StackRadar

GHSA-6q48-6c7w-9gw2

Critical

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,335
of 18,208 indexed, latest versions
Container images
1,205
deployed by those charts
Fix available
1 of 1
affected package

certifi bundles emSign root CAs with compromised intermediate CA keys

Carried by container images the latest versions of 1,335 of 18,208 indexed charts deploy, on 1,205 images.

Affected packageAffected versionsFixed inImages
certifipypi2019.3.9, 2019.6.16, 2019.9.11, 2019.11.28+37 more2026.10.191,205
OSV records
GHSA-6q48-6c7w-9gw2
Also known as
PYSEC-2026-4320
Trending
Rank 2 in indexed charts, since 21 Oct 2026. See the ranking →

Charts affected

1,335 by stars
ChartLatestAffected imagesRadar Score
ambassadorwener6.9.51 of 2See more

ambassador wener 6.9.5

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
certifi@2020.6.20
2026.10.19

Open the chart page →

5,702
argocd-image-updaterwener1.3.21 of 1See more

argocd-image-updater wener 1.3.2

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.3.1a578e328e8cb
certifi@2026.2.25
2026.10.19

Open the chart page →

468
emissary-ingresswener8.12.21 of 2See more

emissary-ingress wener 8.12.2

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
datawire/emissary:3.12.21f67a1292d2a
certifi@2024.2.2
2026.10.19

Open the chart page →

75,784
juicefs-csi-driverwener0.33.11 of 5See more

juicefs-csi-driver wener 0.33.1

1 of the 5 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.1103ac60b6b9c
certifi@2022.9.24
2026.10.19

Open the chart page →

11,867
kube-prometheus-stackwener92.11.01 of 6See more

kube-prometheus-stack wener 92.11.0

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.14.1092dbe0c335f
certifi@2026.7.22
2026.10.19

Open the chart page →

1,665
victoria-metrics-k8s-stackwener0.96.01 of 7See more

victoria-metrics-k8s-stack wener 0.96.0

1 of the 7 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
certifi@2026.7.22
2026.10.19

Open the chart page →

1,913
ambassadorwenerme6.9.51 of 2See more

ambassador wenerme 6.9.5

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
certifi@2020.6.20
2026.10.19

Open the chart page →

5,702
argocd-image-updaterwenerme1.3.21 of 1See more

argocd-image-updater wenerme 1.3.2

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.3.1a578e328e8cb
certifi@2026.2.25
2026.10.19

Open the chart page →

468
emissary-ingresswenerme8.12.21 of 2See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
datawire/emissary:3.12.21f67a1292d2a
certifi@2024.2.2
2026.10.19

Open the chart page →

75,784
juicefs-csi-driverwenerme0.33.11 of 5See more

juicefs-csi-driver wenerme 0.33.1

1 of the 5 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.1103ac60b6b9c
certifi@2022.9.24
2026.10.19

Open the chart page →

11,867
victoria-metrics-k8s-stackwenerme0.96.01 of 7See more

victoria-metrics-k8s-stack wenerme 0.96.0

1 of the 7 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
certifi@2026.7.22
2026.10.19

Open the chart page →

1,913
ceph-csi-cephfswikimedia0.2.11 of 5See more

ceph-csi-cephfs wikimedia 0.2.1

1 of the 5 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.14.2dc4bbac6efe1
certifi@2023.5.7
2026.10.19

Open the chart page →

7,086
ceph-csi-rbdwikimedia0.2.11 of 6See more

ceph-csi-rbd wikimedia 0.2.1

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.14.2dc4bbac6efe1
certifi@2023.5.7
2026.10.19

Open the chart page →

8,221
docker-hub-rate-limit-exporterwiremindVerified publisher0.3.01 of 1See more

docker-hub-rate-limit-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
viadee/docker-hub-rate-limit-exporter:version-1.52e27e3b3ee56
certifi@2020.12.5
2026.10.19

Open the chart page →

1,890
marge-botwiremindVerified publisher1.4.41 of 1See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
hiboxsystems/marge-bot:0.14.0dcffb926e563
certifi@2023.7.22
2026.10.19

Open the chart page →

5,949
powerdnsadminwitcom-gmbh0.3.41 of 1See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
certifi@2021.10.8
2026.10.19

Open the chart page →

2,736
wp-gats-helmwordpress-gatsby0.0.11 of 3See more

wp-gats-helm wordpress-gatsby 0.0.1

1 of the 3 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:latest9d48c42f8341
certifi@2026.5.20
2026.10.19

Open the chart page →

3,587
wordpressmysqlenvwordpress-mysql0.1.01 of 2See more

wordpressmysqlenv wordpress-mysql 0.1.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

