StackRadar

CVE-2026-48815

High

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.002
9th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
458
of 17,781 indexed, latest versions
Container images
484
deployed by those charts
Fix available
1 of 1
affected package

sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced

Carried by container images the latest versions of 458 of 17,781 indexed charts deploy, on 484 images.

Affected packageAffected versionsFixed inImages
sigstorenpm1.0.0, 1.2.0, 1.4.0, 1.5.2+10 more4.1.1484
OSV records
GHSA-52v5-jr5w-gjxr

Charts affected

458 by stars
ChartLatestAffected imagesRadar Score
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.26.3092384dba45d
sigstore@2.3.1
4.1.1

Open the chart page →

10,380
stackradar-scannerstackradarVerified publisher0.3.01 of 1See more

stackradar-scanner stackradar 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/lockdep/stackradar-scanner:0.3.0dd8a35d50c2d
sigstore@3.1.0
4.1.1

Open the chart page →

1,209
stornxstornxVerified publisher1.1.11 of 9See more

stornx stornx 1.1.1

1 of the 9 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
alazidis/stornx:1.1.1602d4f7f090c
sigstore@4.1.0
4.1.1

Open the chart page →

11,574
supabasesupabse0.8.03 of 11See more

supabase supabse 0.8.0

3 of the 11 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
supabase/postgres-meta:v0.96.6a84cc713585e
sigstore@2.3.1
4.1.1
supabase/storage-api:v1.60.4c8eb9858eafe
sigstore@4.1.0
4.1.1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
sigstore@3.1.0
4.1.1

Open the chart page →

18,075
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
sigstore@2.3.1
4.1.1

Open the chart page →

12,581
vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets0.0.0-main1 of 2See more

vaultwarden-kubernetes-secrets vaultwarden-kubernetes-secrets 0.0.0-main

1 of the 2 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
sigstore@2.3.1
4.1.1

Open the chart page →

4,010
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
sigstore@2.3.1
4.1.1

Open the chart page →

5,225
tdarrvhdirkVerified publisher5.0.51 of 2See more

tdarr vhdirk 5.0.5

1 of the 2 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
haveagitgat/tdarr_node:2.17.013ff0913202dd
sigstore@1.5.2
4.1.1

Open the chart page →

26,657
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
sigstore@3.1.0
4.1.1

Open the chart page →

1,269
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
sigstore@4.1.0
4.1.1

Open the chart page →

3,833
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
sigstore@3.0.0
4.1.1

Open the chart page →

10,090
qleverzazukoVerified publisher0.7.01 of 2See more

qlever zazuko 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/zazukoians/qlever-ui:v0.10.034c7b540a095
sigstore@3.0.0
4.1.1

Open the chart page →

2,900
adeptia-automate-mcpadeptia-automate-mcp1.0.02 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
sigstore@3.1.0
4.1.1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
sigstore@3.1.0
4.1.1

Open the chart page →

3,600
activepiecesadnoctemVerified publisher0.5.01 of 1See more

activepieces adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
activepieces/activepieces:0.90.430c10a04fe3d
sigstore@4.1.0
4.1.1

Open the chart page →

1,055
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
sigstore@3.1.0
4.1.1

Open the chart page →

3,820
uptime-kumaadnoctemVerified publisher0.4.11 of 1See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
sigstore@3.1.0
4.1.1

Open the chart page →

30,028
turborepo-remote-cacheadriantr1.1.11 of 1See more

turborepo-remote-cache adriantr 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ducktors/turborepo-remote-cache:latest31ec9e83c844
sigstore@4.1.0
4.1.1

Open the chart page →

523
akto-mini-testingakto1.45.71 of 5See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-puppeteer-replay:1.49.4_latestf1c5763d565e
sigstore@4.1.0
4.1.1

Open the chart page →

6,486
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
sigstore@2.3.1
4.1.1

Open the chart page →

4,880
homepagealareira1.0.11 of 1See more

homepage alareira 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:latest753eeb0cc22a
sigstore@3.1.0
4.1.1

