StackRadar

GHSA-6q48-6c7w-9gw2

Critical

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,335
of 18,208 indexed, latest versions
Container images
1,205
deployed by those charts
Fix available
1 of 1
affected package

certifi bundles emSign root CAs with compromised intermediate CA keys

Carried by container images the latest versions of 1,335 of 18,208 indexed charts deploy, on 1,205 images.

Affected packageAffected versionsFixed inImages
certifipypi2019.3.9, 2019.6.16, 2019.9.11, 2019.11.28+37 more2026.10.191,205
OSV records
GHSA-6q48-6c7w-9gw2
Also known as
PYSEC-2026-4320
Trending
Rank 2 in indexed charts, since 21 Oct 2026. See the ranking →

Charts affected

1,335 by stars
ChartLatestAffected imagesRadar Score
ambassadorwener6.9.51 of 2See more

ambassador wener 6.9.5

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
certifi@2020.6.20
2026.10.19

Open the chart page →

5,702
argocd-image-updaterwener1.3.21 of 1See more

argocd-image-updater wener 1.3.2

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.3.1a578e328e8cb
certifi@2026.2.25
2026.10.19

Open the chart page →

468
emissary-ingresswener8.12.21 of 2See more

emissary-ingress wener 8.12.2

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
datawire/emissary:3.12.21f67a1292d2a
certifi@2024.2.2
2026.10.19

Open the chart page →

75,784
juicefs-csi-driverwener0.33.11 of 5See more

juicefs-csi-driver wener 0.33.1

1 of the 5 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.1103ac60b6b9c
certifi@2022.9.24
2026.10.19

Open the chart page →

11,867
kube-prometheus-stackwener92.11.01 of 6See more

kube-prometheus-stack wener 92.11.0

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.14.1092dbe0c335f
certifi@2026.7.22
2026.10.19

Open the chart page →

1,665
victoria-metrics-k8s-stackwener0.96.01 of 7See more

victoria-metrics-k8s-stack wener 0.96.0

1 of the 7 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
certifi@2026.7.22
2026.10.19

Open the chart page →

1,913
ambassadorwenerme6.9.51 of 2See more

ambassador wenerme 6.9.5

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
certifi@2020.6.20
2026.10.19

Open the chart page →

5,702
argocd-image-updaterwenerme1.3.21 of 1See more

argocd-image-updater wenerme 1.3.2

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.3.1a578e328e8cb
certifi@2026.2.25
2026.10.19

Open the chart page →

468
emissary-ingresswenerme8.12.21 of 2See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
datawire/emissary:3.12.21f67a1292d2a
certifi@2024.2.2
2026.10.19

Open the chart page →

75,784
juicefs-csi-driverwenerme0.33.11 of 5See more

juicefs-csi-driver wenerme 0.33.1

1 of the 5 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.1103ac60b6b9c
certifi@2022.9.24
2026.10.19

Open the chart page →

11,867
victoria-metrics-k8s-stackwenerme0.96.01 of 7See more

victoria-metrics-k8s-stack wenerme 0.96.0

1 of the 7 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
certifi@2026.7.22
2026.10.19

Open the chart page →

1,913
ceph-csi-cephfswikimedia0.2.11 of 5See more

ceph-csi-cephfs wikimedia 0.2.1

1 of the 5 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.14.2dc4bbac6efe1
certifi@2023.5.7
2026.10.19

Open the chart page →

7,086
ceph-csi-rbdwikimedia0.2.11 of 6See more

ceph-csi-rbd wikimedia 0.2.1

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.14.2dc4bbac6efe1
certifi@2023.5.7
2026.10.19

Open the chart page →

8,221
docker-hub-rate-limit-exporterwiremindVerified publisher0.3.01 of 1See more

docker-hub-rate-limit-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
viadee/docker-hub-rate-limit-exporter:version-1.52e27e3b3ee56
certifi@2020.12.5
2026.10.19

Open the chart page →

1,890
marge-botwiremindVerified publisher1.4.41 of 1See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
hiboxsystems/marge-bot:0.14.0dcffb926e563
certifi@2023.7.22
2026.10.19

Open the chart page →

5,949
powerdnsadminwitcom-gmbh0.3.41 of 1See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
certifi@2021.10.8
2026.10.19

Open the chart page →

2,736
wp-gats-helmwordpress-gatsby0.0.11 of 3See more

wp-gats-helm wordpress-gatsby 0.0.1

1 of the 3 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:latest9d48c42f8341
certifi@2026.5.20
2026.10.19

Open the chart page →

3,587
wordpressmysqlenvwordpress-mysql0.1.01 of 2See more

wordpressmysqlenv wordpress-mysql 0.1.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