4,950
wpmysqlwordpressmysqlapp0.1.01 of 2See more

wpmysql wordpressmysqlapp 0.1.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

4,950
mychartwordpress-mysql-helm-chart1.0.01 of 2See more

mychart wordpress-mysql-helm-chart 1.0.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

4,950
wpmysqlwpmysqlVerified publisher0.1.01 of 2See more

wpmysql wpmysql 0.1.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

4,950
am-pattern-1wso22.6.0-71 of 6See more

am-pattern-1 wso2 2.6.0-7

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

33,667
am-pattern-2wso22.6.0-71 of 6See more

am-pattern-2 wso2 2.6.0-7

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

33,667
ei-pattern-1wso26.6.0-31 of 6See more

ei-pattern-1 wso2 6.6.0-3

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

52,973
eval-ob-pattern-1wso21.4.0-11 of 6See more

eval-ob-pattern-1 wso2 1.4.0-1

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

2,408
mysql-eiwso26.6.0-31 of 2See more

mysql-ei wso2 6.6.0-3

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

2,408
xkopsxkops0.1.02 of 5See more

xkops xkops 0.1.0

2 of the 5 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
certifi@2024.8.30
2026.10.19
hamzaarshad10/querypodpy:1.7154f38e8668e
certifi@2024.8.30
2026.10.19

Open the chart page →

15,777
dingtalk-botxxl-job-adminVerified publisher0.1.31 of 2See more

dingtalk-bot xxl-job-admin 0.1.3

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
certifi@2025.11.12
2026.10.19

Open the chart page →

3,937
kadalu-operatorxxl-job-adminVerified publisher1.2.42 of 4See more

kadalu-operator xxl-job-admin 1.2.4

2 of the 4 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
kadalu/kadalu-csi:1.2.0af8d470b0ef3
certifi@2023.7.22
2026.10.19
kadalu/kadalu-operator:1.2.03726d7a805f2
certifi@2023.7.22
2026.10.19

Open the chart page →

7,241
nightingalexxl-job-adminVerified publisher0.2.112 of 6See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
flashcatcloud/nightingale:8.0.0-beta.11ea1b0aaabe09
certifi@2025.4.26
2026.10.19
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

12,550
ceph-exporterygqygq2Verified publisher1.0.01 of 1See more

ceph-exporter ygqygq2 1.0.0

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
digitalocean/ceph_exporter:latest19b163e3fb95
certifi@2019.11.28
2026.10.19

Open the chart page →

6,948
enterprise-gatewayzeet3.2.21 of 2See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
elyra/kernel-image-puller:3.2.2c922f1f1646a
certifi@2022.12.7
2026.10.19

Open the chart page →

2,768
changedetection-iozekker6Verified publisher1.104.01 of 1See more

changedetection-io zekker6 1.104.0

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
certifi@2026.7.22
2026.10.19

Open the chart page →

2,534
zerossl-cert-managerzerossl-cert-manager0.1.01 of 2See more

zerossl-cert-manager zerossl-cert-manager 0.1.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
andreymileshin/zerossl-issuer:v1.0.0e0825acc9e48
certifi@2025.1.31
2026.10.19

Open the chart page →

632
zoo-project-druzoo-projectOfficialVerified publisher0.10.91 of 6See more

zoo-project-dru zoo-project 0.10.9

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-51e7d55383f24594959b69e58518961c6aa66740da112e8d03f1
certifi@2026.7.22
2026.10.19