Open the chart page →

352
cross-seedalekcVerified publisher7.19.01 of 1See more

cross-seed alekc 7.19.0

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/cross-seed/cross-seed:6.13.7a1fed512261f
sigstore@2.3.1
4.1.1

Open the chart page →

1,384
excalidashalekcVerified publisher1.4.01 of 2See more

excalidash alekc 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.6.0cbdab75f31b2
sigstore@2.3.1
4.1.1

Open the chart page →

904
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
sigstore@2.3.1
4.1.1

Open the chart page →

5,558
platform-uiappscodeVerified publisher2026.9.111 of 1See more

platform-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/appscode/platform-ui:2.4.0668ee2682eaf
sigstore@3.1.0
4.1.1

Open the chart page →

690
argonix-apiargonix0.2.01 of 4See more

argonix-api argonix 0.2.0

1 of the 4 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api-frontend:1.0.0b6a67099e4c5
sigstore@2.3.1
4.1.1

Open the chart page →

4,923
assemblylineassemblylineVerified publisher7.4.171 of 12See more

assemblyline assemblyline 7.4.17

1 of the 12 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
cccs/assemblyline-ui-frontend:4.7.4.stable174c8e4b6c0483
sigstore@3.1.0
4.1.1

Open the chart page →

12,898
multilink-clientassist-iot-multi-link-client-app1.0.01 of 2See more

multilink-client assist-iot-multi-link-client-app 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
assistiot/multi-link_client:latestcf048365d042
sigstore@2.1.0
4.1.1

Open the chart page →

1,446
multilink-serverassist-iot-multi-link-server-app1.0.01 of 2See more

multilink-server assist-iot-multi-link-server-app 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
assistiot/multi-link_server:latestf38c76a4c960
sigstore@2.1.0
4.1.1

Open the chart page →

973
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
sigstore@2.2.2
4.1.1

Open the chart page →

32,501
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
sigstore@2.1.0
4.1.1

Open the chart page →

9,412
nas-appsawesomeVerified publisher2.0.01 of 8See more

nas-apps awesome 2.0.0

1 of the 8 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
wettyoss/wetty:latest7423b3d40ba2
sigstore@3.1.0
4.1.1

Open the chart page →

7,152
awesomeblessingappawesomeblessingapp1.1.01 of 1See more

awesomeblessingapp awesomeblessingapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
bnwokoye/nodejswebapp:latest74de7dc7ebfb
sigstore@1.0.0
4.1.1

Open the chart page →

1,267
audiobookshelfbdclark-helm-chartsVerified publisher0.1.41 of 1See more

audiobookshelf bdclark-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
sigstore@2.3.1
4.1.1

Open the chart page →

1,722
bluesky-pdsbear0.4.2081 of 1See more

bluesky-pds bear 0.4.208

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
sigstore@2.3.1
4.1.1

Open the chart page →

2,136
myhelmappbelihelmapp1.1.01 of 1See more

myhelmapp belihelmapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
belirta/beli-docker:v1.0.0f65ad0e23b4d
sigstore@1.5.2
4.1.1

Open the chart page →

1,187
bluerange-mosquittobluerangeOfficialVerified publisher1.0.41 of 1See more

bluerange-mosquitto bluerange 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
bluerange/bluerange-mosquitto:25f1bfbba84832
sigstore@4.0.0
4.1.1

Open the chart page →

1,168
colosseumbook-k8sinfra-v21.0.182 of 5See more

colosseum book-k8sinfra-v2 1.0.18

2 of the 5 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-cms:loge74b43c7f492
sigstore@3.0.0
4.1.1
sysnet4admin/colosseum-prm:log5802bfcd7fed
sigstore@3.0.0
4.1.1

Open the chart page →

26,996
node-appbryopsida0.5.11 of 2See more

node-app bryopsida 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
sigstore@3.0.0
4.1.1