4,950
wpmysqlwordpressmysqlapp0.1.01 of 2See more

wpmysql wordpressmysqlapp 0.1.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

4,950
mychartwordpress-mysql-helm-chart1.0.01 of 2See more

mychart wordpress-mysql-helm-chart 1.0.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

4,950
wpmysqlwpmysqlVerified publisher0.1.01 of 2See more

wpmysql wpmysql 0.1.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

4,950
am-pattern-1wso22.6.0-71 of 6See more

am-pattern-1 wso2 2.6.0-7

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

33,667
am-pattern-2wso22.6.0-71 of 6See more

am-pattern-2 wso2 2.6.0-7

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

33,667
ei-pattern-1wso26.6.0-31 of 6See more

ei-pattern-1 wso2 6.6.0-3

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

52,973
eval-ob-pattern-1wso21.4.0-11 of 6See more

eval-ob-pattern-1 wso2 1.4.0-1

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

2,408
mysql-eiwso26.6.0-31 of 2See more

mysql-ei wso2 6.6.0-3

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

2,408
xkopsxkops0.1.02 of 5See more

xkops xkops 0.1.0

2 of the 5 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
certifi@2024.8.30
2026.10.19
hamzaarshad10/querypodpy:1.7154f38e8668e
certifi@2024.8.30
2026.10.19

Open the chart page →

15,777
dingtalk-botxxl-job-adminVerified publisher0.1.31 of 2See more

dingtalk-bot xxl-job-admin 0.1.3

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
certifi@2025.11.12
2026.10.19

Open the chart page →

3,937
kadalu-operatorxxl-job-adminVerified publisher1.2.42 of 4See more

kadalu-operator xxl-job-admin 1.2.4

2 of the 4 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
kadalu/kadalu-csi:1.2.0af8d470b0ef3
certifi@2023.7.22
2026.10.19
kadalu/kadalu-operator:1.2.03726d7a805f2
certifi@2023.7.22
2026.10.19

Open the chart page →

7,241
nightingalexxl-job-adminVerified publisher0.2.112 of 6See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
flashcatcloud/nightingale:8.0.0-beta.11ea1b0aaabe09
certifi@2025.4.26
2026.10.19
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

12,550
ceph-exporterygqygq2Verified publisher1.0.01 of 1See more

ceph-exporter ygqygq2 1.0.0

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
digitalocean/ceph_exporter:latest19b163e3fb95
certifi@2019.11.28
2026.10.19

Open the chart page →

6,948
enterprise-gatewayzeet3.2.21 of 2See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
elyra/kernel-image-puller:3.2.2c922f1f1646a
certifi@2022.12.7
2026.10.19

Open the chart page →

2,768
changedetection-iozekker6Verified publisher1.104.01 of 1See more

changedetection-io zekker6 1.104.0

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
certifi@2026.7.22
2026.10.19

Open the chart page →

2,534
zerossl-cert-managerzerossl-cert-manager0.1.01 of 2See more

zerossl-cert-manager zerossl-cert-manager 0.1.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
andreymileshin/zerossl-issuer:v1.0.0e0825acc9e48
certifi@2025.1.31
2026.10.19

Open the chart page →

632
zoo-project-druzoo-projectOfficialVerified publisher0.10.91 of 6See more

zoo-project-dru zoo-project 0.10.9

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-51e7d55383f24594959b69e58518961c6aa66740da112e8d03f1
certifi@2026.7.22
2026.10.19

