StackRadar

CVE-2026-63374

Critical

Advisory

Published 18 Sept 2026In the index since 19 Sept 2026
Severity
Critical
worst across findings
CVSS
9.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 17,805 indexed, latest versions
Container images
260
deployed by those charts
Fix available
1 of 1
affected package

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Carried by container images the latest versions of 247 of 17,805 indexed charts deploy, on 260 images.

Affected packageAffected versionsFixed inImages
anyiopypi3.3.0, 3.3.4, 3.5.0, 3.6.1+22 more4.14.2260
OSV records
GHSA-82r6-8w77-94w6

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
rhbk-neurofacerhbk-neurofaceVerified publisher1.0.01 of 4See more

rhbk-neuroface rhbk-neuroface 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
anyio@4.14.0
4.14.2

Open the chart page →

4,022
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
anyio@4.6.2.post1
4.14.2

Open the chart page →

9,771
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
anyio@4.9.0
4.14.2

Open the chart page →

3,468
imgtagrotationalVerified publisher0.2.01 of 1See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
anyio@4.8.0
4.14.2

Open the chart page →

3,374
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
anyio@4.8.0
4.14.2

Open the chart page →

3,592
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
anyio@4.8.0
4.14.2

Open the chart page →

4,798
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
anyio@4.13.0
4.14.2

Open the chart page →

7,818
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
anyio@4.11.0
4.14.2

Open the chart page →

10,767
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
anyio@4.11.0
4.14.2

Open the chart page →

4,598
runwhen-localrunwhen-contribVerified publisher0.6.171 of 3See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
anyio@4.13.0
4.14.2

Open the chart page →

3,837
test-helm-app1saam-helm-test0.1.01 of 1See more

test-helm-app1 saam-helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
hamidyousefi93/saam-test:latestc34f071f6ed0
anyio@3.7.1
4.14.2

Open the chart page →

3,952
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
anyio@4.2.0
4.14.2

Open the chart page →

10,296
search-proxysearch-proxy2026.38.01 of 1See more

search-proxy search-proxy 2026.38.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/unique-ag/ai/search-proxy:2026.38.0aa6699b027bb
anyio@4.13.0
4.14.2

Open the chart page →

1,348
first-chartshashkist-test0.1.01 of 3See more

first-chart shashkist-test 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
shashkist/flask-contacts-app:latest581de1fd6084
anyio@4.6.0
4.14.2

Open the chart page →

3,108
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
anyio@4.8.0
4.14.2

Open the chart page →

5,318
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
anyio@3.7.1
4.14.2

Open the chart page →

5,648
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.24a2259b098b13
anyio@4.9.0
4.14.2

Open the chart page →

8,185
spoolmanspoolmanVerified publisher0.2.61 of 1See more

spoolman spoolman 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/donkie/spoolman:0.26.1cf9b41e17b93
anyio@4.14.1
4.14.2

Open the chart page →

1,848
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
anyio@4.12.1
4.14.2

Open the chart page →

1,616
servicexssl-hep1.8.52 of 16See more

servicex ssl-hep 1.8.5

2 of the 16 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
sslhep/servicex-did-finder:v1.8.5ab0090083567
anyio@4.14.1
4.14.2
sslhep/x509-secrets:v1.8.5d9e9ecb12d59
anyio@4.14.1
4.14.2

Open the chart page →

69,027
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
anyio@4.3.0
4.14.2

Open the chart page →

13,546
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
anyio@4.13.0
4.14.2

Open the chart page →

3,516
svc-lb-muxsvc-lb-mux0.1.31 of 1See more

svc-lb-mux svc-lb-mux 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
anyio@4.13.0
4.14.2

Open the chart page →

1,475
take-the-helmtake-the-helm0.1.01 of 1See more

take-the-helm take-the-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
cadmusthefounder/lnd:take-the-helm-0.1.0e596c5fbf80f
anyio@3.6.1
4.14.2

