StackRadar

CVE-2026-101912

Medium

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
567
of 17,957 indexed, latest versions
Container images
573
deployed by those charts
Fix available
1 of 1
affected package

ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

Carried by container images the latest versions of 567 of 17,957 indexed charts deploy, on 573 images.

Affected packageAffected versionsFixed inImages
ip-addressnpm5.9.4, 6.1.0, 6.4.0, 7.1.0+11 more10.7.1573
OSV records
GHSA-j6r3-76f7-8jcv
Trending
Rank 24 in indexed charts, since 30 Sept 2026. See the ranking →

Charts affected

567 by stars
ChartLatestAffected imagesRadar Score
tenuretenureVerified publisher1.0.61 of 2See more

tenure tenure 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
tenureai/tenure:v1.0.285f5b222df9a5
ip-address@10.2.0
10.7.1

Open the chart page →

2,813
u-storeunifieVerified publisher1.2.01 of 1See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
ip-address@9.0.5
10.7.1

Open the chart page →

16,011
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
ip-address@9.0.5
10.7.1

Open the chart page →

13,489
vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets0.0.0-main1 of 2See more

vaultwarden-kubernetes-secrets vaultwarden-kubernetes-secrets 0.0.0-main

1 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
ip-address@9.0.5
10.7.1

Open the chart page →

4,397
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
ip-address@9.0.5
10.7.1

Open the chart page →

5,458
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
ip-address@10.1.0
10.7.1

Open the chart page →

1,299
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
ip-address@5.9.4
10.7.1

Open the chart page →

4,129
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
ip-address@9.0.5
10.7.1

Open the chart page →

9,671
discord-botxxczakiVerified publisher0.32.71 of 2See more

discord-bot xxczaki 0.32.7

1 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
xxczaki/discord-bot:7a05df2aa964bac379b6cdca94ba72826dc340c83bc9052f75d4
ip-address@10.2.0
10.7.1

Open the chart page →

685
qleverzazukoVerified publisher0.7.11 of 2See more

qlever zazuko 0.7.1

1 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/zazukoians/qlever-ui:v0.10.151a7ec1c2de4
ip-address@9.0.5
10.7.1

Open the chart page →

2,729
crowdsec-web-uizekker6Verified publisher0.52.01 of 1See more

crowdsec-web-ui zekker6 0.52.0

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/theduffman85/crowdsec-web-ui:2026.9.162614fd45986
ip-address@10.1.1
10.7.1

Open the chart page →

1,360
adeptia-automate-mcpadeptia-automate-mcp1.0.02 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
ip-address@10.0.1
10.7.1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
ip-address@9.0.5
10.7.1

Open the chart page →

3,963
activepiecesadnoctemVerified publisher0.6.01 of 1See more

activepieces adnoctem 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
activepieces/activepieces:0.91.058414dfc94c4
ip-address@10.7.0
10.7.1

Open the chart page →

1,338
lhciadnoctemVerified publisher0.1.01 of 1See more

lhci adnoctem 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
ip-address@10.2.0
10.7.1

Open the chart page →

1,481
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
ip-address@10.1.0
10.7.1

Open the chart page →

4,292
outlineadnoctemVerified publisher0.1.21 of 1See more

outline adnoctem 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
outlinewiki/outline:1.10.1832051f039b4
ip-address@10.4.0
10.7.1

Open the chart page →

1,678
uptime-kumaadnoctemVerified publisher0.4.11 of 1See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
ip-address@10.1.0
10.7.1

Open the chart page →

32,738
turborepo-remote-cacheadriantr1.1.11 of 1See more

turborepo-remote-cache adriantr 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ducktors/turborepo-remote-cache:latest8aa1c158d885
ip-address@10.2.0
10.7.1

Open the chart page →

724
akeyless-gatewayakeyless-services-helmVerified publisher3.6.01 of 2See more

akeyless-gateway akeyless-services-helm 3.6.0

1 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
akeyless/gateway:5.4.0d4768a9b089c
ip-address@10.7.0
10.7.1

