StackRadar

CVE-2026-98436

Medium

Advisory

Published 18 Oct 2026In the index since 20 Oct 2026
Severity
Medium
worst across findings
CVSS
6.8
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
367
of 18,219 indexed, latest versions
Container images
368
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 367 of 18,219 indexed charts deploy, on 368 images.

Affected packageAffected versionsFixed inImages
linuxdeb3.13.0-46.77, 3.13.0-126.175, 3.13.0-149.199, 3.13.0-170.220+140 moreno fix listed368
OSV records
DEBIAN-CVE-2026-98436UBUNTU-CVE-2026-98436

Charts affected

367 by stars
ChartLatestAffected imagesRadar Score
codegentest-opea1.0.01 of 5See more

codegen test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
opea/codegen-ui:1.02bee4eb66f3e
linux@6.1.76-1
no fix listed

Open the chart page →

106,449
codetranstest-opea1.0.01 of 5See more

codetrans test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
opea/codetrans-ui:1.03ef121f34610
linux@6.1.76-1
no fix listed

Open the chart page →

105,973
docsumtest-opea1.0.01 of 5See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
opea/docsum-ui:1.07f854e9bffaf
linux@6.1.76-1
no fix listed

Open the chart page →

106,476
nextcloudth-chartsVerified publisher0.4.01 of 1See more

nextcloud th-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
library/nextcloud:31.0.6-apache588609d76b21
linux@6.1.140-1
no fix listed

Open the chart page →

64,580
tfy-distributortruefoundryVerified publisher0.0.11 of 4See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
linux@6.1.69-1
no fix listed

Open the chart page →

95,252
demo-backendv2flyVerified publisher0.0.31 of 1See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
linux@6.1.38-4
no fix listed

Open the chart page →

96,285
tdarrvhdirkVerified publisher5.0.52 of 2See more

tdarr vhdirk 5.0.5

2 of the 2 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
haveagitgat/tdarr_node:2.17.013ff0913202dd
linux@5.4.0-163.180
no fix listed
ghcr.io/haveagitgat/tdarr:2.00.18.23fbe4c29d14c
linux@5.4.0-110.124
no fix listed

Open the chart page →

157,503
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
linux@5.15.0-100.110
no fix listed

Open the chart page →

78,818
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
linux@6.1.124-1
no fix listed

Open the chart page →

69,454
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
twentycrm/twenty-postgres-spilo:latest2f78405a78be
linux@5.15.0-134.145
no fix listed

Open the chart page →

72,557
kongwallarmVerified publisher4.6.31 of 7See more

kong wallarm 4.6.3

1 of the 7 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
wallarm/kong:3.1.0-ubuntu-4.6.0ea9608c82e40
linux@5.4.0-144.161
no fix listed

Open the chart page →

76,110
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
linux@6.1.85-1
no fix listed

Open the chart page →

78,184
web-dvwaweb-dvwa1.16.01 of 2See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
gulacedia/web-dvwa-new:v367b467d961ca
linux@6.1.27-1
no fix listed

Open the chart page →

94,339
emissary-ingresswener8.12.21 of 2See more

emissary-ingress wener 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
istio/kubectl:1.5.10dbb7726d1bf0
linux@4.15.0-112.113
no fix listed

Open the chart page →

75,441
juicefs-csi-driverwener0.33.11 of 5See more

juicefs-csi-driver wener 0.33.1

1 of the 5 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.1103ac60b6b9c
linux@6.1.187-1
no fix listed

Open the chart page →

33,733
emissary-ingresswenerme8.12.21 of 2See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
istio/kubectl:1.5.10dbb7726d1bf0
linux@4.15.0-112.113
no fix listed

Open the chart page →

75,441
juicefs-csi-driverwenerme0.33.11 of 5See more

juicefs-csi-driver wenerme 0.33.1

1 of the 5 container images this version deploys carry CVE-2026-98436.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.1103ac60b6b9c
linux@6.1.187-1
no fix listed

