StackRadar

CVE-2026-43894

Medium

Advisory

Published 11 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.2
base score, highest
EPSS
0.002
5th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
423
of 17,787 indexed, latest versions
Container images
337
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 423 of 17,787 indexed charts deploy, on 337 images.

Affected packageAffected versionsFixed inImages
jqdeb1.5+dfsg-1, 1.5+dfsg-1ubuntu0.1, 1.5+dfsg-2, 1.6-1ubuntu0.20.04.1+13 more1.6-2.1+deb12u2, 1.7.1-6+deb13u3231
jqapk1.7.1-r0, 1.8.0-r0, 1.8.1-r01.8.2-r0106
OSV records
ALPINE-CVE-2026-43894DEBIAN-CVE-2026-43894UBUNTU-CVE-2026-43894

Charts affected

423 by stars
ChartLatestAffected imagesRadar Score
ueb-listenersmo-helm-chart6.0.01 of 3See more

ueb-listener smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
jq@1.5+dfsg-1ubuntu0.1
no fix listed

Open the chart page →

25,793
testing-multitoolsomeblackmagic0.1.21 of 1See more

testing-multitool someblackmagic 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
jq@1.6-1ubuntu0.20.04.1
no fix listed

Open the chart page →

30,759
static-src-people-detector-appstatic-src-people-detector-chartVerified publisher1.5.51 of 6See more

static-src-people-detector-app static-src-people-detector-chart 1.5.5

1 of the 6 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
library/mongo:4.4.18d23ec07162ca
jq@1.6-1ubuntu0.20.04.1
no fix listed

Open the chart page →

13,684
prowlarrsudo-kraken-prowlarrVerified publisher3.2.11 of 1See more

prowlarr sudo-kraken-prowlarr 3.2.1

1 of the 1 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
ghcr.io/home-operations/prowlarr:2.3.01a8a4b11972b
jq@1.8.1-r0
1.8.2-r0

Open the chart page →

877
qbittorrentsudo-kraken-qbittorrentVerified publisher5.1.51 of 2See more

qbittorrent sudo-kraken-qbittorrent 5.1.5

1 of the 2 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
ghcr.io/home-operations/qbittorrent:5.1.4bb82ad6668f8
jq@1.8.1-r0
1.8.2-r0

Open the chart page →

2,130
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
jq@1.6-1ubuntu0.20.04.1
no fix listed

Open the chart page →

18,828
stateful-data-generatortalhajuikar-helm-charts0.1.21 of 2See more

stateful-data-generator talhajuikar-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
jq@1.6-1ubuntu0.20.04.1
no fix listed

Open the chart page →

4,898
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
supabase/realtime:latestd3aa0c86c7b3
jq@1.7.1-6+deb13u2
1.7.1-6+deb13u3

Open the chart page →

9,469
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
library/mongo:5.0.217c81758cb295
jq@1.6-1ubuntu0.20.04.1
no fix listed

Open the chart page →

20,362
owncloudth-chartsVerified publisher0.2.11 of 1See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
owncloud/server:10.15.051d9b74fc2a8
jq@1.6-1ubuntu0.20.04.1
no fix listed

Open the chart page →

10,065
the0the0Verified publisher0.9.81 of 9See more

the0 the0 0.9.8

1 of the 9 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
library/mongo:7-jammy406a4fdca9fc
jq@1.6-2.1ubuntu3.2
no fix listed

Open the chart page →

7,336
traefik-secrets-exportertraefik-secrets-exporter0.0.21 of 1See more

traefik-secrets-exporter traefik-secrets-exporter 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
ghcr.io/reiche-world/traefik-secrets-exporter:0.0.21485ff93cbf9
jq@1.8.1-r0
1.8.2-r0

Open the chart page →

1,676
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
jq@1.8.1-r0
1.8.2-r0

Open the chart page →

5,599
simple-mongodbtyk-helm0.1.11 of 1See more

simple-mongodb tyk-helm 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
jq@1.6-1ubuntu0.20.04.1
no fix listed

Open the chart page →

4,125
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
bitnamilegacy/kubectl:1.301249fc292e84
jq@1.6-2.1
1.6-2.1+deb12u2

Open the chart page →

8,370
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
jq@1.6-2.1ubuntu3
no fix listed

Open the chart page →

9,396
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
jq@1.8.0-r0
1.8.2-r0

Open the chart page →

6,470
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
twentycrm/twenty-postgres-spilo:latest2f78405a78be
jq@1.6-2.1ubuntu3
no fix listed

Open the chart page →

13,563
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
jq@1.7.1-3ubuntu0.24.04.1
no fix listed

Open the chart page →

7,696
ciliumvks-helm-chartsVerified publisher1.17.141 of 3See more

cilium vks-helm-charts 1.17.14

1 of the 3 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
quay.io/cilium/cilium:v1.17.14cdcfab5b4466
jq@1.7.1-3ubuntu0.24.04.1
no fix listed

Open the chart page →

4,124
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
jq@1.6-1ubuntu0.20.04.1
no fix listed

Open the chart page →

28,699
wexa-studiowexa-studio1.2.01 of 15See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
jq@1.8.0-r0
1.8.2-r0

Open the chart page →

14,618
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-43894.

