StackRadar

CVE-2026-91187

Critical

Advisory

Published 24 Sept 2026In the index since 25 Sept 2026
Severity
Critical
worst across findings
CVSS
9.3
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,255
of 17,879 indexed, latest versions
Container images
1,187
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 1,255 of 17,879 indexed charts deploy, on 1,187 images.

Affected packageAffected versionsFixed inImages
dashdeb0.5.7-4ubuntu1, 0.5.8-2.1ubuntu2, 0.5.8-2.10, 0.5.10.2-6+3 moreno fix listed1,187
OSV records
UBUNTU-CVE-2026-91187
Trending
Rank 1 in indexed charts, since 25 Sept 2026. See the ranking →

Charts affected

1,255 by stars
ChartLatestAffected imagesRadar Score
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-91187.

Container imageDigestPackageFixed in
library/mongo:latest5d7043a4ffe0
dash@0.5.12-6ubuntu5
no fix listed

Open the chart page →

13,942
xlinexline0.0.11 of 1See more

xline xline 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-91187.

Container imageDigestPackageFixed in
ghcr.io/liangyuanpeng/xline:latest3d2eceb44a3b
dash@0.5.12-6ubuntu5
no fix listed

Open the chart page →

2,284
nightingalexxl-job-adminVerified publisher0.2.111 of 6See more

nightingale xxl-job-admin 0.2.11

1 of the 6 container images this version deploys carry CVE-2026-91187.

Container imageDigestPackageFixed in
flashcatcloud/categraf:latest42e6ab16472e
dash@0.5.12-6ubuntu5
no fix listed

Open the chart page →

10,111
clickhousezloi-space1.2.02 of 3See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-91187.

Container imageDigestPackageFixed in
yandex/clickhouse-client:21.3863f94a0f607
dash@0.5.8-2.10
no fix listed
yandex/clickhouse-server:21.3.204eccfffb01d7
dash@0.5.10.2-6
no fix listed

Open the chart page →

9,550
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-91187.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed

Open the chart page →

8,389

Container images carrying it

1,187 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/radar-base/radar-app-config/radar-app-config:0.6.24431db7b486b
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/radar-base/radar-data-dashboard-backend/radar-data-dashboard-backend:0.2.4d1e55350923c
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/radar-base/radar-gateway/radar-gateway:0.9.4219d894aa7a6
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/radar-base/radar-output-restructure/radar-output-restructure:3.0.67fb9c70e96a4
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/radar-base/radar-schemas/radar-schemas-tools:0.8.16c442e8bfe6b4
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/radar-base/radar-upload-source-connector/radar-upload-connect-backend:0.6.46a04b43b8d9a
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/sergelogvinov/mongosqld:2.14.230b826375ed42
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/sergelogvinov/mongosync:1.15.0fa99ed475f03
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/slskd/slskd:0.25.1ab9ed50e028b
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/smarter-project/audio-client:v3.1.23c8375dc5487
dash@0.5.10.2-6
no fix listed
1
ghcr.io/smarter-project/gstreamer:v1.0.25ecb16015aa8
dash@0.5.10.2-6
no fix listed
1
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
dash@0.5.10.2-6
no fix listed
1
ghcr.io/spidernet-io/egressgateway-agent:v0.6.9a8ec2f74c9d0
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/spidernet-io/egressgateway-controller:v0.6.99deda7b68c34
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/spidernet-io/spiderpool/spiderpool-agent:v1.2.08bb9411e47e0
dash@0.5.10.2-6
no fix listed
1
ghcr.io/spidernet-io/spiderpool/spiderpool-controller:v1.2.042304e3ed36e
dash@0.5.10.2-6
no fix listed
1
ghcr.io/star-whale/server:0.6.158368359c8dd0
dash@0.5.10.2-6
no fix listed
1
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/streamingfast/firehose-core:v1.12.391fca773a63f
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/streamingfast/firehose-ethereum:v2.12.489969b78fb07
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/streamingfast/firehose-ethereum:v2.14.3bf816072380e
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/streamingfast/firehose-ethereum:v2.12.4-gethd7bdfa7b41da
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/streamingfast/go-ethereum:geth-v1.16.9-fh3.08e3cb38953a3
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/streamingfast/substreams-sink-kv:v2.3.026953ec68d5d
dash@0.5.10.2-6
no fix listed
1
ghcr.io/streamingfast/substreams-sink-noop:v1.4.0d7c43c3135c6
dash@0.5.10.2-6
no fix listed
1
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/substra/substra-backend:1.0.121967f54ec86
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/suwayomi/suwayomi-server:v2.3.2320d2c3218c7f9f
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/thm-mni-ii/fbs-core:v2.0.1b585ab8bb7e8
dash@0.5.12-12ubuntu3
no fix listed
1
ghcr.io/thm-mni-ii/fbs-identity-service:v2.0.1baf79539e5df
dash@0.5.12-12ubuntu3
no fix listed
1
ghcr.io/topolvm/pie:0.18.0aa467443e407
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/topolvm/topolvm-with-sidecar:0.41.170548dbe0c6a
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/topolvm/topolvm-with-sidecar:0.35.0b354978c440d
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/utkuozdemir/nvidia_gpu_exporter:1.5.0d75967a4dd72
dash@0.5.12-12ubuntu3
no fix listed
1
ghcr.io/voxpupuli/container-puppetdb:7.18.0-v1.5.0a56dfe91f5b1
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/wearefrank/frank-gateway:1.0.05ccf797ccdf1
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/wmde/wbaas-backup:v0.1.78e6a9516eac0
dash@0.5.8-2.10
no fix listed
1
ghcr.io/wolveix/satisfactory-server:v1.9.10e0f2f8c97598
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
ghcr.io/zazukoians/qlever-server:v0.10.11de7869ab46e
dash@0.5.12-6ubuntu5
no fix listed
1
ghcr.io/zystem-io/zymtrace-pub-gateway:26.9.3ec631bf7d54d
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
mcr.microsoft.com/azure-application-gateway/kubernetes-ingress:1.6.0bccaa701e2df
dash@0.5.10.2-6
no fix listed
1
mcr.microsoft.com/mssql/server:latest2b5b58162112
dash@0.5.12-6ubuntu5
no fix listed
1
mcr.microsoft.com/mssql/server:2022-latest4402d880dd4c
dash@0.5.11+git20210903+057cd650a4ed-3build1
no fix listed
1
mcr.microsoft.com/mssql/server:2019-CU16-ubuntu-20.0449a57dc220b1
dash@0.5.10.2-6
no fix listed
1
mcr.microsoft.com/mssql/server:2025-CU5-ubuntu-24.04cee0f4db03b5
dash@0.5.12-6ubuntu5
no fix listed
1
public.ecr.aws/aktosecurity/akto-api-security-dashboard:1.69.2:latestb53a854bd7c1
dash@0.5.12-6ubuntu5
no fix listed
1
public.ecr.aws/aktosecurity/akto-api-security-dashboard:1.69.7fd278c2d8647
dash@0.5.12-6ubuntu5
no fix listed
1

syft 1.42.1 · advisories as of 26 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.