StackRadar

CVE-2026-89610

Critical

Advisory

Published 11 Sept 2026In the index since 22 Oct 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
184
of 18,219 indexed, latest versions
Container images
181
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 184 of 18,219 indexed charts deploy, on 181 images.

Affected packageAffected versionsFixed inImages
linuxdeb6.1.27-1, 6.1.37-1, 6.1.38-4, 6.1.52-1+31 moreno fix listed181
OSV records
DEBIAN-CVE-2026-89610

Charts affected

184 by stars
ChartLatestAffected imagesRadar Score
node-appbryopsida0.5.11 of 2See more

node-app bryopsida 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
library/node:lts3d27e5c11e57
linux@6.1.187-1
no fix listed

Open the chart page →

102,139
tetragon-policy-buildercamptocamp30.1.11 of 1See more

tetragon-policy-builder camptocamp3 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/camptocamp/tetragon-policy-builder:master0e99f12bb040
linux@6.1.128-1
no fix listed

Open the chart page →

69,126
caninecanine0.1.101 of 7See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/caninehq/canine:latest70d5fa5a3fd8
linux@6.1.99-1
no fix listed

Open the chart page →

83,591
chart-dnazarenochart-dnazareno0.1.01 of 3See more

chart-dnazareno chart-dnazareno 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
library/phpmyadmin:5.2.16e75aa8f767c
linux@6.1.123-1
no fix listed

Open the chart page →

64,672
metaflowcluster-deploy0.2.21 of 1See more

metaflow cluster-deploy 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
linux@6.1.115-1
no fix listed

Open the chart page →

70,775
pbcore-utilcluster-deploy0.0.11 of 1See more

pbcore-util cluster-deploy 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
linux@6.1.159-1
no fix listed

Open the chart page →

57,221
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
linux@6.1.129-1
no fix listed

Open the chart page →

72,928
rtcsic-charts0.1.11 of 5See more

rt csic-charts 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
firefart/requesttracker:5.0.40d6249906d8c
linux@6.1.55-1
no fix listed

Open the chart page →

94,712
cspconsolecspconsole1.3.111 of 5See more

cspconsole cspconsole 1.3.11

1 of the 5 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
cspconsole/csp-control-center:1.0.1046dda4a31bd6
linux@6.1.164-1
no fix listed

Open the chart page →

57,822
jupyterhubd4nVerified publisher3.3.71 of 7See more

jupyterhub d4n 3.3.7

1 of the 7 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
linux@6.1.90-1
no fix listed

Open the chart page →

89,458
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
linux@6.1.162-1
no fix listed

Open the chart page →

50,688
db-connection-testdb-connection-testVerified publisher0.1.01 of 1See more

db-connection-test db-connection-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
felipecs8/app-db-connection-test:v129e06c9c6385
linux@6.1.119-1
no fix listed

Open the chart page →

71,105
linkdingdeimosfr-charts1.0.31 of 1See more

linkding deimosfr-charts 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.35.00c5dddf0b37c
linux@6.1.106-3
no fix listed

Open the chart page →

71,264
supersetdeliveryheroVerified publisher1.1.31 of 1See more

superset deliveryhero 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
linux@6.1.180-1
no fix listed

Open the chart page →

30,618
devtron-enterprisedevtron48.0.02 of 28See more

devtron-enterprise devtron 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
quay.io/devtron/devtron-utils:dup-chart-repo-v1.1.095d6f0e05636
linux@6.1.55-1
no fix listed
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
linux@6.1.153-1
no fix listed

Open the chart page →

217,278
devtron-enterprisedevtron-labs48.0.02 of 28See more

devtron-enterprise devtron-labs 48.0.0

2 of the 28 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
quay.io/devtron/devtron-utils:dup-chart-repo-v1.1.095d6f0e05636
linux@6.1.55-1
no fix listed
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
linux@6.1.153-1
no fix listed

Open the chart page →

217,278
devtron-operatordevtron-labs0.23.31 of 11See more

devtron-operator devtron-labs 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
quay.io/devtron/devtron-utils:dup-chart-repo-v1.1.095d6f0e05636
linux@6.1.55-1
no fix listed

Open the chart page →

119,903
domainmoddjjudas21Verified publisher1.0.01 of 1See more

domainmod djjudas21 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
domainmod/domainmod:4.23.04017bfe4c597
linux@6.1.38-4
no fix listed

Open the chart page →

88,652
wizarrdjjudas21Verified publisher0.1.51 of 1See more

wizarr djjudas21 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
linux@6.1.55-1
no fix listed

Open the chart page →

92,689
monitoring-proxyenixVerified publisher0.3.01 of 2See more

monitoring-proxy enix 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
library/haproxy:2.9.6fc5748ff7c72
linux@6.1.76-1
no fix listed