Open the chart page →

1,489
akto-mini-testingakto1.45.71 of 5See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-puppeteer-replay:1.49.4_latestf1c5763d565e
ip-address@10.1.0
10.7.1

Open the chart page →

7,131
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
ip-address@9.0.5
10.7.1

Open the chart page →

5,179
homepagealareira1.0.11 of 1See more

homepage alareira 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:latest643bd0be730d
ip-address@10.5.0
10.7.1

Open the chart page →

537
browserlessalekcVerified publisher1.2.71 of 1See more

browserless alekc 1.2.7

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/browserless/chrome:v2.56.7d600eac6283f
ip-address@10.5.0
10.7.1

Open the chart page →

2,661
cross-seedalekcVerified publisher7.19.01 of 1See more

cross-seed alekc 7.19.0

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/cross-seed/cross-seed:6.13.7a1fed512261f
ip-address@9.0.5
10.7.1

Open the chart page →

1,478
excalidashalekcVerified publisher1.4.01 of 2See more

excalidash alekc 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.6.0cbdab75f31b2
ip-address@10.5.0
10.7.1

Open the chart page →

1,128
zigbee2mqttalekcVerified publisher1.0.11 of 2See more

zigbee2mqtt alekc 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
koenkk/zigbee2mqtt:2.14.1fef0de769dcd
ip-address@10.7.0
10.7.1

Open the chart page →

247
jellyseerralexmorbo-jellyseerrVerified publisher1.0.31 of 1See more

jellyseerr alexmorbo-jellyseerr 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:2.2.3a324fa4d81cc
ip-address@9.0.5
10.7.1

Open the chart page →

3,559
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
ip-address@9.0.5
10.7.1

Open the chart page →

5,995
platform-uiappscodeVerified publisher2026.9.111 of 1See more

platform-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/appscode/platform-ui:2.5.0c27cafe398c2
ip-address@10.1.0
10.7.1

Open the chart page →

660
argonix-apiargonix0.5.51 of 4See more

argonix-api argonix 0.5.5

1 of the 4 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api-frontend:0.5.531be6a905000
ip-address@9.0.5
10.7.1

Open the chart page →

5,360
assemblylineassemblylineVerified publisher7.4.211 of 12See more

assemblyline assemblyline 7.4.21

1 of the 12 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
cccs/assemblyline-ui-frontend:4.7.4.stable21c00e72d90666
ip-address@10.1.0
10.7.1

Open the chart page →

13,081
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
ip-address@9.0.5
10.7.1

Open the chart page →

34,130
nas-appsawesomeVerified publisher2.0.01 of 8See more

nas-apps awesome 2.0.0

1 of the 8 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
wettyoss/wetty:latest4f7c56d5b961
ip-address@9.0.5
10.7.1

Open the chart page →

6,873
audiobookshelfbdclark-helm-chartsVerified publisher0.1.41 of 1See more

audiobookshelf bdclark-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
ip-address@9.0.5
10.7.1

Open the chart page →

1,899
pangolinbdcode0.14.11 of 1See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
fosrl/pangolin:latest00cfb631097a
ip-address@10.2.0
10.7.1

Open the chart page →

2,084
bluesky-pdsbear0.4.2081 of 1See more

bluesky-pds bear 0.4.208

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
ip-address@9.0.5
10.7.1

Open the chart page →

2,329
immichbear0.1.11 of 2See more

immich bear 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
ip-address@10.1.0
10.7.1

Open the chart page →

7,555
bluerange-mosquittobluerangeOfficialVerified publisher1.1.01 of 1See more

bluerange-mosquitto bluerange 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
bluerange/bluerange-mosquitto:2690a4e5b92cc6
ip-address@10.4.0
10.7.1

Open the chart page →

215
colosseumbook-k8sinfra-v21.0.182 of 5See more

colosseum book-k8sinfra-v2 1.0.18

2 of the 5 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-cms:loge74b43c7f492
ip-address@9.0.5
10.7.1
sysnet4admin/colosseum-prm:log5802bfcd7fed
ip-address@9.0.5
10.7.1

