StackRadar

CVE-2026-101910

Medium

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
182
of 17,939 indexed, latest versions
Container images
160
deployed by those charts
Fix available
1 of 1
affected package

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

Carried by container images the latest versions of 182 of 17,939 indexed charts deploy, on 160 images.

Affected packageAffected versionsFixed inImages
ip-addressnpm10.2.0, 10.3.1, 10.4.0, 10.5.010.5.1160
OSV records
GHSA-2vr4-cq9g-pvrc

Charts affected

182 by stars
ChartLatestAffected imagesRadar Score
langflow-runtimelangflow0.1.11 of 1See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
langflowai/langflow:latest79c02794adeb
ip-address@10.3.1
10.5.1

Open the chart page →

159
actualbudgetm0nsterrr-actualbudgetVerified publisher2.10.01 of 1See more

actualbudget m0nsterrr-actualbudget 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
actualbudget/actual-server:26.9.0552beab3dec8
ip-address@10.2.0
10.5.1

Open the chart page →

1,240
mend-renovate-enterprise-editionmend-renovateVerified publisher10.6.01 of 2See more

mend-renovate-enterprise-edition mend-renovate 10.6.0

1 of the 2 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ghcr.io/mend/renovate-ee-server:15.6.087b77989f48d
ip-address@10.2.0
10.5.1

Open the chart page →

38,104
observability-mcpobservability-mcpOfficialVerified publisher2.9.121 of 2See more

observability-mcp observability-mcp 2.9.12

1 of the 2 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ghcr.io/thotischner/observability-mcp:3.9.11775e1e84d5d1
ip-address@10.3.1
10.5.1

Open the chart page →

37
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
growthbook/growthbook:latestcbf1bc59e9a9
ip-address@10.5.0
10.5.1

Open the chart page →

1,249
kuttone-acre-fundVerified publisher0.2.51 of 1See more

kutt one-acre-fund 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
kutt/kutt:latestfa3d24a89b04
ip-address@10.2.0
10.5.1

Open the chart page →

525
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
ip-address@10.2.0
10.5.1

Open the chart page →

7,722
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
ip-address@10.5.0
10.5.1

Open the chart page →

33,426
immichsecustorVerified publisher2.0.61 of 1See more

immich secustor 2.0.6

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.2.279cc1623323d
ip-address@10.2.0
10.5.1

Open the chart page →

3,427
helm64-toolboxserdigital64Verified publisher0.4.01 of 1See more

helm64-toolbox serdigital64 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ghcr.io/automation64/toolbox/oraclelinux-9-toolbox:latest7af2216c7b9e
ip-address@10.2.0
10.5.1

Open the chart page →

1,551
wg-easyslybase-wg-easyVerified publisher1.2.01 of 1See more

wg-easy slybase-wg-easy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ghcr.io/wg-easy/wg-easy:15.4.00e7bc9d34e86
ip-address@10.2.0
10.5.1

Open the chart page →

775
stackradar-scannerstackradarVerified publisher0.4.01 of 1See more

stackradar-scanner stackradar 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ghcr.io/lockdep/stackradar-scanner:0.4.073cbeb990cf4
ip-address@10.5.0
10.5.1

Open the chart page →

1,271
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
supabase/storage-api:v1.60.4c8eb9858eafe
ip-address@10.2.0
10.5.1

Open the chart page →

19,207
switcher-apiswitcherapiOfficialVerified publisher1.3.52 of 3See more

switcher-api switcherapi 1.3.5

2 of the 3 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
trackerforce/switcher-api:latest28ee0c4e0b88
ip-address@10.2.0
10.5.1
trackerforce/switcher-resolver-node:latest67e2c261f7b4
ip-address@10.2.0
10.5.1

Open the chart page →

722
tenuretenureVerified publisher1.0.61 of 2See more

tenure tenure 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
tenureai/tenure:v1.0.285f5b222df9a5
ip-address@10.2.0
10.5.1

Open the chart page →

2,667
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
ip-address@10.2.0
10.5.1

Open the chart page →

4,020
discord-botxxczakiVerified publisher0.32.51 of 2See more

discord-bot xxczaki 0.32.5

1 of the 2 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
xxczaki/discord-bot:3bf18776db30d6f5e1d8fc9ece62f13c913548aa695cbc36b5fa
ip-address@10.2.0
10.5.1