Open the chart page →

33,733

Container images carrying it

368 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
stackstorm/st2api:3.86f56d239d280
linux@5.4.0-169.187
no fix listed
1
stackstorm/st2auth:3.833ecfda16608
linux@5.4.0-169.187
no fix listed
1
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
linux@5.4.0-169.187
no fix listed
1
stackstorm/st2notifier:3.8f190a6212195
linux@5.4.0-169.187
no fix listed
1
stackstorm/st2rulesengine:3.8259503496ff9
linux@5.4.0-169.187
no fix listed
1
stackstorm/st2scheduler:3.8b1de2055c362
linux@5.4.0-169.187
no fix listed
1
stackstorm/st2sensorcontainer:3.8b1a338f64773
linux@5.4.0-169.187
no fix listed
1
stackstorm/st2stream:3.81c8904a3bf67
linux@5.4.0-169.187
no fix listed
1
stackstorm/st2timersengine:3.81bf35bfaf00c
linux@5.4.0-169.187
no fix listed
1
stackstorm/st2workflowengine:3.819fdfffdbba8
linux@5.4.0-169.187
no fix listed
1
statcan/ckan:2.93921305425b8
linux@5.4.0-74.83
no fix listed
1
streamnative/apache-pulsar-grafana-dashboard-k8s:0.0.1611bceacec8fb
linux@5.4.0-77.86
no fix listed
1
substratusai/verba:v0.4.0-baseURL261695be635eb
linux@6.1.85-1
no fix listed
1
supabase/studio:20241021-9f9b08326d8070c55e9
linux@6.1.112-1
no fix listed
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
linux@6.1.177-1
no fix listed
1
supabase/studio:latestd878dcd9dba7
linux@6.1.187-1
no fix listed
1
svtechnmaa/svtech_maxscale:v1.0.3410a25b51f9f
linux@5.15.0-92.102
no fix listed
1
svtechnmaa/svtech_nagvis:v1.2.118394b08e6c3
linux@6.1.76-1
no fix listed
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
linux@5.4.0-176.196
no fix listed
1
sysnet4admin/colosseum-cms:loge74b43c7f492
linux@6.1.137-1
no fix listed
1
sysnet4admin/colosseum-prm:log5802bfcd7fed
linux@6.1.137-1
no fix listed
1
teknas09/bird-pod:latest12a1fa85c4aa
linux@6.1.76-1
no fix listed
1
tensorflow/tensorflow:1.6.0-devel1e3172090703
linux@4.4.0-116.140
no fix listed
1
theradius/loggia:0.463ba348546ec
linux@6.1.69-1
no fix listed
1
thongngo3301/stakefish:latesta341af5976e3
linux@6.1.52-1
no fix listed
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
linux@4.4.0-112.135
no fix listed
1
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
linux@6.1.128-1
no fix listed
1
twentycrm/twenty-postgres-spilo:latest2f78405a78be
linux@5.15.0-134.145
no fix listed
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
linux@6.1.137-1
no fix listed
1
valkey/valkey:8.0.1c5d4f082b76d
linux@6.1.106-3
no fix listed
1
vaultwarden/server:1.34.384fd8a47f58d
linux@6.1.140-1
no fix listed
1
vinanrra/7dtd-server:v0.4.4f9534490bd2b
linux@4.15.0-204.215
no fix listed
1
vlebediantsev/notes-admin-front:latest007c6670ff48
linux@6.1.38-4
no fix listed
1
vlebediantsev/notes-project-front:latest945675fd2636
linux@6.1.38-4
no fix listed
1
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
linux@6.1.38-4
no fix listed
1
voltha/voltha-cli:1.6.0c4e41e92f046
linux@4.4.0-137.163
no fix listed
1
voltha/voltha-envoy:1.6.059ab2a00f712
linux@3.13.0-126.175
no fix listed
1
voltha/voltha-netconf:1.6.037f80524c207
linux@4.4.0-137.163
no fix listed
1
voltha/voltha-ofagent:1.6.09ee8c1f4428c
linux@4.4.0-137.163
no fix listed
1
voltha/voltha-tester:1.7.0655c3048a602
linux@4.4.0-154.181
no fix listed
1
voltha/voltha-voltha:1.6.0ff596b62de59
linux@4.4.0-137.163
no fix listed
1
voska/hass-mcp:latest7142a431e2c5
linux@6.1.128-1
no fix listed
1
wallarm/kong:3.1.0-ubuntu-4.6.0ea9608c82e40
linux@5.4.0-144.161
no fix listed
1
xeladock/mysql_dns:latest4baf531453f1
linux@5.15.0-25.25
no fix listed
1
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
linux@6.1.99-1
no fix listed
1
xom4ekp2p/infini-route-attestators-public-mainnet-avs-webapi:latest2745b5fd8785
linux@6.1.99-1
no fix listed
1
gcr.io/flink-operator/deployer:webhook-cert809338a69bd5
linux@4.15.0-88.88
no fix listed
1
gcr.io/istio-release/pilot:release-1.0-latest-daily5ea7b7f3632a
linux@4.4.0-150.176
no fix listed
1
gcr.io/istio-release/proxyv2:release-1.0-latest-daily8f9ff98fdbef
linux@4.4.0-150.176
no fix listed
1
gcr.io/ml-pipeline/metadata-writer:2.3.09bcfd2abc361
linux@6.1.106-3
no fix listed
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.