StackRadar

CVE-2026-90802

Medium

Advisory

Published 14 Sept 2026In the index since 15 Sept 2026
Severity
Medium
worst across findings
CVSS
4.4
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
235
of 17,787 indexed, latest versions
Container images
236
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 235 of 17,787 indexed charts deploy, on 236 images.

Affected packageAffected versionsFixed inImages
binutilsdeb2.40-2, 2.44-3no fix listed236
OSV records
DEBIAN-CVE-2026-90802
Trending
Rank 49 in indexed charts, since 15 Sept 2026. See the ranking →

Charts affected

235 by stars
ChartLatestAffected imagesRadar Score
matomohelmforgeVerified publisher2.3.01 of 3See more

matomo helmforge 2.3.0

1 of the 3 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
library/matomo:5.13.0-apache8e6bdd396496
binutils@2.44-3
no fix listed

Open the chart page →

2,711
iris-webappiris-webapp0.2.41 of 2See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
binutils@2.44-3
no fix listed

Open the chart page →

11,794
glpikitsune-itopsVerified publisher1.0.71 of 3See more

glpi kitsune-itops 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
glpi/glpi:latest4b681082a79e
binutils@2.44-3
no fix listed

Open the chart page →

4,878
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
binutils@2.40-2
no fix listed

Open the chart page →

13,763
helm-composenousefreakVerified publisher0.1.31 of 2See more

helm-compose nousefreak 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
library/wordpress:latest5a93c470ae82
binutils@2.44-3
no fix listed

Open the chart page →

14,324
opentelemetry-demoopentelemetry-helmVerified publisher0.41.13 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

3 of the 34 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.0.0-mcp654f860148ba
binutils@2.44-3
no fix listed
ghcr.io/open-telemetry/demo:3.0.0-chatbot66ba53497f1f
binutils@2.44-3
no fix listed
ghcr.io/open-telemetry/demo:3.0.0-agentdf5ee05e23e3
binutils@2.44-3
no fix listed

Open the chart page →

22,678
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
binutils@2.40-2
no fix listed

Open the chart page →

6,899
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
binutils@2.44-3
no fix listed

Open the chart page →

7,075
matomopockostVerified publisher1.3.01 of 3See more

matomo pockost 1.3.0

1 of the 3 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
pockost/matomo:5.13.07f5d293cbe4e
binutils@2.44-3
no fix listed

Open the chart page →

5,102
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
binutils@2.40-2
no fix listed

Open the chart page →

31,949
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
binutils@2.40-2
no fix listed

Open the chart page →

8,203
kimai2robjuz5.0.141 of 2See more

kimai2 robjuz 5.0.14

1 of the 2 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
kimai/kimai2:2.67.03084f1e5ecdc
binutils@2.40-2
no fix listed

Open the chart page →

4,508
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
binutils@2.40-2
no fix listed

Open the chart page →

5,508
fluent-bitromanow-helm-chartsVerified publisher1.7.31 of 1See more

fluent-bit romanow-helm-charts 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
fluent/fluent-bit:4.0-debuge76397ef3983
binutils@2.40-2
no fix listed

Open the chart page →

7,767
kyoorubxkubeVerified publisher0.1.102 of 9See more

kyoo rubxkube 0.1.10

2 of the 9 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
ghcr.io/zoriya/kyoo_autosync:4.7.1fbba58ddb1a6
binutils@2.40-2
no fix listed
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
binutils@2.40-2
no fix listed

Open the chart page →

30,310
securosecuroVerified publisher0.15.11 of 4See more

securo securo 0.15.1

1 of the 4 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
ghcr.io/securo-finance/securo-backend:0.15.162e030110745
binutils@2.44-3
no fix listed

Open the chart page →

3,350
sogosogoVerified publisher0.3.51 of 2See more

sogo sogo 0.3.5

1 of the 2 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
sonroyaalmerol/docker-sogo:5.12.43f60f3abe990
binutils@2.44-3
no fix listed

Open the chart page →

7,157
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
binutils@2.40-2
no fix listed

Open the chart page →

18,213
tocktock0.6.31 of 9See more

tock tock 0.6.3

1 of the 9 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
binutils@2.44-3
no fix listed