Open the chart page →

543
crowdsec-web-uizekker6Verified publisher0.52.01 of 1See more

crowdsec-web-ui zekker6 0.52.0

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ghcr.io/theduffman85/crowdsec-web-ui:2026.9.162614fd45986
ip-address@10.2.0
10.5.1

Open the chart page →

1,158
lhciadnoctemVerified publisher0.1.01 of 1See more

lhci adnoctem 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
ip-address@10.2.0
10.5.1

Open the chart page →

1,409
outlineadnoctemVerified publisher0.1.21 of 1See more

outline adnoctem 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
outlinewiki/outline:1.10.1832051f039b4
ip-address@10.4.0
10.5.1

Open the chart page →

1,432
uptime-kumaadnoctemVerified publisher0.4.11 of 1See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
ip-address@10.5.0
10.5.1

Open the chart page →

31,952
turborepo-remote-cacheadriantr1.1.11 of 1See more

turborepo-remote-cache adriantr 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ducktors/turborepo-remote-cache:latest8aa1c158d885
ip-address@10.2.0
10.5.1

Open the chart page →

587
homepagealareira1.0.11 of 1See more

homepage alareira 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:latest643bd0be730d
ip-address@10.5.0
10.5.1

Open the chart page →

395
browserlessalekcVerified publisher1.2.71 of 1See more

browserless alekc 1.2.7

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ghcr.io/browserless/chrome:v2.56.7d600eac6283f
ip-address@10.5.0
10.5.1

Open the chart page →

2,338
excalidashalekcVerified publisher1.4.01 of 2See more

excalidash alekc 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.6.0cbdab75f31b2
ip-address@10.5.0
10.5.1

Open the chart page →

990
pangolinbdcode0.14.11 of 1See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
fosrl/pangolin:latest00cfb631097a
ip-address@10.2.0
10.5.1

Open the chart page →

1,981
bluerange-mosquittobluerangeOfficialVerified publisher1.1.01 of 1See more

bluerange-mosquitto bluerange 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
bluerange/bluerange-mosquitto:2690a4e5b92cc6
ip-address@10.4.0
10.5.1

Open the chart page →

137
node-appbryopsida0.5.11 of 2See more

node-app bryopsida 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
library/node:lts64af3819f927
ip-address@10.2.0
10.5.1

Open the chart page →

79,572
stocksalescluster-deploy0.1.31 of 1See more

stocksales cluster-deploy 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
foggbh/stocky:latest8b7a2e5ecf4e
ip-address@10.2.0
10.5.1

Open the chart page →

477
opencloudcommunity-opencloud3.1.01 of 13See more

opencloud community-opencloud 3.1.0

1 of the 13 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
opencloudeu/yjs:1.0.02beddf0cc6db
ip-address@10.2.0
10.5.1

Open the chart page →

9,829
kuberay-dashboarddanchevVerified publisher0.0.51 of 1See more

kuberay-dashboard danchev 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
ip-address@10.2.0
10.5.1

Open the chart page →

592
decisionrules-aksdecisionrules-aksVerified publisher0.2.01 of 2See more

decisionrules-aks decisionrules-aks 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
ip-address@10.5.0
10.5.1

Open the chart page →

280
decisionrules-eksdecisionrules-eksVerified publisher0.3.01 of 2See more

decisionrules-eks decisionrules-eks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
ip-address@10.5.0
10.5.1

Open the chart page →

280
decisionrules-ingressdecisionrules-ingressVerified publisher0.2.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
ip-address@10.5.0
10.5.1

Open the chart page →

280
decisionrules-ocpdecisionrules-ocpVerified publisher0.1.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
ip-address@10.5.0
10.5.1

Open the chart page →

1,525
dial-admindialVerified publisher0.19.01 of 3See more

dial-admin dial 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
epam/ai-dial-admin-frontend:0.21.01ecee9f1aa09
ip-address@10.4.0
10.5.1

Open the chart page →

3,846
node-reddjdl-charts0.33.01 of 1See more

node-red djdl-charts 0.33.0

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
nodered/node-red:latesta649dd711d55
ip-address@10.2.0
10.5.1