Open the chart page →

78,681
matomoeosc-lot-1Verified publisher0.2.01 of 1See more

matomo eosc-lot-1 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
library/matomo:5.1.2-apache2415789e1602
linux@6.1.119-1
no fix listed

Open the chart page →

65,941
beeport-uiethersphereVerified publisher0.76.21 of 3See more

beeport-ui ethersphere 0.76.2

1 of the 3 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
library/node:lts14078204b6bb
linux@6.1.187-1
no fix listed

Open the chart page →

29,262
multichain-uiethersphereVerified publisher0.73.11 of 3See more

multichain-ui ethersphere 0.73.1

1 of the 3 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
library/node:lts14078204b6bb
linux@6.1.187-1
no fix listed

Open the chart page →

29,189
ferriscompanyferriscompany0.1.01 of 1See more

ferriscompany ferriscompany 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/libreconnect/ferriscompany:0.1.0-rc6ed86db9f0efe
linux@6.1.112-1
no fix listed

Open the chart page →

75,184
business-api-ecosystemfiware1.2.01 of 4See more

business-api-ecosystem fiware 1.2.0

1 of the 4 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
linux@6.1.137-1
no fix listed

Open the chart page →

171,843
flyteconnectorflyte2.0.01 of 1See more

flyteconnector flyte 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
linux@6.1.172-1
no fix listed

Open the chart page →

43,553
frinx-machinefrinx-helm-charts11.0.01 of 26See more

frinx-machine frinx-helm-charts 11.0.0

1 of the 26 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
frinx/resource-manager:6.1.09cd0147a09bd
linux@6.1.76-1
no fix listed

Open the chart page →

126,588
resource-managerfrinx-helm-charts2.3.11 of 4See more

resource-manager frinx-helm-charts 2.3.1

1 of the 4 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
frinx/resource-manager:6.1.09cd0147a09bd
linux@6.1.76-1
no fix listed

Open the chart page →

84,283
mopidygeek-cookbookVerified publisher0.1.21 of 1See more

mopidy geek-cookbook 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
jaedb/iris:latest048cfbf58d57
linux@6.1.135-1
no fix listed

Open the chart page →

68,311
glpiglpi-chart0.1.11 of 3See more

glpi glpi-chart 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
vdiogov/glpi-conteiner:latest6945f84f0058
linux@6.1.99-1
no fix listed

Open the chart page →

79,143
opentelemetry-demogpg-dev0.33.82 of 27See more

opentelemetry-demo gpg-dev 0.33.8

2 of the 27 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-quoteservice87eb325d306f
linux@6.1.112-1
no fix listed
ghcr.io/open-telemetry/demo:1.12.0-emailservicea1f5cebb5240
linux@6.1.69-1
no fix listed

Open the chart page →

196,721
heliconehelicone0.1.421 of 14See more

helicone helicone 0.1.42

1 of the 14 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
helicone/supabase-migration-runner:v2025.03.05-14a913936c97b
linux@6.1.52-1
no fix listed

Open the chart page →

156,820
kube-downscalerhelm-charts-nr0.7.61 of 1See more

kube-downscaler helm-charts-nr 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
linux@6.1.27-1
no fix listed

Open the chart page →

88,003
supersethelm-charts-nr1.1.31 of 1See more

superset helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
linux@6.1.180-1
no fix listed

Open the chart page →

30,618
drupalhelmforgeVerified publisher1.2.181 of 2See more

drupal helmforge 1.2.18

1 of the 2 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
library/drupal:11.4.10-php8.5-apache-bookworm116fbf35120e
linux@6.1.190-1
no fix listed

Open the chart page →

17,609
middlewarehelmforgeVerified publisher1.2.111 of 4See more

middleware helmforge 1.2.11

1 of the 4 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
middlewareeng/middleware:0.3.1747d880812f1
linux@6.1.140-1
no fix listed

Open the chart page →

63,628
moodlehelmforgeVerified publisher1.1.51 of 2See more

moodle helmforge 1.1.5

1 of the 2 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
moodlehq/moodle-php-apache:8.4-bookworm922af5166835
linux@6.1.180-1
no fix listed

Open the chart page →

34,592
opensignhelmforgeVerified publisher1.0.01 of 3See more

opensign helmforge 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
opensign/opensigndigest-pinned0ebc230eed21
linux@6.1.129-1
no fix listed

Open the chart page →

69,345
supersethelmforgeVerified publisher1.4.21 of 5See more

superset helmforge 1.4.2

1 of the 5 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
linux@6.1.180-1
no fix listed

Open the chart page →

34,432
myapphelmingapp0.1.01 of 1See more

myapp helmingapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
muhammedgamal/fp23:latest74b4cd69b6fa
linux@6.1.90-1
no fix listed