Open the chart page →

29,409
rtorrent-floodbryanalves0.5.01 of 1See more

rtorrent-flood bryanalves 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
jesec/flood:4.7.03d1d0bec117a
ip-address@6.4.0
10.7.1

Open the chart page →

1,557
node-appbryopsida0.5.12 of 2See more

node-app bryopsida 0.5.1

2 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
library/node:lts64af3819f927
ip-address@10.2.0
10.7.1
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
ip-address@9.0.5
10.7.1

Open the chart page →

79,935
openmctbryopsida0.1.11 of 1See more

openmct bryopsida 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/openmct:main38b6a50a62b2
ip-address@9.0.5
10.7.1

Open the chart page →

1,307
syslog-portalbryopsida0.3.11 of 1See more

syslog-portal bryopsida 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/syslog-portal:main3947bfd04f49
ip-address@9.0.5
10.7.1

Open the chart page →

1,422
cross-seedcfi20176.13.61 of 1See more

cross-seed cfi2017 6.13.6

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/cross-seed/cross-seed:6.13.381afafdd96a5
ip-address@9.0.5
10.7.1

Open the chart page →

1,461
qbittorrentcfi20176.13.31 of 1See more

qbittorrent cfi2017 6.13.3

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/cross-seed/cross-seed:6.13.381afafdd96a5
ip-address@9.0.5
10.7.1

Open the chart page →

1,461
dv-podcharonOfficialVerified publisher0.19.11 of 5See more

dv-pod charon 0.19.1

1 of the 5 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
obolnetwork/charon-dkg-sidecar:maine263be0a7440
ip-address@10.0.1
10.7.1

Open the chart page →

8,135
ghostchart-ghost0.1.61 of 2See more

ghost chart-ghost 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
library/ghost:6.65.0-alpine3.23fea3264f902e
ip-address@10.1.0
10.7.1

Open the chart page →

1,283
audiobookshelfcharts-derwitt-devVerified publisher1.1.21 of 1See more

audiobookshelf charts-derwitt-dev 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.37.06432d1dc5895
ip-address@10.2.0
10.7.1

Open the chart page →

1,403
chatgpt-next-webchatgpt-next-web0.1.11 of 1See more

chatgpt-next-web chatgpt-next-web 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
yidadaa/chatgpt-next-web:latesteaaa469ddeeb
ip-address@9.0.5
10.7.1

Open the chart page →

2,189
audiobookshelfchristianhuthVerified publisher2.5.01 of 1See more

audiobookshelf christianhuth 2.5.0

1 of the 1 container images this version deploys carry CVE-2026-101912.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.37.06432d1dc5895
ip-address@10.2.0
10.7.1