Open the chart page →

156
adventurelogdjjudas21Verified publisher0.1.11 of 3See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ghcr.io/seanmorley15/adventurelog-frontend:v0.13.051ee22428b41
ip-address@10.2.0
10.5.1

Open the chart page →

7,928
clickhouse-monitoringduyet0.1.31 of 2See more

clickhouse-monitoring duyet 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ghcr.io/duyet/clickhouse-monitoring:latest84edfe8a67a8
ip-address@10.2.0
10.5.1

Open the chart page →

1,093
benchmarking-tooleclipse-aeriosVerified publisher1.0.01 of 1See more

benchmarking-tool eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
eclipseaerios/benchmarking-tool:1.0.0a4b4c2e7fe62
ip-address@10.2.0
10.5.1

Open the chart page →

744
node-redegebackVerified publisher2.0.131 of 1See more

node-red egeback 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
nodered/node-red:5.0.410f40d0a83e7
ip-address@10.3.1
10.5.1

Open the chart page →

1,105
uptime-kumaegebackVerified publisher2.0.121 of 1See more

uptime-kuma egeback 2.0.12

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
ip-address@10.2.0
10.5.1

Open the chart page →

32,092
edp-installepmdedpOfficialVerified publisher3.15.01 of 7See more

edp-install epmdedp 3.15.0

1 of the 7 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
epamedp/krci-portal:0.8.0687acf641097
ip-address@10.2.0
10.5.1

Open the chart page →

2,184
krci-portalepmdedpVerified publisher0.8.01 of 1See more

krci-portal epmdedp 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
epamedp/krci-portal:0.8.0687acf641097
ip-address@10.2.0
10.5.1

Open the chart page →

888
assertoorethereum-helm-chartsVerified publisher1.2.01 of 1See more

assertoor ethereum-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
ethpandaops/assertoor:latest1efa2fba6711
ip-address@10.2.0
10.5.1

Open the chart page →

2,927
lodestarethereum-helm-chartsVerified publisher1.2.21 of 2See more

lodestar ethereum-helm-charts 1.2.2

1 of the 2 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
chainsafe/lodestar:latestd717e4193699
ip-address@10.2.0
10.5.1

Open the chart page →

2,670
beeport-uiethersphereVerified publisher0.76.21 of 3See more

beeport-ui ethersphere 0.76.2

1 of the 3 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
library/node:lts64af3819f927
ip-address@10.2.0
10.5.1

Open the chart page →

7,377
multichain-uiethersphereVerified publisher0.73.11 of 3See more

multichain-ui ethersphere 0.73.1

1 of the 3 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
library/node:lts64af3819f927
ip-address@10.2.0
10.5.1

Open the chart page →

7,377
static-siteethersphereVerified publisher0.73.11 of 2See more

static-site ethersphere 0.73.1

1 of the 2 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
library/node:latestfa271c47a5d8
ip-address@10.5.0
10.5.1

Open the chart page →

6,195
consent-managerfiware0.1.21 of 1See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-101910.

Container imageDigestPackageFixed in
quay.io/wi_stefan/consent-manager:0.0.656399619568b
ip-address@10.5.0
10.5.1

