Critical Severity
Published: Oct 26, 2026
Open-source Kubernetes vulnerability scanner: an SBOM of every running image, matched against OSV and ranked by CVSS, EPSS and CISA KEV. Self-host with one Helm chart, or use the cloud.
<p align="center">
<img src=".github/logo.svg" alt="" width="96" height="96">
</p>
<h1 align="center">StackRadar</h1>
<p align="center">
The vulnerabilities on the images running in your Kubernetes cluster,<br>
ranked by what to fix first, with the upgrade that fixes them.
</p>
<p align="center">
<a href="https://github.com/lockdep/stackradar/releases/latest"><img src="https://img.shields.io/github/v/release/lockdep/stackradar?style=flat-square&label=Release" alt="Latest release"></a>
<a href="https://github.com/lockdep/stackradar/actions/workflows/ci-test.yaml"><img src="https://img.shields.io/github/actions/workflow/status/lockdep/stackradar/ci-test.yaml?branch=main&style=flat-square&label=Tests" alt="Tests"></a>
<a href="LICENSE"><img src="https://img.shields.io/badge/License-AGPL--3.0-informational?style=flat-square" alt="License: AGPL-3.0"></a>
<a href="https://artifacthub.io/packages/helm/lockdep/stackradar"><img src="https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/lockdep&style=flat-square" alt="Artifact Hub"></a>
<a href="https://scorecard.dev/viewer/?uri=github.com/lockdep/stackradar"><img src="https://api.scorecard.dev/projects/github.com/lockdep/stackradar/badge?style=flat-square" alt="OpenSSF Scorecard"></a>
</p>
<p align="center">
<a href="https://demo.stackradar.io/demo/enter">Live demo</a> ·
<a href="#quick-start">Quick start</a> ·
<a href="docs/">Documentation</a> ·
<a href="https://stackradar.io">Website</a> ·
<a href="https://app.stackradar.io">Cloud</a>
</p>
---
A scanner tells you your cluster has four thousand CVEs. StackRadar tells
you which of them are on images that are running right now, which of those
are being exploited in the wild, and which chart version or image tag makes
them go away. When a new advisory is published, the dashboard already knows
which pods run it, without pulling or scanning anything again.
StackRadar is open source under AGPL-3.0. Self-host it with one
`helm