Open the chart page →

12,910
typemilltypemill-helm-chart2.2.02 of 2See more

typemill typemill-helm-chart 2.2.0

2 of the 2 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
kixote/typemilldigest-pinned4e9dff179519
binutils@2.44-3
no fix listed
kixote/typemilldigest-pinned628f79a08cc7
binutils@2.44-3
no fix listed

Open the chart page →

5,402
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
binutils@2.40-2
no fix listed

Open the chart page →

12,137
varnish-cachevarnishVerified publisher1.1.11 of 1See more

varnish-cache varnish 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
library/varnish:7.5.04d0bb287d87b
binutils@2.40-2
no fix listed

Open the chart page →

4,022
varnish-ingress-controllervarnish-ingress-controllerVerified publisher0.5.01 of 1See more

varnish-ingress-controller varnish-ingress-controller 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
mariusm/vingress:0.5.0b3db186c3d72
binutils@2.44-3
no fix listed

Open the chart page →

2,282
wordpress-e2e-setupwoocommerce-e2e-setup0.1.11 of 2See more

wordpress-e2e-setup woocommerce-e2e-setup 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
library/wordpress:6.8-apache30bff39330d1
binutils@2.44-3
no fix listed

Open the chart page →

7,728
wordpress-helmwordpress-helm0.2.91 of 4See more

wordpress-helm wordpress-helm 0.2.9

1 of the 4 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
binutils@2.44-3
no fix listed

Open the chart page →

8,139
zcash-stackzcashVerified publisher0.4.51 of 2See more

zcash-stack zcash 0.4.5

1 of the 2 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
electriccoinco/lightwalletd:v0.5.42ae3a551e111
binutils@2.44-3
no fix listed

Open the chart page →

2,866
esphomealekcVerified publisher2.8.11 of 1See more

esphome alekc 2.8.1

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
esphome/esphome:2026.8.285abea33854b
binutils@2.44-3
no fix listed

Open the chart page →

3,143
anchore-admission-controlleranchore-charts0.8.51 of 2See more

anchore-admission-controller anchore-charts 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
cfssl/cfssl:v1.6.5c9018c2ddf0b
binutils@2.40-2
no fix listed

Open the chart page →

7,559
mathesarandrenarchyVerified publisher1.8.01 of 1See more

mathesar andrenarchy 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
mathesar/mathesar:0.12.0091757cb01fe
binutils@2.40-2
no fix listed

Open the chart page →

7,265
speech-to-phraseandrenarchyVerified publisher1.3.01 of 1See more

speech-to-phrase andrenarchy 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
rhasspy/wyoming-speech-to-phrase:1.4.3e532f0dbc6b2
binutils@2.40-2
no fix listed

Open the chart page →

3,872
ddosifyanteonVerified publisher1.7.52 of 13See more

ddosify anteon 1.7.5

2 of the 13 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
binutils@2.40-2
no fix listed
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
binutils@2.40-2
no fix listed

Open the chart page →

25,720
dokuwikiarea-42Verified publisher0.1.81 of 1See more

dokuwiki area-42 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
dokuwiki/dokuwiki:2025-05-14af08ecfdda239
binutils@2.44-3
no fix listed

Open the chart page →

7,521
arlas-aiasarlas-stackVerified publisher28.8.01 of 22See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
binutils@2.40-2
no fix listed

Open the chart page →

40,411
smartorchestratorassist-iot-smart-orchestrator4.0.03 of 14See more

smartorchestrator assist-iot-smart-orchestrator 4.0.0

3 of the 14 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
binutils@2.40-2
no fix listed
assistiot/smart-orchestrator_scheduler:latest38b003e55ff3
binutils@2.40-2
no fix listed
assistiot/smart-orchestrator_scheduler_mc:latestb1dbe4d62a03
binutils@2.40-2
no fix listed

Open the chart page →

42,460
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
binutils@2.40-2
no fix listed

Open the chart page →

31,807
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
binutils@2.40-2
no fix listed