Open the chart page →

821
tarkatarkaOfficialVerified publisher0.4.11 of 4See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
anyio@4.12.1
4.14.2

Open the chart page →

1,584
flask-contactstest-configmap1.0.11 of 3See more

flask-contacts test-configmap 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
shashkist/flask-contacts-app:latest581de1fd6084
anyio@4.6.0
4.14.2

Open the chart page →

5,884
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
anyio@4.5.0
4.14.2

Open the chart page →

4,460
chatqnatest-opea1.0.05 of 11See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
anyio@4.5.0
4.14.2
opea/embedding-tei:1.05c9639de61c1
anyio@4.5.0
4.14.2
opea/llm-tgi:1.00c25aab3f106
anyio@4.5.0
4.14.2
opea/reranking-tei:1.0e48613afb191
anyio@4.5.0
4.14.2
opea/retriever-redis:1.0eb746b263705
anyio@4.5.0
4.14.2

Open the chart page →

39,639
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
anyio@4.5.0
4.14.2
opea/llm-tgi:1.00c25aab3f106
anyio@4.5.0
4.14.2

Open the chart page →

29,111
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
anyio@4.5.0
4.14.2
opea/llm-tgi:1.00c25aab3f106
anyio@4.5.0
4.14.2

Open the chart page →

28,683
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
anyio@4.5.0
4.14.2
opea/llm-docsum-tgi:1.002f9e8fa5d71
anyio@4.5.0
4.14.2

Open the chart page →

29,157
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
anyio@4.5.0
4.14.2

Open the chart page →

5,263
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
anyio@4.5.0
4.14.2

Open the chart page →

5,299
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
anyio@4.5.0
4.14.2

Open the chart page →

4,797
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
anyio@4.5.0
4.14.2

Open the chart page →

5,063
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
anyio@4.5.0
4.14.2

Open the chart page →

5,276
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
anyio@4.5.0
4.14.2

Open the chart page →

9,713
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
anyio@4.5.0
4.14.2

Open the chart page →

4,443
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
anyio@4.5.0
4.14.2

Open the chart page →

5,445
kasa-exporterth-chartsVerified publisher0.1.01 of 1See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
thelande/kasa_exporter:v0.2.3a1fdb8baa152
anyio@4.4.0
4.14.2

Open the chart page →

1,531
tfy-grafanatruefoundryVerified publisher0.1.211 of 3See more

tfy-grafana truefoundry 0.1.21

1 of the 3 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
anyio@4.11.0
4.14.2

Open the chart page →

1,082
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
anyio@4.11.0
4.14.2

Open the chart page →

4,598
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
anyio@4.10.0
4.14.2

Open the chart page →

7,779
waldur-site-agentwaldur-site-agentVerified publisher1.0.71 of 1See more

waldur-site-agent waldur-site-agent 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
opennode/waldur-site-agent:1.0.76d2e3b97c8d2
anyio@4.12.1
4.14.2

Open the chart page →

551
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.45a065930682d
anyio@4.1.0
4.14.2

Open the chart page →

5,616
dingtalk-botxxl-job-adminVerified publisher0.1.21 of 2See more

dingtalk-bot xxl-job-admin 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
anyio@4.12.0
4.14.2

Open the chart page →

3,180
kadalu-operatorxxl-job-adminVerified publisher1.2.42 of 4See more

kadalu-operator xxl-job-admin 1.2.4

2 of the 4 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
kadalu/kadalu-csi:1.2.0af8d470b0ef3
anyio@3.7.1
4.14.2
kadalu/kadalu-operator:1.2.03726d7a805f2
anyio@3.7.1
4.14.2

Open the chart page →

4,926

Container images carrying it

260 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
anyio@4.14.0
4.14.2
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
anyio@4.12.0
4.14.2
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
anyio@4.4.0
4.14.2
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
anyio@4.9.0
4.14.2
1

syft 1.42.1 · advisories as of 19 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.