StackRadar

GHSA-6q48-6c7w-9gw2

Critical

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,335
of 18,208 indexed, latest versions
Container images
1,205
deployed by those charts
Fix available
1 of 1
affected package

certifi bundles emSign root CAs with compromised intermediate CA keys

Carried by container images the latest versions of 1,335 of 18,208 indexed charts deploy, on 1,205 images.

Affected packageAffected versionsFixed inImages
certifipypi2019.3.9, 2019.6.16, 2019.9.11, 2019.11.28+37 more2026.10.191,205
OSV records
GHSA-6q48-6c7w-9gw2
Also known as
PYSEC-2026-4320
Trending
Rank 2 in indexed charts, since 21 Oct 2026. See the ranking →

Charts affected

1,335 by stars
ChartLatestAffected imagesRadar Score
ambassadorwener6.9.51 of 2See more

ambassador wener 6.9.5

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
certifi@2020.6.20
2026.10.19

Open the chart page →

5,702
argocd-image-updaterwener1.3.21 of 1See more

argocd-image-updater wener 1.3.2

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.3.1a578e328e8cb
certifi@2026.2.25
2026.10.19

Open the chart page →

468
emissary-ingresswener8.12.21 of 2See more

emissary-ingress wener 8.12.2

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
datawire/emissary:3.12.21f67a1292d2a
certifi@2024.2.2
2026.10.19

Open the chart page →

75,784
juicefs-csi-driverwener0.33.11 of 5See more

juicefs-csi-driver wener 0.33.1

1 of the 5 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.1103ac60b6b9c
certifi@2022.9.24
2026.10.19

Open the chart page →

11,867
kube-prometheus-stackwener92.11.01 of 6See more

kube-prometheus-stack wener 92.11.0

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.14.1092dbe0c335f
certifi@2026.7.22
2026.10.19

Open the chart page →

1,665
victoria-metrics-k8s-stackwener0.96.01 of 7See more

victoria-metrics-k8s-stack wener 0.96.0

1 of the 7 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
certifi@2026.7.22
2026.10.19

Open the chart page →

1,913
ambassadorwenerme6.9.51 of 2See more

ambassador wenerme 6.9.5

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
certifi@2020.6.20
2026.10.19

Open the chart page →

5,702
argocd-image-updaterwenerme1.3.21 of 1See more

argocd-image-updater wenerme 1.3.2

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.3.1a578e328e8cb
certifi@2026.2.25
2026.10.19

Open the chart page →

468
emissary-ingresswenerme8.12.21 of 2See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
datawire/emissary:3.12.21f67a1292d2a
certifi@2024.2.2
2026.10.19

Open the chart page →

75,784
juicefs-csi-driverwenerme0.33.11 of 5See more

juicefs-csi-driver wenerme 0.33.1

1 of the 5 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.1103ac60b6b9c
certifi@2022.9.24
2026.10.19

Open the chart page →

11,867
victoria-metrics-k8s-stackwenerme0.96.01 of 7See more

victoria-metrics-k8s-stack wenerme 0.96.0

1 of the 7 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
certifi@2026.7.22
2026.10.19

Open the chart page →

1,913
ceph-csi-cephfswikimedia0.2.11 of 5See more

ceph-csi-cephfs wikimedia 0.2.1

1 of the 5 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.14.2dc4bbac6efe1
certifi@2023.5.7
2026.10.19

Open the chart page →

7,086
ceph-csi-rbdwikimedia0.2.11 of 6See more

ceph-csi-rbd wikimedia 0.2.1

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.14.2dc4bbac6efe1
certifi@2023.5.7
2026.10.19

Open the chart page →

8,221
docker-hub-rate-limit-exporterwiremindVerified publisher0.3.01 of 1See more

docker-hub-rate-limit-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
viadee/docker-hub-rate-limit-exporter:version-1.52e27e3b3ee56
certifi@2020.12.5
2026.10.19

Open the chart page →

1,890
marge-botwiremindVerified publisher1.4.41 of 1See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
hiboxsystems/marge-bot:0.14.0dcffb926e563
certifi@2023.7.22
2026.10.19

Open the chart page →

5,949
powerdnsadminwitcom-gmbh0.3.41 of 1See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
certifi@2021.10.8
2026.10.19

Open the chart page →

2,736
wp-gats-helmwordpress-gatsby0.0.11 of 3See more

wp-gats-helm wordpress-gatsby 0.0.1

1 of the 3 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:latest9d48c42f8341
certifi@2026.5.20
2026.10.19

Open the chart page →

3,587
wordpressmysqlenvwordpress-mysql0.1.01 of 2See more

wordpressmysqlenv wordpress-mysql 0.1.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