Open the chart page →

7,561

Container images carrying it

1,205 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
weblate/weblate:4.2.2-169c160d37a3c
certifi@2020.6.20
2026.10.19
2
gcr.io/google-samples/microservices-demo/loadgenerator:v0.2.3360130ab5850
certifi@2020.12.5
2026.10.19
2
gcr.io/google-samples/microservices-demo/recommendationservice:v0.2.35f60c4988859
certifi@2020.12.5
2026.10.19
2
ghcr.io/cloudnative-pg/postgresql:18.4-system-trixie42708a75345b
certifi@2026.7.22
2026.10.19
2
ghcr.io/donkie/spoolman:0.27.07aba565eff77
certifi@2026.6.17
2026.10.19
2
ghcr.io/flaresolverr/flaresolverr:v3.4.67962759d99d7
certifi@2025.10.5
2026.10.19
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
certifi@2026.5.20
2026.10.19
2
ghcr.io/immich-app/immich-machine-learning:v3.1.05a0839dc5303
certifi@2025.11.12
2026.10.19
2
ghcr.io/janssenproject/jans/auth-server:0.0.0-nightlya1e82488e141
certifi@2026.10.18
2026.10.19
2
ghcr.io/janssenproject/jans/configurator:0.0.0-nightlya63c560869f6
certifi@2026.10.18
2026.10.19
2
ghcr.io/kiwigrid/k8s-sidecar:1.29.142002d66ddb3
certifi@2024.12.14
2026.10.19
2
ghcr.io/mealie-recipes/mealie:v3.29.078eb28b8776d
certifi@2026.7.22
2026.10.19
2
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
certifi@2025.11.12
2026.10.19
2
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
certifi@2026.1.4
2026.10.19
2
ghcr.io/plausible/community-edition:v3.2.133e60bfb40f2
certifi@2025.4.26
2026.10.19
2
ghcr.io/quenchworks/images/jupyterhub43ff4a2514f0
certifi@2026.10.18
2026.10.19
2
ghcr.io/quenchworks/images/label-studio5dade160df8a
certifi@2026.7.22
2026.10.19
2
ghcr.io/quenchworks/images/litellm7b5bfb2ad386
certifi@2026.10.18
2026.10.19
2
ghcr.io/quenchworks/images/mlflow07c0a9a91f3a
certifi@2026.7.22
2026.10.19
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
certifi@2025.1.31
2026.10.19
2
ghcr.io/smarter-project/home-ha-mock:main95ee018cf558
certifi@2025.4.26
2026.10.19
2
ghcr.io/xeor/karb:1.0.6:main647a3c938d31
certifi@2026.2.25
2026.10.19
2
public.ecr.aws/cloudnatix/llmariner/model-manager-loader:1.27.026ac7263a823
certifi@2025.8.3
2026.10.19
2
quay.io/cephcsi/cephcsi:v3.14.2dc4bbac6efe1
certifi@2023.5.7
2026.10.19
2
quay.io/kiwigrid/k8s-sidecar:1.19.26a8671702d6f
certifi@2022.5.18.1
2026.10.19
2
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
certifi@2025.11.12
2026.10.19
2
quay.io/kiwigrid/k8s-sidecar:2.8.1abb55b2165c6
certifi@2026.6.17
2026.10.19
2
quay.io/kiwigrid/k8s-sidecar:1.27.4f6ed71d0f9f1
certifi@2024.6.2
2026.10.19
2
quay.io/netscaler/netscaler-k8s-ingress-controller:4.2.26a68453858339
certifi@2026.7.22
2026.10.19
2
a10networks/acos-prometheus-exporter:latest8dc58d434d71
certifi@2020.4.5.1
2026.10.19
1
a1ex4/ownfoil:2.5.0123130aad6a2
certifi@2026.7.22
2026.10.19
1
abdullahkhawer/simple-elasticsearch-cleaner:2.1.028a6c3f7e0a9
certifi@2024.8.30
2026.10.19
1
acockburn/appdaemon:4.0.83a93281d7e94
certifi@2020.12.5
2026.10.19
1
acryldata/datahub-actions:v1.7.0.1c5fd70130157
certifi@2026.7.22
2026.10.19
1
adwerx/github-actions-runner:2.276.1-20.04-1840d2b078682
certifi@2019.11.28
2026.10.19
1
afrank/mozalert-controller:latestd463c37b08d7
certifi@2020.6.20
2026.10.19
1
agentarea/agentarea-api:0.1.1:latestde166c910ef9
certifi@2026.2.25
2026.10.19
1
agentarea/agentarea-mcp-runner:0.1.1:latest066fa4a71695
certifi@2026.7.22
2026.10.19
1
agentarea/agentarea-worker:0.1.1:latestadb761a4d103
certifi@2026.2.25
2026.10.19
1
aibrix/metadata-service:v0.8.058b915e3708d
certifi@2026.7.22
2026.10.19
1
airbyte/manifest-server:7.28.2deec511b51c3
certifi@2024.12.14
2026.10.19
1
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
certifi@2019.11.28
2026.10.19
1
akeyless/base:latest759e4289fae8
certifi@2026.4.22
2026.10.19
1
akeyless/base-rhel:0.0.14ba8900a0061
certifi@2024.2.2
2026.10.19
1
akeyless/gateway:5.5.2a35c060aa8e4
certifi@2026.6.17
2026.10.19
1
aktosecurity/akto-agent-guard-anonymizer:1.2.2212328d85f87
certifi@2026.7.22
2026.10.19
1
aktosecurity/akto-agent-guard-anonymizer:1.1.4d4b100cbdc47
certifi@2026.6.17
2026.10.19
1
aktosecurity/akto-agent-guard-embedder:1.2.26d90b501493b
certifi@2026.7.22
2026.10.19
1
aktosecurity/akto-agent-guard-embedder:1.1.4dbc566b2376c
certifi@2026.6.17
2026.10.19
1
aktosecurity/akto-agent-guard-worker:1.1.4666eaffd5362
certifi@2026.6.17
2026.10.19
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.