Container imageDigestPackageFixed in
library/mongo:latest5211c51171f5
jq@1.7.1-3ubuntu0.24.04.2
no fix listed

Open the chart page →

13,197

Container images carrying it

337 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/linuxserver/duplicati:latesta792931146b4
jq@1.7.1-3ubuntu0.24.04.2
no fix listed
1
ghcr.io/linuxserver/freshrss:1.29.17f7f276244da
jq@1.8.1-r0
1.8.2-r0
1
ghcr.io/linuxserver/ombi:4.53.50caadf03b804
jq@1.7.1-3ubuntu0.24.04.2
no fix listed
1
ghcr.io/linuxserver/pairdrop:version-v1.11.23279d2d986c0
jq@1.8.1-r0
1.8.2-r0
1
ghcr.io/linuxserver/plex:version-1.41.4.9463-630c9f557e6d2775e77ec
jq@1.7.1-3build1
no fix listed
1
ghcr.io/linuxserver/radarr:6.0.4.10291-ls2896c0948b42c14
jq@1.8.1-r0
1.8.2-r0
1
ghcr.io/linuxserver/radarr:6.0.4c8a55bd83672
jq@1.8.1-r0
1.8.2-r0
1
ghcr.io/linuxserver/sonarr:4.0.16.2944-ls3008b9f2138ec50
jq@1.8.1-r0
1.8.2-r0
1
ghcr.io/linuxserver/syslog-ng:4.10.247fae7f540f9
jq@1.8.1-r0
1.8.2-r0
1
ghcr.io/lloesche/valheim-server:latest20fde516ce31
jq@1.7.1-6+deb13u1
1.7.1-6+deb13u3
1
ghcr.io/mcwarman/backstage-sample-app/app:mainfae3c1f04311
jq@1.7.1-6+deb13u1
1.7.1-6+deb13u3
1
ghcr.io/ncsa/jupyterhub-metrics/collector:1.3.0dcb8c731bb1b
jq@1.8.1-r0
1.8.2-r0
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
jq@1.6-2.1+deb12u1
1.6-2.1+deb12u2
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
jq@1.6-2.1
1.6-2.1+deb12u2
1
ghcr.io/okteto/pipeline-runner:0.0.0-2026-08-03:0.0.0-2026-08-173e56bdd1b90d
jq@1.7.1-6+deb13u2
1.7.1-6+deb13u3
1
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
jq@1.6-1ubuntu0.20.04.1
no fix listed
1
ghcr.io/reiche-world/traefik-secrets-exporter:0.0.21485ff93cbf9
jq@1.8.1-r0
1.8.2-r0
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
jq@1.6-2.1
1.6-2.1+deb12u2
1
ghcr.io/sergelogvinov/mongosync:1.15.0fa99ed475f03
jq@1.7.1-3ubuntu0.24.04.1
no fix listed
1
ghcr.io/slskd/slskd:0.25.1ab9ed50e028b
jq@1.7.1-3ubuntu0.24.04.1
no fix listed
1
ghcr.io/spidernet-io/spiderpool/spiderpool-agent:v1.2.08bb9411e47e0
jq@1.6-1ubuntu0.20.04.1
no fix listed
1
ghcr.io/streamingfast/firehose-core:v1.12.391fca773a63f
jq@1.7.1-3ubuntu0.24.04.1
no fix listed
1
ghcr.io/streamingfast/firehose-ethereum:v2.12.489969b78fb07
jq@1.7.1-3ubuntu0.24.04.1
no fix listed
1
ghcr.io/streamingfast/firehose-ethereum:v2.14.3bf816072380e
jq@1.7.1-3ubuntu0.24.04.1
no fix listed
1
ghcr.io/streamingfast/firehose-ethereum:v2.12.4-gethd7bdfa7b41da
jq@1.7.1-3ubuntu0.24.04.1
no fix listed
1
ghcr.io/streamingfast/go-ethereum:geth-v1.16.9-fh3.08e3cb38953a3
jq@1.7.1-3ubuntu0.24.04.1
no fix listed
1
ghcr.io/streamingfast/substreams-sink-kv:v2.3.026953ec68d5d
jq@1.6-1ubuntu0.20.04.1
no fix listed
1
ghcr.io/streamingfast/substreams-sink-noop:v1.4.0d7c43c3135c6
jq@1.6-1ubuntu0.20.04.1
no fix listed
1
ghcr.io/suwayomi/suwayomi-server:v2.3.2320d2c3218c7f9f
jq@1.7.1-3ubuntu0.24.04.2
no fix listed
1
ghcr.io/topolvm/pie:0.18.0aa467443e407
jq@1.6-2.1ubuntu3.2
no fix listed
1
ghcr.io/wolveix/satisfactory-server:v1.9.10e0f2f8c97598
jq@1.6-2.1ubuntu3.1
no fix listed
1
quay.io/cilium/cilium:v1.15.1351d6685dc6f
jq@1.6-2.1ubuntu3
no fix listed
1
quay.io/cilium/cilium:v1.18.2858f807ea4e2
jq@1.7.1-3ubuntu0.24.04.1
no fix listed
1
quay.io/cilium/cilium:v1.17.14cdcfab5b4466
jq@1.7.1-3ubuntu0.24.04.1
no fix listed
1
quay.io/opsmxpublic/opa:opa-sidecar-v1.03dcbf3caa454
jq@1.8.1-r0
1.8.2-r0
1
quay.io/opsmxpublic/spin-sample-pipeline:v1.0.1c6a934439421
jq@1.5+dfsg-1ubuntu0.1
no fix listed
1
registry.k8s.io/provider-os/manila-csi-plugin:v1.36.0190976e2e2fe
jq@1.8.1-r0
1.8.2-r0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.