4,950
wpmysqlwordpressmysqlapp0.1.01 of 2See more

wpmysql wordpressmysqlapp 0.1.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

4,950
mychartwordpress-mysql-helm-chart1.0.01 of 2See more

mychart wordpress-mysql-helm-chart 1.0.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

4,950
wpmysqlwpmysqlVerified publisher0.1.01 of 2See more

wpmysql wpmysql 0.1.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

4,950
am-pattern-1wso22.6.0-71 of 6See more

am-pattern-1 wso2 2.6.0-7

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

33,667
am-pattern-2wso22.6.0-71 of 6See more

am-pattern-2 wso2 2.6.0-7

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

33,667
ei-pattern-1wso26.6.0-31 of 6See more

ei-pattern-1 wso2 6.6.0-3

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

52,973
eval-ob-pattern-1wso21.4.0-11 of 6See more

eval-ob-pattern-1 wso2 1.4.0-1

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

2,408
mysql-eiwso26.6.0-31 of 2See more

mysql-ei wso2 6.6.0-3

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

2,408
xkopsxkops0.1.02 of 5See more

xkops xkops 0.1.0

2 of the 5 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
certifi@2024.8.30
2026.10.19
hamzaarshad10/querypodpy:1.7154f38e8668e
certifi@2024.8.30
2026.10.19

Open the chart page →

15,777
dingtalk-botxxl-job-adminVerified publisher0.1.31 of 2See more

dingtalk-bot xxl-job-admin 0.1.3

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
certifi@2025.11.12
2026.10.19

Open the chart page →

3,937
kadalu-operatorxxl-job-adminVerified publisher1.2.42 of 4See more

kadalu-operator xxl-job-admin 1.2.4

2 of the 4 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
kadalu/kadalu-csi:1.2.0af8d470b0ef3
certifi@2023.7.22
2026.10.19
kadalu/kadalu-operator:1.2.03726d7a805f2
certifi@2023.7.22
2026.10.19

Open the chart page →

7,241
nightingalexxl-job-adminVerified publisher0.2.112 of 6See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
flashcatcloud/nightingale:8.0.0-beta.11ea1b0aaabe09
certifi@2025.4.26
2026.10.19
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19

Open the chart page →

12,550
ceph-exporterygqygq2Verified publisher1.0.01 of 1See more

ceph-exporter ygqygq2 1.0.0

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
digitalocean/ceph_exporter:latest19b163e3fb95
certifi@2019.11.28
2026.10.19

Open the chart page →

6,948
enterprise-gatewayzeet3.2.21 of 2See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
elyra/kernel-image-puller:3.2.2c922f1f1646a
certifi@2022.12.7
2026.10.19

Open the chart page →

2,768
changedetection-iozekker6Verified publisher1.104.01 of 1See more

changedetection-io zekker6 1.104.0

1 of the 1 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
certifi@2026.7.22
2026.10.19

Open the chart page →

2,534
zerossl-cert-managerzerossl-cert-manager0.1.01 of 2See more

zerossl-cert-manager zerossl-cert-manager 0.1.0

1 of the 2 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
andreymileshin/zerossl-issuer:v1.0.0e0825acc9e48
certifi@2025.1.31
2026.10.19

Open the chart page →

632
zoo-project-druzoo-projectOfficialVerified publisher0.10.91 of 6See more

zoo-project-dru zoo-project 0.10.9

1 of the 6 container images this version deploys carry GHSA-6q48-6c7w-9gw2.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-51e7d55383f24594959b69e58518961c6aa66740da112e8d03f1
certifi@2026.7.22
2026.10.19

