StackRadar

CVE-2026-94287

Medium

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
0.001
1st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
310
of 17,939 indexed, latest versions
Container images
159
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 310 of 17,939 indexed charts deploy, on 159 images.

Affected packageAffected versionsFixed inImages
libxpmdeb1:3.5.12-1.1, 1:3.5.12-1.1+deb12u1, 1:3.5.17-1+b3, 1:3.5.17-1+deb13u1+1 moreno fix listed159
OSV records
DEBIAN-CVE-2026-94287

Charts affected

310 by stars
ChartLatestAffected imagesRadar Score
nginx-ingressnginxVerified publisher2.7.31 of 1See more

nginx-ingress nginx 2.7.3

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
nginx/nginx-ingress:5.6.33e97f06dce1c
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

1,248
uptime-kumauptime-kumaVerified publisher4.2.01 of 1See more

uptime-kuma uptime-kuma 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

32,092
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

10,968
penpotpenpotOfficialVerified publisher1.10.01 of 5See more

penpot penpot 1.10.0

1 of the 5 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
penpotapp/exporter:2.18.0beb2c2bd9660
libxpm@1:3.5.17-1+deb13u1+dhi0
no fix listed

Open the chart page →

5,276
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

71,190
gotenbergmaikumoriVerified publisher1.25.01 of 1See more

gotenberg maikumori 1.25.0

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.36.087c16b9f3642
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

11,356
oneuptimeoneuptimeOfficialVerified publisher14.0.81 of 7See more

oneuptime oneuptime 14.0.8

1 of the 7 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
oneuptime/probe:release91dac418f5ba
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

8,374
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
budibase/proxy:3.41.38d780b6ee602
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

10,680
phpmyadminalekcVerified publisher0.3.11 of 1See more

phpmyadmin alekc 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/phpmyadmin:5.2.3-apache9e915766488a
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

2,312
cortexcortex3.4.01 of 4See more

cortex cortex 3.4.0

1 of the 4 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:1.31abe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

3,362
nginx-ingressnginx-ingress-chartVerified publisher0.0.0-edge1 of 1See more

nginx-ingress nginx-ingress-chart 0.0.0-edge

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
nginx/nginx-ingress:edged127d1013198
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

1,248
passboltpassbolt2.1.11 of 6See more

passbolt passbolt 2.1.1

1 of the 6 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
passbolt/passbolt:5.13.0-1-ceaf3a620902a0
libxpm@1:3.5.17-1+b3
no fix listed

Open the chart page →

14,061
minecraft-overvieweralphani-helm-chartsVerified publisher0.1.01 of 3See more

minecraft-overviewer alphani-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:stable0aa2d81d65bc
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

3,529
glpiglpi-conteiner0.1.01 of 3See more

glpi glpi-conteiner 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/phpmyadmin:latest9e915766488a
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

11,911
hermes-agenthermes-agentVerified publisher1.16.01 of 1See more

hermes-agent hermes-agent 1.16.0

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

5,766
part-dbpart-dbVerified publisher0.1.21 of 1See more

part-db part-db 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
jbtronics/part-db1:latestfd68338829ed
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

3,636
phpmyadminphpmyadminVerified publisher1.0.31 of 1See more

phpmyadmin phpmyadmin 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/phpmyadmin:5.2.3-apache0b38dba8580a
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

2,312
qgis-serverqgis-serverVerified publisher0.1.101 of 3See more

qgis-server qgis-server 0.1.10

1 of the 3 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:1.27.409369da6b103
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

5,726
spartanspartan0.9.11 of 1See more

spartan spartan 0.9.1

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

1,686
repmanszpadel-chartsVerified publisher3.52.171 of 3See more

repman szpadel-charts 3.52.17

1 of the 3 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:1.27.3fb197595ebe7
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

7,402
vrijbrpvrijbrpVerified publisher0.1.51 of 5See more

vrijbrp vrijbrp 0.1.5

1 of the 5 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

8,754
wgerwgerOfficialVerified publisher2.0.01 of 7See more

wger wger 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:stable0aa2d81d65bc
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

7,565
paperless-ngxadnoctemVerified publisher0.4.21 of 5See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.36.087c16b9f3642
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

22,217
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

6,488
dawarichcogitriVerified publisher2.9.21 of 3See more

dawarich cogitri 2.9.2

1 of the 3 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
freikin/dawarich:1.15.2e58334ca5697
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

6,320
commonground-gatewaycommonground-gateway1.5.41 of 7See more

commonground-gateway commonground-gateway 1.5.4

1 of the 7 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/gateway-ui:stag6a5594b7b32c
libxpm@1:3.5.12-1.1
no fix listed

Open the chart page →

10,028
dragonfly-stackdragonflyVerified publisher0.1.21 of 7See more

dragonfly-stack dragonfly 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
dragonflyoss/client:v0.1.82edf3e921f4e0
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