Open the chart page →

1,403

Container images carrying it

573 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
frinx/frinx-inventory-server:6.1.086c9ce1f5e31
ip-address@9.0.5
10.7.1
1
fthomas/scala-steward:latesta8eb43927576
ip-address@10.1.0
10.7.1
1
gethue/hue:latest7d5c1b9f8a79
ip-address@10.1.0
10.7.1
1
getwud/wud:8.1.1b1cd01c43839
ip-address@9.0.5
10.7.1
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
ip-address@10.1.0
10.7.1
1
globalping/globalping-probe:latestb8469caf783a
ip-address@10.1.0
10.7.1
1
growthbook/growthbook:5.1.0c8a124f55dca
ip-address@10.5.0
10.7.1
1
growthbook/growthbook:latestcbf1bc59e9a9
ip-address@10.5.0
10.7.1
1
haohanyang/compass-web:0.5.054f2112602ee
ip-address@10.1.0
10.7.1
1
haohanyang/compass-web:0.1.1e3952b14ae8e
ip-address@9.0.5
10.7.1
1
haohanyang/compass-web:0.5.1f4f8fe4e21f1
ip-address@10.2.0
10.7.1
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
ip-address@9.0.5
10.7.1
1
helmforge/opencut:v0.3.0bf11156e0ab5
ip-address@10.2.0
10.7.1
1
helmforge/strapi-base:5.52.270e9143d6d92
ip-address@10.7.0
10.7.1
1
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
ip-address@9.0.5
10.7.1
1
honglab/slack-emoji-maker:v0.0.1ca075a926fe1
ip-address@9.0.5
10.7.1
1
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
ip-address@9.0.5
10.7.1
1
hoppscotch/hoppscotch:2026.8.2e7ba6061a286
ip-address@10.5.0
10.7.1
1
ilum/marquez-web:0.53.2716437a51a6c
ip-address@10.0.1
10.7.1
1
infisical/infisical:latest:v0.165.602082bf13163
ip-address@9.0.5
10.7.1
1
infisical/infisical:latest3365445909be
ip-address@10.7.0
10.7.1
1
instill/console:0.68.54cd70e2df5c6
ip-address@9.0.5
10.7.1
1
iwakitakuma/gitlab-mcp:2.0.7fb3e81aa6528
ip-address@9.0.5
10.7.1
1
jaedb/iris:latest048cfbf58d57
ip-address@9.0.5
10.7.1
1
jesec/flood:4.7.03d1d0bec117a
ip-address@6.4.0
10.7.1
1
jesec/flood:4.6.060bd59cfb4eb
ip-address@6.4.0
10.7.1
1
jesec/flood:4.14.3c887dad96b40
ip-address@10.1.0
10.7.1
1
jesec/rtorrent-flood:latestf0c894ec459e
ip-address@6.4.0
10.7.1
1
jhidalgo3/hello-kubernetes:1.0.0.1397bf5ddfa8628d79f5
ip-address@9.0.5
10.7.1
1
jkroepke/github_exporter:1.8.03d850992786d
ip-address@10.0.1
10.7.1
1
johly/airtrail:v3.11.19f702b91e0e7
ip-address@10.1.0
10.7.1
1
joplin/server:3.0-beta52af57880c0e
ip-address@9.0.5
10.7.1
1
journeyapps/powersync-service:latest413a0c813e96
ip-address@10.2.0
10.7.1
1
kaushaln1/helm_node_app:lateste9f2d5dfdba0
ip-address@9.0.5
10.7.1
1
kerolosayman308/voting-app-env:examplevotingapp_result6e92e5a231fa
ip-address@9.0.5
10.7.1
1
kitware/cdash:v5.4.0da5abe941506
ip-address@10.2.0
10.7.1
1
koenkk/zigbee2mqtt:2.7.260a295b40f4e
ip-address@10.0.1
10.7.1
1
laituanmanh/websearch-crawler:latest63b6da557c71
ip-address@9.0.5
10.7.1
1
laly9999/node-app:1dd0e503913e1
ip-address@9.0.5
10.7.1
1
langflowai/langflow:1.12.334055a07d446
ip-address@10.3.1
10.7.1
1
langgenius/dify-agent-local-sandbox:1.16.1bf8027ddccf3
ip-address@9.0.5
10.7.1
1
langgenius/dify-api:1.16.1dcefa5f7c47c
ip-address@9.0.5
10.7.1
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
ip-address@10.2.0
10.7.1
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
ip-address@10.2.0
10.7.1
1
langgenius/dify-web:1.16.187dd47e4e28f
ip-address@9.0.5
10.7.1
1
langgenius/dify-web:0.6.11a2a294743634
ip-address@9.0.5
10.7.1
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
ip-address@9.0.5
10.7.1
1
langgenius/dify-web:1.0.0d64914ff0d6d
ip-address@9.0.5
10.7.1
1
lbenicio/helm-pilot:0.2.54594a2632510
ip-address@10.1.0
10.7.1
1
lbenicio/stremio-web:latest732f9003de33
ip-address@10.1.0
10.7.1
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.