Open the chart page →

7,561

Container images carrying it

1,205 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
frinx/topology-discovery:7.0.37832e3589dba
certifi@2024.8.30
2026.10.19
2
gisaia/agate:0.21.09c4e14b49cff
certifi@2026.7.22
2026.10.19
2
gisaia/airs:0.21.0550b497ebd2a
certifi@2026.7.22
2026.10.19
2
gisaia/aproc-service:0.21.0ec396328a6fd
certifi@2026.7.22
2026.10.19
2
gisaia/fam:0.21.0eeb6311803d2
certifi@2026.7.22
2026.10.19
2
gradiant/srsran-5g:23_10_19061b1bf0f36
certifi@2019.11.28
2026.10.19
2
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
certifi@2023.5.7
2026.10.19
2
hjacobs/kube-ops-view:20.4.058221b57d4d2
certifi@2020.4.5.1
2026.10.19
2
ilum/api:6.7.3624fd09528c8
certifi@2026.6.17
2026.10.19
2
istio/examples-bookinfo-productpage-v1:1.15.00a5eb4795952
certifi@2019.3.9
2026.10.19
2
istio/examples-bookinfo-productpage-v1:1.14.022a0410f35a8
certifi@2019.3.9
2026.10.19
2
juicedata/juicefs-csi-driver:v0.33.1103ac60b6b9c
certifi@2022.9.24
2026.10.19
2
kiwigrid/k8s-sidecar:1.24.44138bea678f0
certifi@2023.5.7
2026.10.19
2
kiwigrid/k8s-sidecar:1.24.35af76eebbba7
certifi@2023.5.7
2026.10.19
2
kiwigrid/k8s-sidecar:1.30.98c06e1ba643a
certifi@2025.8.3
2026.10.19
2
langgenius/dify-sandbox:0.2.009b7e8705673
certifi@2024.2.2
2026.10.19
2
larribas/mlflow:1.9.105ccb0b46bfb
certifi@2020.6.20
2026.10.19
2
library/mysql:8.2.0212fe73edca5
certifi@2023.7.22
2026.10.19
2
library/mysql:8.4.2ac80b6e09e5b
certifi@2024.2.2
2026.10.19
2
linuxserver/beets:1.5.0:version-1.5.0e36d16f7341c
certifi@2021.10.8
2026.10.19
2
lncm/specter-desktop:v1.10.536eaa06f99f4
certifi@2021.10.8
2026.10.19
2
localstack/localstack:latestaa5632e041ca
certifi@2026.7.22
2026.10.19
2
locustio/locust:2.32.2a0d4b88e42c1
certifi@2024.8.30
2026.10.19
2
louislam/uptime-kuma:2.5.69912da7d7d9b
certifi@2022.9.24
2026.10.19
2
louislam/uptime-kuma:2.3.29aeb4e51d038
certifi@2022.9.24
2026.10.19
2
maxrocketinternet/newrelic-controller:0.8ff66958597f0
certifi@2020.4.5.1
2026.10.19
2
maxrocketinternet/postgres-controller:0.572ac4d33b99d
certifi@2020.4.5.1
2026.10.19
2
memgraph/memgraph:3.13.1bd3fe13228f4
certifi@2026.7.22
2026.10.19
2
nacos/nacos-server:latest1c191c30c8cd
certifi@2026.7.22
2026.10.19
2
netbirdio/dashboard:latest:v2.95.03d6adfee19dd
certifi@2026.2.25
2026.10.19
2
neuvector/manager:3.2.1f1b7d666eae0
certifi@2019.11.28
2026.10.19
2
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
certifi@2021.10.8
2026.10.19
2
nutanix/nai-jobs:v2.8.0:v2.8.19c373718e1b1
certifi@2026.7.22
2026.10.19
2
omecproject/kubernetes-synchronizer:comac-1.0.07c17a7b1d1ef
certifi@2019.6.16
2026.10.19
2
opea/embedding-tei:1.05c9639de61c1
certifi@2024.8.30
2026.10.19
2
opea/reranking-tei:1.0e48613afb191
certifi@2024.8.30
2026.10.19
2
opea/retriever-redis:1.0eb746b263705
certifi@2024.8.30
2026.10.19
2
openbas/caldera-server:5.1.0a277796d9724
certifi@2025.1.31
2026.10.19
2
opencsghq/label-studio:v2.6.0-llm-back03da7327c91e
certifi@2026.7.22
2026.10.19
2
opencsghq/label-studio:v2.6.01f6764097129
certifi@2024.7.4
2026.10.19
2
polyaxon/polyaxon-agent:2.17.0da877a2647fc
certifi@2026.7.22
2026.10.19
2
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
certifi@2026.7.22
2026.10.19
2
redislabs/redisinsight:1.14.0b03ab1426d0d
certifi@2022.12.7
2026.10.19
2
safeglobal/safe-config-service:latest09a5e495c219
certifi@2026.4.22
2026.10.19
2
safeglobal/safe-transaction-service:latest7b576c73f865
certifi@2026.5.20
2026.10.19
2
seafileltd/seafile-mc:11.0.12d0c66e4621bd
certifi@2024.7.4
2026.10.19
2
sealife/fritzbox-exporter:1.0f5cc2f0f4c9b
certifi@2020.12.5
2026.10.19
2
searxng/searxng:2026.9.8-3fdc6d7533547509b419c
certifi@2026.7.22
2026.10.19
2
searxng/searxng:2026.8.12-cdfdaa5a8c2dc2d9e6b91
certifi@2026.7.22
2026.10.19
2
wallarm/node-helpers:6.13.2290a87f01799
certifi@2024.7.4
2026.10.19
2

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.