Open the chart page →

14,352
openmctbryopsida0.1.11 of 1See more

openmct bryopsida 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/openmct:main38b6a50a62b2
sigstore@2.3.1
4.1.1

Open the chart page →

951
syslog-portalbryopsida0.3.11 of 1See more

syslog-portal bryopsida 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/syslog-portal:main3947bfd04f49
sigstore@3.0.0
4.1.1

Open the chart page →

1,306
cross-seedcfi20176.13.61 of 1See more

cross-seed cfi2017 6.13.6

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/cross-seed/cross-seed:6.13.381afafdd96a5
sigstore@2.3.1
4.1.1

Open the chart page →

1,338
qbittorrentcfi20176.13.31 of 1See more

qbittorrent cfi2017 6.13.3

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/cross-seed/cross-seed:6.13.381afafdd96a5
sigstore@2.3.1
4.1.1

Open the chart page →

1,338
dv-podcharonOfficialVerified publisher0.19.11 of 5See more

dv-pod charon 0.19.1

1 of the 5 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
obolnetwork/charon-dkg-sidecar:maine263be0a7440
sigstore@3.1.0
4.1.1

Open the chart page →

7,405
ghostchart-ghost0.1.51 of 2See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
library/ghost:6.22.0-alpine3.23ac533a6988ee
sigstore@3.1.0
4.1.1

Open the chart page →

4,083
audiobookshelfcharts-derwitt-devVerified publisher1.1.01 of 1See more

audiobookshelf charts-derwitt-dev 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
sigstore@2.3.1
4.1.1

Open the chart page →

1,722
chatgpt-next-webchatgpt-next-web0.1.11 of 1See more

chatgpt-next-web chatgpt-next-web 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
yidadaa/chatgpt-next-web:latesteaaa469ddeeb
sigstore@2.3.1
4.1.1

Open the chart page →

1,977
audiobookshelfchristianhuthVerified publisher2.4.01 of 1See more

audiobookshelf christianhuth 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
sigstore@2.3.1
4.1.1

Open the chart page →

1,722
countlychristianhuthVerified publisher5.2.12 of 3See more

countly christianhuth 5.2.1

2 of the 3 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
countly/api:25.05.4f4cc7447c4f5
sigstore@2.3.0
4.1.1
countly/frontend:25.05.42acbc11499b6
sigstore@2.3.0
4.1.1

Open the chart page →

7,295
mcp-for-argocdchristianhuthVerified publisher2.0.01 of 1See more

mcp-for-argocd christianhuth 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
sigstore@2.3.1
4.1.1

Open the chart page →

1,947
kamaji-consoleclastixVerified publisher0.1.31 of 1See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-48815.

Container imageDigestPackageFixed in
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
sigstore@1.7.0
4.1.1