Open the chart page →

2,066

Container images carrying it

160 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
trackerforce/switcher-resolver-node:latest67e2c261f7b4
ip-address@10.2.0
10.5.1
1
treskon/portrait-ui:DEV-lateste7970783bc8d
ip-address@10.5.0
10.5.1
1
twentycrm/twenty:latest:v2.41.047bcefe4e497
ip-address@10.4.0
10.5.1
1
twentycrm/twenty:v2.43.0b2b662b1bef1
ip-address@10.4.0
10.5.1
1
twentycrm/twenty:v2.22.0e7d9948bf284
ip-address@10.2.0
10.5.1
1
veecode/devportal7a3d61de5e5e
ip-address@10.2.0
10.5.1
1
wsjbr/duplistatus:1.5.0bede86cf183f
ip-address@10.2.0
10.5.1
1
xxczaki/discord-bot:3bf18776db30d6f5e1d8fc9ece62f13c913548aa695cbc36b5fa
ip-address@10.2.0
10.5.1
1
zimengxiong/excalidash-backend:0.6.0cbdab75f31b2
ip-address@10.5.0
10.5.1
1
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
ip-address@10.2.0
10.5.1
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
ip-address@10.2.0
10.5.1
1
ghcr.io/automation64/toolbox/oraclelinux-9-toolbox:latest7af2216c7b9e
ip-address@10.2.0
10.5.1
1
ghcr.io/backstage/backstage:lateste2a48bb6ab55
ip-address@10.2.0
10.5.1
1
ghcr.io/bluesky-social/pds:0.405e164855fa1
ip-address@10.2.0
10.5.1
1
ghcr.io/browserless/chrome:v2.56.7d600eac6283f
ip-address@10.5.0
10.5.1
1
ghcr.io/browserless/chromium:v2.55.42ed0183564d7
ip-address@10.2.0
10.5.1
1
ghcr.io/cameri/nostream:mainc134ac2fa289
ip-address@10.2.0
10.5.1
1
ghcr.io/data-fair/portals:18b621866ceb2
ip-address@10.2.0
10.5.1
1
ghcr.io/ding113/claude-code-hub:latest87f9e8a92bd7
ip-address@10.2.0
10.5.1
1
ghcr.io/duyet/clickhouse-monitoring:latest84edfe8a67a8
ip-address@10.2.0
10.5.1
1
ghcr.io/elk-zone/elk:main046dfdb8550c
ip-address@10.2.0
10.5.1
1
ghcr.io/elk-zone/elk:v1.0.1236faedcb68a
ip-address@10.2.0
10.5.1
1
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
ip-address@10.2.0
10.5.1
1
ghcr.io/fluxerapp/fluxer-api:2026.820.164808f683541d5374
ip-address@10.2.0
10.5.1
1
ghcr.io/fpsacha/zomboid-panel:v1.0.6605e16dd56cfb
ip-address@10.2.0
10.5.1
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
ip-address@10.5.0
10.5.1
1
ghcr.io/immich-app/immich-server:v3.2.279cc1623323d
ip-address@10.2.0
10.5.1
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
ip-address@10.2.0
10.5.1
1
ghcr.io/lockdep/stackradar-scanner:0.4.073cbeb990cf4
ip-address@10.5.0
10.5.1
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
ip-address@10.2.0
10.5.1
1
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
ip-address@10.2.0
10.5.1
1
ghcr.io/matter-js/matterjs-server:1.4.054232d0d3e7d
ip-address@10.2.0
10.5.1
1
ghcr.io/mend/renovate-ee-server:15.6.087b77989f48d
ip-address@10.2.0
10.5.1
1
ghcr.io/microboxlabs/miot-dashboard-server:latest690057f3a1ee
ip-address@10.2.0
10.5.1
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
ip-address@10.2.0
10.5.1
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
ip-address@10.2.0
10.5.1
1
ghcr.io/platform-mesh/portal:v0.27.16a7ecd5a0dc2
ip-address@10.4.0
10.5.1
1
ghcr.io/quenchworks/images/code-server1e81c19f0149
ip-address@10.3.1
10.5.1
1
ghcr.io/quenchworks/images/homepage5af95ab01e8e
ip-address@10.5.0
10.5.1
1
ghcr.io/quenchworks/images/unleash85b22c79b8cf
ip-address@10.3.1
10.5.1
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.32c1ec86675d4
ip-address@10.5.0
10.5.1
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
ip-address@10.2.0
10.5.1
1
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
ip-address@10.2.0
10.5.1
1
ghcr.io/seanmorley15/adventurelog-frontend:v0.13.051ee22428b41
ip-address@10.2.0
10.5.1
1
ghcr.io/seerr-team/seerr:v3.5.027602401178d
ip-address@10.2.0
10.5.1
1
ghcr.io/tarampampam/video-dl-bot:1.4.36daa2dc7556b
ip-address@10.2.0
10.5.1
1
ghcr.io/theduffman85/crowdsec-web-ui:2026.9.162614fd45986
ip-address@10.2.0
10.5.1
1
ghcr.io/thotischner/observability-mcp:3.9.11775e1e84d5d1
ip-address@10.3.1
10.5.1
1
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
ip-address@10.4.0
10.5.1
1
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
ip-address@10.2.0
10.5.1
1

syft 1.42.1 · advisories as of 29 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.