing :v0.9.3-final	5c47ef99443a	golang.org/x/net@v0.20.0	0.55.0	1
ghcr.io/decayofmind/kube-better-node :master	ccd2ce03b682	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7	0.55.0	1
ghcr.io/deepch/rtsptoweb :v2.2.0	f9de3a1a5deb	golang.org/x/net@v0.0.0-20211216030914-fe4d6282115f	0.55.0	1
ghcr.io/defensia/agent :1.4.57	e9d40ae44711	golang.org/x/net@v0.47.0	0.55.0	1
ghcr.io/deliveryhero/field-exporter :v1.4.0	6b71ba4f9297	golang.org/x/net@v0.26.0	0.55.0	1
ghcr.io/devangradadiya/k8s-s3-bucket-operator :0.2.2	58288de9f9fa	golang.org/x/net@v0.47.0	0.55.0	1
ghcr.io/devhatro/clamav-api :1.0.2	ff0cd9db78d3	golang.org/x/net@v0.25.0	0.55.0	1
ghcr.io/devops-ia/steampipe :v2.4.1	a982103d91d3	golang.org/x/net@v0.48.0	0.55.0	1
ghcr.io/devplayer0/lxd8s :0.3.1	e159ba41aede	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0	0.55.0	1
ghcr.io/dexidp/dex :v2.43.1	0881d3c9359b	golang.org/x/net@v0.37.0	0.55.0	1
ghcr.io/dexidp/dex :v2.35.3	13964b29d63e	golang.org/x/net@v0.0.0-20220927171203-f486391704dc	0.55.0	1
ghcr.io/dexidp/dex :v2.44.0	5d0656fce7d4	golang.org/x/net@v0.43.0	0.55.0	1
ghcr.io/dexidp/dex :v2.42.1	8186d6dd81f4	golang.org/x/net@v0.32.0	0.55.0	1
ghcr.io/dexidp/dex :v2.37.0	f579d00721b0	golang.org/x/net@v0.11.0	0.55.0	1
ghcr.io/digitalis-io/vals-operator :v0.8.1	7c776499b8c9	golang.org/x/net@v0.49.0	0.55.0	1
ghcr.io/dirien/minecraft-exporter :0.24.0	61d89bf99ff7	golang.org/x/net@v0.51.0	0.55.0	1
ghcr.io/distribution/distribution :3.0.0	4ba3adf47f5c	golang.org/x/net@v0.37.0	0.55.0	1
ghcr.io/djcass44/cso-proxy :cccf49fd	b360d44125ad	golang.org/x/net@v0.0.0-20210908191846-a5e095526f91	0.55.0	1
ghcr.io/djcass44/gitlab-goproxy :v0.1.8	a43323732181	golang.org/x/net@v0.10.0	0.55.0	1
ghcr.io/dntosas/capi2argo-cluster-operator :v1.5.0	fb8c6457ef6e	golang.org/x/net@v0.40.0	0.55.0	1
ghcr.io/dodevops/azure-advanced-backup :0.4.0	1041d4449e49	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f	0.55.0	1
ghcr.io/doodlescheduling/k8s-pause :v0.1.1	6b3215e37738	golang.org/x/net@v0.0.0-20210825183410-e898025ed96a	0.55.0	1
ghcr.io/doodlescheduling/k8svault-controller :v0.2.0	627e5e211766	golang.org/x/net@v0.0.0-20211108170745-6635138e15ea	0.55.0	1
ghcr.io/dploeger/cloudflare-ddns-update :v0.1.0	ec06685b9ff4	golang.org/x/net@v0.25.0	0.55.0	1
ghcr.io/druggeri/nut_exporter :3.3.0	276460d141c7	golang.org/x/net@v0.35.0	0.55.0	1
ghcr.io/dsp0x4/cloudfront-tenant-operator :0.3.0	eb40174cd20d	golang.org/x/net@v0.51.0	0.55.0	1
ghcr.io/edgelesssys/continuum/continuum-proxy	24c76f294a80	golang.org/x/net@v0.32.0	0.55.0	1
ghcr.io/edgelesssys/coordinator :v0.5.0	bcd5b8d4c45c	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781	0.55.0	1
ghcr.io/einstack/glide :0.0.1-alpine	ab3f7d0a1d50	golang.org/x/net@v0.19.0	0.55.0	1
ghcr.io/element-hq/ess-helm/matrix-tools :0.3.2	0eac0521be29	golang.org/x/net@v0.36.0	0.55.0	1
ghcr.io/eminaktas/oom-tracer :v0.1.0	c90ca8389c87	golang.org/x/net@v0.38.0	0.55.0	1