StackRadar

CVE-2026-91187

Critical

Advisory

Published 24 Sept 2026In the index since 25 Sept 2026
Severity
Critical
worst across findings
CVSS
9.3
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,255
of 17,879 indexed, latest versions
Container images
1,187
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 1,255 of 17,879 indexed charts deploy, on 1,187 images.

Affected packageAffected versionsFixed inImages
dashdeb0.5.7-4ubuntu1, 0.5.8-2.1ubuntu2, 0.5.8-2.10, 0.5.10.2-6+3 moreno fix listed1,187
OSV records
UBUNTU-CVE-2026-91187
Trending
Rank 1 in indexed charts, since 25 Sept 2026. See the ranking →

Charts affected

1,255 by stars
ChartLatestAffected imagesRadar Score
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-91187.

Container imageDigestPackageFixed in
library/mongo:latest5d7043a4ffe0
dash@0.5.12-6ubuntu5
no fix listed

Open the chart page →

13,942
xlinexline0.0.11 of 1See more

xline xline 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-91187.

Container imageDigestPackageFixed in
ghcr.io/liangyuanpeng/xline:latest3d2eceb44a3b
dash@0.5.12-6ubuntu5
no fix listed

Open the chart page →

2,284
nightingalexxl-job-adminVerified publisher0.2.111 of 6See more

nightingale xxl-job-admin 0.2.11

1 of the 6 container images this version deploys carry CVE-2026-91187.

Container imageDigestPackageFixed in
flashcatcloud/categraf:latest42e6ab16472e
dash@0.5.12-6ubuntu5
no fix listed

Open the chart page →

10,111
clickhousezloi-space1.2.02 of 3See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-91187.

Container imageDigestPackageFixed in
yandex/clickhouse-client:21.3863f94a0f607
dash@0.5.8-2.10
no fix listed
yandex/clickhouse-server:21.3.204eccfffb01d7
dash@0.5.10.2-6
no fix listed

Open the chart page →

9,550
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-91187.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed

Open the chart page →

8,389

Container images carrying it

1,187 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
zabbix/zabbix-server-mysql:ubuntu-6.4-latest55d074b6b031
dash@0.5.12-6ubuntu5
no fix listed
1
zabbix/zabbix-server-pgsql:ubuntu-5.4.66c946b1f45cd
dash@0.5.10.2-6
no fix listed
1
zabbix/zabbix-server-pgsql:ubuntu-7.0.237e8c8e059533
dash@0.5.12-6ubuntu5
no fix listed
1
zabbix/zabbix-server-pgsql:ubuntu-6.0.8d59ffa07f615
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
zabbix/zabbix-web-nginx-mysql:ubuntu-6.4-latest0e5f69c4c54e
dash@0.5.12-6ubuntu5
no fix listed
1
zabbix/zabbix-web-nginx-pgsql:ubuntu-5.4.601de79c31391
dash@0.5.10.2-6
no fix listed
1
zabbix/zabbix-web-nginx-pgsql:ubuntu-7.0.237d4d58086515
dash@0.5.12-6ubuntu5
no fix listed
1
zabbix/zabbix-web-nginx-pgsql:ubuntu-6.0.899e9a090b516
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
zabbix/zabbix-web-service:ubuntu-7.0.23915b3183e054
dash@0.5.12-6ubuntu5
no fix listed
1
zabbix/zabbix-web-service:ubuntu-6.0.8ee4baa872280
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
zer0tonin/mikochi:1.12.0f7ee3fe7ee6b
dash@0.5.12-12ubuntu3
no fix listed
1
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
gcr.io/abacus-labs-dev/hyperlane-agent:10c0ab1-20231215-220639f33e88324a40
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
gcr.io/datadoghq/cluster-agent:7.61.06efe04ba4e06
dash@0.5.12-6ubuntu5
no fix listed
1
gcr.io/datadoghq/observability-pipelines-worker:2.22.0b77c432c7bc9
dash@0.5.12-6ubuntu5
no fix listed
1
gcr.io/datadoghq/private-action-runner:v1.21.05f5918f843a4
dash@0.5.12-6ubuntu5
no fix listed
1
gcr.io/flink-operator/deployer:webhook-cert809338a69bd5
dash@0.5.8-2.10
no fix listed
1
gcr.io/google-containers/echoserver:1.910f4dbc8eeeb
dash@0.5.8-2.1ubuntu2
no fix listed
1
gcr.io/google_containers/echoserver:1.10cb5c1bddd1b5
dash@0.5.8-2.1ubuntu2
no fix listed
1
gcr.io/istio-release/pilot:release-1.0-latest-daily5ea7b7f3632a
dash@0.5.8-2.1ubuntu2
no fix listed
1
gcr.io/istio-release/pilot:1.11.1c552478f8f11
dash@0.5.10.2-6
no fix listed
1
gcr.io/istio-release/proxyv2:release-1.0-latest-daily8f9ff98fdbef
dash@0.5.8-2.1ubuntu2
no fix listed
1
gcr.io/istio-release/proxyv2:1.11.19538fabe49fd
dash@0.5.10.2-6
no fix listed
1
gcr.io/istio-testing/install-cni:latestec6f9ea5757b
dash@0.5.12-6ubuntu5
no fix listed
1
gcr.io/istio-testing/operator:latest8d4576f7b98f
dash@0.5.12-6ubuntu5
no fix listed
1
gcr.io/kubecost1/cost-model:prod-1.108.1852f7923fad3
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
gcr.io/ml-pipeline/metadata-envoy:2.0.0-alpha.5e8bc6cf08613
dash@0.5.8-2.1ubuntu2
no fix listed
1
gcr.io/ml-pipeline/metadata-envoy:2.3.0e8e263a919ff
dash@0.5.10.2-6
no fix listed
1
gcr.io/tfx-oss-public/ml_metadata_store_server:1.14.051404ef4419c
dash@0.5.10.2-6
no fix listed
1
gcr.io/tfx-oss-public/ml_metadata_store_server:1.5.0db8691752b4c
dash@0.5.8-2.10
no fix listed
1
ghcr.io/98jan/smalland-server/smalland-server:deveb7be822d5b2
dash@0.5.8-2.10
no fix listed
1
ghcr.io/abcdesktopio/mongo:safe8.09a1f085b0530
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/aetrius/msockperf-client/msockperf-client:main820af919c5e2
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/aetrius/msockperf-server/msockperf-server:main46ae4ea003e0
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/aklivity/zilla:2.4.60b58c2991a23
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/alethic/auth0-operator-image:1.4.122468990a8521
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/alexanderwanyoike/the0/runtime:1.14.7459010a02aff
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/alexmorbo/dell_idrac_fan_controller:v0.1.6-1d110504d551d
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/amoylab/unla/mcp-gateway:latest960cb3cfce77
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/angelnu/tt-rss:2.0.100708ba6617f33c9
dash@0.5.12-12ubuntu3
no fix listed
1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/apache/flink-kubernetes-operator:c703255e9c2ce635b89
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/appscode/s3proxy:sha-a82ca6820518335f9f9
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/astriaorg/hermes:0.5.04f33a0a9f75e
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/base/node-reth:v1.1.18eb6e492fe3c
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/base-org/node:v0.11.11aba0ffe55ea
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/beluga-cloud/jellyfin/jellyfin:10.8.1368f52b993a7f
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/blockscout/smart-contract-verifier:main097e82b3468a
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/brittonhayes/arma-reforger:latest6fde1edc0983
dash@0.5.10.2-6
no fix listed
1

syft 1.42.1 · advisories as of 26 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.