Open the chart page →

2,759

Container images carrying it

484 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
docmost/docmost:0.95.041c8d777cf23
sigstore@3.1.0
4.1.1
1
documenso/documenso:v1.8.17f16a9449f18
sigstore@2.3.1
4.1.1
1
drumsergio/genieacs:1.2.16.028244054e1bf
sigstore@4.1.0
4.1.1
1
drumsergio/lynxprompt:2.0.75c6afb6679301
sigstore@4.1.0
4.1.1
1
drumsergio/pumperly:1.4.885bbc3915e9e
sigstore@3.1.0
4.1.1
1
dserio83/velero-ui:0.3.1b4e1ec6664d3
sigstore@2.1.0
4.1.1
1
ducktors/turborepo-remote-cache:latest31ec9e83c844
sigstore@4.1.0
4.1.1
1
eclipseaerios/self-orchestrator:1.2.08b123bec5679
sigstore@2.3.1
4.1.1
1
etherpad/etherpad:2.7.2b723fe5f2594
sigstore@4.1.0
4.1.1
1
ethersphere/etherproxy:1.0.056029b0985f4
sigstore@1.7.0
4.1.1
1
ethersphere/multichain-proxy:0.0.261f5419afbcd
sigstore@3.0.0
4.1.1
1
ethpandaops/ethereumjs:masterfb84b718500f
sigstore@2.3.1
4.1.1
1
evoapicloud/evolution-api:latest966625532d90
sigstore@4.1.0
4.1.1
1
fallenbagel/jellyseerr:latest4538137bc5af
sigstore@3.1.0
4.1.1
1
felddy/foundryvtt:12.343.06c5e3e9ffbb0
sigstore@2.3.0
4.1.1
1
felipecs8/conversor-temperatura:v1f945423be36d
sigstore@2.3.1
4.1.1
1
felipecs8/landing-page:v1db6d44e325a1
sigstore@3.1.0
4.1.1
1
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
sigstore@2.3.1
4.1.1
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
sigstore@3.0.0
4.1.1
1
flanksource/incident-manager-ui:v1.4.318891f21df54fb
sigstore@3.0.0
4.1.1
1
folioci/mod-graphql:latestf0655a6a08fd
sigstore@2.3.1
4.1.1
1
fonoster/routr-pgdata-migrations:2.13.6c7b1dba81eb3
sigstore@2.3.0
4.1.1
1
fosrl/pangolin:1.13.0c32ad797ab96
sigstore@4.0.0
4.1.1
1
fthomas/scala-steward:latest367afe974b7a
sigstore@4.1.0
4.1.1
1
gethue/hue:latest7d5c1b9f8a79
sigstore@4.1.0
4.1.1
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
sigstore@3.1.0
4.1.1
1
globalping/globalping-probe:latest8acbd23009fd
sigstore@3.1.0
4.1.1
1
hamid2021/nodejs-dockercli:latest429d99890c3c
sigstore@2.1.0
4.1.1
1
hansehe/graphql-gateway:1.0.458e09540afbc
sigstore@2.1.0
4.1.1
1
haohanyang/compass-web:0.5.054f2112602ee
sigstore@4.1.0
4.1.1
1
haveagitgat/tdarr_node:2.17.013ff0913202dd
sigstore@1.5.2
4.1.1
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
sigstore@2.3.1
4.1.1
1
helga09/shoes_ukr:v1.1.17999bc8b77c0
sigstore@1.2.0
4.1.1
1
helicone/supabase-migration-runner:v2025.03.05-14a913936c97b
sigstore@1.7.0
4.1.1
1
heywood8/redisinsight:2.28.00bc9ab313d37
sigstore@1.0.0
4.1.1
1
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
sigstore@3.1.0
4.1.1
1
honglab/slack-emoji-maker:v0.0.1ca075a926fe1
sigstore@2.3.1
4.1.1
1
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
sigstore@2.3.1
4.1.1
1
ilum/marquez-web:0.53.2716437a51a6c
sigstore@4.0.0
4.1.1
1
instill/console:0.68.54cd70e2df5c6
sigstore@2.3.1
4.1.1
1
instructure/kinesalite:latest34400d82f28f
sigstore@1.7.0
4.1.1
1
intelloop/atlas-cmms-frontend:v1.5.12409c2a00ab6
sigstore@2.1.0
4.1.1
1
jaedb/iris:latest048cfbf58d57
sigstore@2.3.1
4.1.1
1
jesec/flood:4.14.3c887dad96b40
sigstore@3.1.0
4.1.1
1
jhidalgo3/hello-kubernetes:1.0.0.1397bf5ddfa8628d79f5
sigstore@2.3.1
4.1.1
1
jkroepke/github_exporter:1.8.03d850992786d
sigstore@4.0.0
4.1.1
1
johly/airtrail:v3.11.19f702b91e0e7
sigstore@3.1.0
4.1.1
1
joplin/server:3.0-beta52af57880c0e
sigstore@2.3.0
4.1.1
1
joplin/server:2.14.2-betab87564ef34e9
sigstore@2.1.0
4.1.1
1
josepht05/nodejs-feb24:latest36cb0c618c94
sigstore@2.1.0
4.1.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.