Open the chart page →

10,171
colosseumbook-k8sinfra-v21.0.182 of 5See more

colosseum book-k8sinfra-v2 1.0.18

2 of the 5 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-cms:loge74b43c7f492
binutils@2.40-2
no fix listed
sysnet4admin/colosseum-prm:log5802bfcd7fed
binutils@2.40-2
no fix listed

Open the chart page →

26,266
node-appbryopsida0.5.11 of 2See more

node-app bryopsida 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
library/node:ltsbe23f54a88d3
binutils@2.40-2
no fix listed

Open the chart page →

14,446
tetragon-policy-buildercamptocamp30.1.11 of 1See more

tetragon-policy-builder camptocamp3 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
ghcr.io/camptocamp/tetragon-policy-builder:master0e99f12bb040
binutils@2.40-2
no fix listed

Open the chart page →

10,318
chart-dnazarenochart-dnazareno0.1.01 of 3See more

chart-dnazareno chart-dnazareno 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
library/phpmyadmin:5.2.16e75aa8f767c
binutils@2.40-2
no fix listed

Open the chart page →

5,528
polrchristianhuthVerified publisher4.3.01 of 2See more

polr christianhuth 4.3.0

1 of the 2 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
bitnamilegacy/mysql:9.4.0-debian-12-r1ec13e229247a
binutils@2.40-2
no fix listed

Open the chart page →

5,936
kamaji-etcdclastixVerified publisher0.17.01 of 4See more

kamaji-etcd clastix 0.17.0

1 of the 4 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
cfssl/cfssl:latestc9018c2ddf0b
binutils@2.40-2
no fix listed

Open the chart page →

12,021
metaflowcluster-deploy0.2.21 of 1See more

metaflow cluster-deploy 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
binutils@2.40-2
no fix listed

Open the chart page →

7,521
pbcore-utilcluster-deploy0.0.11 of 1See more

pbcore-util cluster-deploy 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
binutils@2.40-2
no fix listed

Open the chart page →

8,806
cohdicohdi0.2.21 of 3See more

cohdi cohdi 0.2.2

1 of the 3 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
ghcr.io/cohdi/composable-dra-driver:v0.2.28c05f7366981
binutils@2.44-3
no fix listed

Open the chart page →

3,680
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
binutils@2.40-2
no fix listed

Open the chart page →

14,587
cspconsolecspconsole1.3.111 of 5See more

cspconsole cspconsole 1.3.11

1 of the 5 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
cspconsole/csp-control-center:1.0.1046dda4a31bd6
binutils@2.40-2
no fix listed

Open the chart page →

11,891
jupyterhubd4nVerified publisher3.3.71 of 7See more

jupyterhub d4n 3.3.7

1 of the 7 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
binutils@2.40-2
no fix listed

Open the chart page →

16,632
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
binutils@2.40-2
no fix listed

Open the chart page →

4,914
db-connection-testdb-connection-testVerified publisher0.1.01 of 1See more

db-connection-test db-connection-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-90802.

Container imageDigestPackageFixed in
felipecs8/app-db-connection-test:v129e06c9c6385
binutils@2.40-2
no fix listed