19,400
nginx-phpfpmdrpsychickVerified publisher0.1.11 of 2See more

nginx-phpfpm drpsychick 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

1,686
enbuildenbuildVerified publisher0.0.501 of 6See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
libxpm@1:3.5.17-1+b3
no fix listed

Open the chart page →

33,121
castopodh2mVerified publisher1.12.101 of 3See more

castopod h2m 1.12.10

1 of the 3 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
castopod/castopod:1.12.101fd37280cbb2
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

10,733
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

6,849
hello-helmhellok8s0.1.01 of 2See more

hello-helm hellok8s 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

1,859
uptime-kumahelmforgeVerified publisher1.5.151 of 1See more

uptime-kuma helmforge 1.5.15

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.5c74379ac4509
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

31,945
mywebapphelm-nginxVerified publisher0.1.01 of 1See more

mywebapp helm-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

1,686
web-chartkbt-ktcloudlab0.1.01 of 1See more

web-chart kbt-ktcloudlab 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

1,686
app-componentkeltio-helm-chartsVerified publisher3.14.01 of 1See more

app-component keltio-helm-charts 3.14.0

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

1,686
overpass-apil4gVerified publisher0.1.21 of 1See more

overpass-api l4g 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
wiktorn/overpass-api:latest9bb5f4a9b54c
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

3,792
langflow-idelangflow0.1.21 of 2See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
langflowai/langflow-frontend:latest54f67f1961fe
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

4,270
flaresolverrlib42Verified publisher2.0.01 of 1See more

flaresolverr lib42 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
ghcr.io/flaresolverr/flaresolverr:v3.4.0ab535d1fef5d
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

37,143
flaresolverrm0nsterrr-flaresolverrVerified publisher2.4.11 of 1See more

flaresolverr m0nsterrr-flaresolverr 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
ghcr.io/flaresolverr/flaresolverr:v3.5.2c80ae007ce2c
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

7,639
12factormyaVerified publisher24.1.21 of 1See more

12factor mya 24.1.2

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

1,686
my-react-appmy-react-app0.1.51 of 1See more

my-react-app my-react-app 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

1,686
nginx-chartnginx-chart-testVerified publisher0.1.11 of 1See more

nginx-chart nginx-chart-test 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

1,686
nginx-s3olopostVerified publisher0.2.11 of 1See more

nginx-s3 olopost 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway:unprivileged-oss3db8145349a3
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

5,316
onechartonechart-slVerified publisher0.76.01 of 1See more

onechart onechart-sl 0.76.0

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

1,686
opencatalogiopencatalogi1.0.62 of 8See more

opencatalogi opencatalogi 1.0.6

2 of the 8 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/gateway-ui:stag6a5594b7b32c
libxpm@1:3.5.12-1.1
no fix listed
ghcr.io/opencatalogi/web-app:deva1a7f507f6ae
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

15,419
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.11 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.1

1 of the 34 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-load-generatorb130d6cee6cb
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

21,488
playgroundplayground0.1.11 of 1See more

playground playground 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libxpm@1:3.5.17-1+deb13u1
no fix listed

Open the chart page →

1,686
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

5,898
baikalrubxkubeVerified publisher1.3.11 of 1See more

baikal rubxkube 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-94287.

Container imageDigestPackageFixed in
ckulka/baikal:0.10.1-nginx434bdd162247
libxpm@1:3.5.12-1.1+deb12u1
no fix listed

Open the chart page →

5,628

Container images carrying it

159 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/open-telemetry/demo:3.1.0-load-generatorb130d6cee6cb
libxpm@1:3.5.12-1.1+deb12u1
no fix listed
1
ghcr.io/yurymkomarov/docker/kubernetes-kiosk-chromium:0.1.27bff29dcec72
libxpm@1:3.5.12-1.1+deb12u1
no fix listed
1
mcr.microsoft.com/playwright/mcp:v0.0.43e101b832b34d
libxpm@1:3.5.12-1.1+deb12u1
no fix listed
1
public.ecr.aws/jtekt-corporation/api-key-manager-gui:v0.1.10424fa47fbeb
libxpm@1:3.5.17-1+deb13u1
no fix listed
1
public.ecr.aws/jtekt-corporation/image-storage-service-gui:v1.9.434823c8abe00
libxpm@1:3.5.12-1.1+deb12u1
no fix listed
1
public.ecr.aws/jtekt-corporation/shinsei-manager-front:v1.5.5f8fb4eea4071
libxpm@1:3.5.12-1.1+deb12u1
no fix listed
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
libxpm@1:3.5.12-1.1+deb12u1
no fix listed
1
quay.io/mittwald/kube-httpcache:stable2169032c5840
libxpm@1:3.5.12-1.1+deb12u1
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
libxpm@1:3.5.17-1+b3
no fix listed
1

syft 1.42.1 · advisories as of 29 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.