Open the chart page →

7,561

Container images carrying it

1,205 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/mysql:8.07dcddc01f13b
certifi@2026.2.25
2026.10.19
91
library/mysql:5.74bc6bc963e6d
certifi@2023.7.22
2026.10.19
36
ghcr.io/quenchworks/images/postgresqle3b4a823a4eb
certifi@2026.7.22
2026.10.19
34
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
certifi@2026.1.4
2026.10.19
14
library/mysql:8:8.4:8.4.116ea90827b110
certifi@2026.2.25
2026.10.19
11
oomk8s/readiness-check:2.0.2875814cc853d
certifi@2019.3.9
2026.10.19
11
quay.io/kiwigrid/k8s-sidecar:2.14.1092dbe0c335f
certifi@2026.7.22
2026.10.19
9
library/mysql:8:8.4:8.4.110f51e63e537a
certifi@2026.2.25
2026.10.19
7
library/mysql:26.7.0:latest9d48c42f8341
certifi@2026.5.20
2026.10.19
7
library/mysql:26.7.0625f74ddf936
certifi@2026.5.20
2026.10.19
6
dpage/pgadmin4:9.17:9.18:latestc332c5f6dfba
certifi@2026.7.22
2026.10.19
5
ghcr.io/home-assistant/home-assistant:2026.10.2:latest33afb0659d78
certifi@2026.7.22
2026.10.19
5
flaresolverr/flaresolverr:latest:v3.5.0139dfee1c6f8
certifi@2025.11.12
2026.10.19
4
opea/llm-tgi:1.00c25aab3f106
certifi@2024.8.30
2026.10.19
4
shashkist/flask-contacts-app:latest581de1fd6084
certifi@2024.8.30
2026.10.19
4
ghcr.io/dgtlmoon/changedetection.io:0.60.9:latest04eaae7915ba
certifi@2026.7.22
2026.10.19
4
ghcr.io/flaresolverr/flaresolverr:latest:v3.5.2c80ae007ce2c
certifi@2026.7.22
2026.10.19
4
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
certifi@2026.1.4
2026.10.19
4
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
certifi@2026.7.22
2026.10.19
4
quay.io/kiwigrid/k8s-sidecar:1.26.1b8d5067137fe
certifi@2024.2.2
2026.10.19
4
apache/superset:6.1.0:latest16b50bbef664
certifi@2025.6.15
2026.10.19
3
cloudve/cloudlaunch-server:latest4a3d7fae90bb
certifi@2021.10.8
2026.10.19
3
datawire/aes:1.14.48588eafe6862
certifi@2020.6.20
2026.10.19
3
dnationcloud/kubernetes-jsonnet-translator:2.0.178fed4f3c130
certifi@2026.6.17
2026.10.19
3
dpage/pgadmin4:6.12781369df9994
certifi@2020.12.5
2026.10.19
3
kiwigrid/k8s-sidecar:0.1.193170069ff0976
certifi@2020.6.20
2026.10.19
3
kiwigrid/k8s-sidecar:1.28.04166a019eeaf
certifi@2024.8.30
2026.10.19
3
kiwigrid/k8s-sidecar:0.1.1517b98eecdf6d1
certifi@2020.4.5.1
2026.10.19
3
kiwigrid/k8s-sidecar:1.30.2cdb361e67b1b
certifi@2025.1.31
2026.10.19
3
langflowai/langflow:1.12.6:latesta0396e089eb9
certifi@2026.7.22
2026.10.19
3
mysql/mysql-server:latestd6c8301b7834
certifi@2022.9.24
2026.10.19
3
searxng/searxng:latest5ed0323b5f5f
certifi@2026.7.22
2026.10.19
3
solace/solace-pubsub-standard:latest59f2a6d8eaba
certifi@2026.7.22
2026.10.19
3
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
certifi@2026.1.4
2026.10.19
3
ghcr.io/prometheus-pve/prometheus-pve-exporter:3.10.15678b230735a
certifi@2026.7.22
2026.10.19
3
quay.io/argoprojlabs/argocd-image-updater:v1.3.1a578e328e8cb
certifi@2026.2.25
2026.10.19
3
quay.io/devtron/ai-agent:0.0.16545dac92173
certifi@2024.8.30
2026.10.19
3
quay.io/kiwigrid/k8s-sidecar:1.14.235654389f8a9
certifi@2021.5.30
2026.10.19
3
amancevice/superset:0.35.212a0a9e66550
certifi@2019.11.28
2026.10.19
2
apachepulsar/pulsar:2.6.14db6ff0b4045
certifi@2020.6.20
2026.10.19
2
aquasec/kube-hunter:0.6.8e64fe49f059f
certifi@2021.10.8
2026.10.19
2
blakeblackshear/frigate:0.11.18330b0a265b8
certifi@2022.9.24
2026.10.19
2
confluentinc/cp-kafka:6.2.11-1-ubi8ac776fad95a5
certifi@2023.5.7
2026.10.19
2
confluentinc/cp-zookeeper:latest7610a50b13e7
certifi@2025.1.31
2026.10.19
2
confluentinc/cp-zookeeper:6.2.11-1-ubi8cae577096489
certifi@2023.5.7
2026.10.19
2
cs3org/wopiserver:v9.4.202a9e78757b4
certifi@2022.12.7
2026.10.19
2
dagster/user-code-example:1.13.265c98e09b2aeb
certifi@2026.7.22
2026.10.19
2
datawire/emissary:3.12.21f67a1292d2a
certifi@2024.2.2
2026.10.19
2
deepflowce/mysql:8.0.313d7ae561cf60
certifi@2022.6.15
2026.10.19
2
esphome/esphome:2026.9.14ad55931c018
certifi@2026.7.22
2026.10.19
2

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.