Open the chart page →

10,116

Container images carrying it

236 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/python:3.9da5aee29682d
binutils@2.44-3
no fix listed
1
library/varnish:7.5.04d0bb287d87b
binutils@2.40-2
no fix listed
1
library/wordpress:6.4.3-apache8ae66efb09a2
binutils@2.40-2
no fix listed
1
library/wordpress:6.9.4-fpmad4a8bae2eb4
binutils@2.44-3
no fix listed
1
library/wordpress:php8.1-apachef73396626d2f
binutils@2.44-3
no fix listed
1
localstack/localstack:latest3fe5b51caec8
binutils@2.44-3
no fix listed
1
makersquad/harp-proxy:0.8.1a40dd258c527
binutils@2.40-2
no fix listed
1
mariusm/vingress:0.5.0b3db186c3d72
binutils@2.44-3
no fix listed
1
martinhelmich/typo3:12.4c83a4f3fd7ae
binutils@2.40-2
no fix listed
1
mathesar/mathesar:0.12.0091757cb01fe
binutils@2.40-2
no fix listed
1
mautic/mautic:7-apacheeb8cc73d97e1
binutils@2.40-2
no fix listed
1
middlewareeng/middleware:0.3.1747d880812f1
binutils@2.40-2
no fix listed
1
mindsdb/mindsdb:latest163011c09299
binutils@2.44-3
no fix listed
1
mintproject/model-catalog-fastapi:7dd88dc5bf1fe6a6d4703ea0a077afee45cb256102260d20a21f
binutils@2.40-2
no fix listed
1
moodlehq/moodle-php-apache:8.4-bookworm922af5166835
binutils@2.40-2
no fix listed
1
moreillon/api-proxy:latestd7d4a5463525
binutils@2.40-2
no fix listed
1
moreillon/food-manager:lateste8fd856e593d
binutils@2.40-2
no fix listed
1
moreillon/group-manager:latest3caa8f710ee0
binutils@2.40-2
no fix listed
1
moreillon/user-manager-mongoose:v5.0.1d2ee0423b797
binutils@2.40-2
no fix listed
1
muhammedgamal/fp23:latest74b4cd69b6fa
binutils@2.40-2
no fix listed
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
binutils@2.44-3
no fix listed
1
oled01/automx2:2025.1.105d3e398e675
binutils@2.40-2
no fix listed
1
oneuptime/probe:release6b2d98713711
binutils@2.40-2
no fix listed
1
oneuptime/runner:release4accc516d800
binutils@2.44-3
no fix listed
1
opea/codegen-ui:1.02bee4eb66f3e
binutils@2.40-2
no fix listed
1
opea/codetrans-ui:1.03ef121f34610
binutils@2.40-2
no fix listed
1
opea/docsum-ui:1.07f854e9bffaf
binutils@2.40-2
no fix listed
1
openbas/caldera-server:5.1.0a277796d9724
binutils@2.40-2
no fix listed
1
openebs/rawfile-localpv:v0.15.2a39ef27ea28b
binutils@2.44-3
no fix listed
1
openproject/hocuspocus:release-338001b288dc1359dfb5
binutils@2.40-2
no fix listed
1
phan2410/dummy-service:0.0.89c6ed6de26ca
binutils@2.40-2
no fix listed
1
phan2410/falcon-asgi-server:0.1.04a86d138832d
binutils@2.40-2
no fix listed
1
phpmyadmin/phpmyadmin:5.2.342a200db07b4
binutils@2.44-3
no fix listed
1
pockost/matomo:5.13.07f5d293cbe4e
binutils@2.44-3
no fix listed
1
polyaxon/polyaxon-api:2.16.42b55c3265a90
binutils@2.44-3
no fix listed
1
polyaxon/polyaxon-streams:2.16.4c186bd9834c0
binutils@2.44-3
no fix listed
1
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
binutils@2.40-2
no fix listed
1
prefecthq/prefect:3.8.6-python3.11f518ebb9c353
binutils@2.44-3
no fix listed
1
pretix/standalone:2026.7.05df3b7aa852e
binutils@2.44-3
no fix listed
1
prowlercloud/prowler-api:5.31.14f252d579be2
binutils@2.40-2
no fix listed
1
qjoly/kubernetes-coffee-image:simpleec94d3bdc035
binutils@2.44-3
no fix listed
1
redash/redash:25.8.000d813437db5
binutils@2.40-2
no fix listed
1
redash/redash:26.3.0c5c9148f5c38
binutils@2.40-2
no fix listed
1
rhasspy/wyoming-speech-to-phrase:1.4.3e532f0dbc6b2
binutils@2.40-2
no fix listed
1
rocketadmin/rocketadmin:1.17.710955ef540b9
binutils@2.40-2
no fix listed
1
rocketchat/freeswitch:stablecfba5c20a5cc
binutils@2.40-2
no fix listed
1
roundcube/roundcubemail:1.6.16-apache-nonroot17d9d9580962
binutils@2.44-3
no fix listed
1
rspamd/rspamd:4.1.4e870599c970d
binutils@2.44-3
no fix listed
1
ryshe/terraria:latestb1c89f7f359a
binutils@2.40-2
no fix listed
1
santisbon/evwatcher:latestc4e994ca4540
binutils@2.40-2
no fix listed
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.