Open the chart page →

83,061
openaevhelm-openbasVerified publisher2.0.151 of 7See more

openaev helm-openbas 2.0.15

1 of the 7 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
linux@6.1.128-1
no fix listed

Open the chart page →

79,005
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
linux@6.1.128-1
no fix listed

Open the chart page →

83,823
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
linux@6.1.137-1
no fix listed

Open the chart page →

67,147
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
linux@6.1.69-1
no fix listed

Open the chart page →

96,413
daveit-at-mOfficialVerified publisher0.2.191 of 9See more

dave it-at-m 0.2.19

1 of the 9 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
linux@6.1.147-1
no fix listed

Open the chart page →

66,817
jasperjasperVerified publisher1.0.2111 of 2See more

jasper jasper 1.0.211

1 of the 2 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/cjmalloy/jasper:v1.3.282726a947bb65b
linux@6.1.180-1
no fix listed

Open the chart page →

37,503
esphomejeffrescVerified publisher0.2.21 of 1See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.4.078a82d810709
linux@6.1.164-1
no fix listed

Open the chart page →

50,047
image-storage-servicejtektVerified publisher0.5.11 of 4See more

image-storage-service jtekt 0.5.1

1 of the 4 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
linux@6.1.112-1
no fix listed

Open the chart page →

88,914
shinsei-managerjtektVerified publisher0.2.04 of 8See more

shinsei-manager jtekt 0.2.0

4 of the 8 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
moreillon/api-proxy:latestd7d4a5463525
linux@6.1.137-1
no fix listed
moreillon/group-manager:latest3caa8f710ee0
linux@6.1.164-1
no fix listed
moreillon/user-manager:v5.0.2e1c9bfab5c16
linux@6.1.55-1
no fix listed
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
linux@6.1.90-1
no fix listed

Open the chart page →

314,677
time-series-storagejtektVerified publisher0.1.101 of 2See more

time-series-storage jtekt 0.1.10

1 of the 2 container images this version deploys carry CVE-2026-89610.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
linux@6.1.55-1
no fix listed

Open the chart page →

96,052

Container images carrying it

181 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
linux@6.1.128-1
no fix listed
1
ghcr.io/krateoplatformops/deployment-service:1.2.59da9f93f2f731
linux@6.1.76-1
no fix listed
1
ghcr.io/krateoplatformops/finops-database-handler:0.5.32550427988e3
linux@6.1.90-1
no fix listed
1
ghcr.io/krateoplatformops/finops-webservice-api-mock:0.1.00877e9452d14
linux@6.1.76-1
no fix listed
1
ghcr.io/krateoplatformops/terminal-client:0.1.36c7c965e739c
linux@6.1.99-1
no fix listed
1
ghcr.io/krateoplatformops/terminal-server:0.1.3f5fd8ba6fea3
linux@6.1.99-1
no fix listed
1
ghcr.io/libreconnect/ferriscompany:0.1.0-rc6ed86db9f0efe
linux@6.1.112-1
no fix listed
1
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
linux@6.1.124-1
no fix listed
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
linux@6.1.158-1
no fix listed
1
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
linux@6.1.99-1
no fix listed
1
ghcr.io/opencost/opencost-parquet-exporter:v0.2.1ce85ef0ce665
linux@6.1.124-1
no fix listed
1
ghcr.io/open-telemetry/demo:1.12.0-quoteservice87eb325d306f
linux@6.1.112-1
no fix listed
1
ghcr.io/open-telemetry/demo:1.12.0-emailservicea1f5cebb5240
linux@6.1.69-1
no fix listed
1
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
linux@6.1.27-1
no fix listed
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
linux@6.1.123-1
no fix listed
1
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
linux@6.1.140-1
no fix listed
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
linux@6.1.159-1
no fix listed
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
linux@6.1.55-1
no fix listed
1
ghcr.io/wundergraph/cosmo/otelcollector:0.18.15a6fe78d4d15
linux@6.1.124-1
no fix listed
1
ghcr.io/zoriya/kyoo_autosync:4.7.1fbba58ddb1a6
linux@6.1.119-1
no fix listed
1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
linux@6.1.119-1
no fix listed
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
linux@6.1.90-1
no fix listed
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
linux@6.1.112-1
no fix listed
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
linux@6.1.90-1
no fix listed
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
linux@6.1.55-1
no fix listed
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
linux@6.1.115-1
no fix listed
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
linux@6.1.69-1
no fix listed
1
quay.io/mittwald/kube-httpcache:stable2169032c5840
linux@6.1.140-1
no fix listed
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
linux@6.1.38-4
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
linux@6.1.172-1
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
linux@6.1.174-1
no fix listed
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.