StackRadar

CVE-2026-101913

Medium

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
557
of 17,939 indexed, latest versions
Container images
568
deployed by those charts
Fix available
1 of 1
affected package

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

Carried by container images the latest versions of 557 of 17,939 indexed charts deploy, on 568 images.

Affected packageAffected versionsFixed inImages
ip-addressnpm5.9.4, 6.1.0, 6.4.0, 7.1.0+9 more10.5.1568
OSV records
GHSA-rpw4-54j3-4h4q
Trending
Rank 14 in indexed charts, since 29 Sept 2026. See the ranking →

Charts affected

557 by stars
ChartLatestAffected imagesRadar Score
apisix-ingress-controllerwenerme1.4.01 of 2See more

apisix-ingress-controller wenerme 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/api7/adc:0.27.1f65f53dd9668
ip-address@10.1.0
10.5.1

Open the chart page →

1,844
opensearch-dashboardswenerme3.8.01 of 1See more

opensearch-dashboards wenerme 3.8.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.8.07fb7ec1b33f1
ip-address@10.2.0
10.5.1

Open the chart page →

328
verdacciowenerme4.35.11 of 1See more

verdaccio wenerme 4.35.1

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
verdaccio/verdaccio:6.10.209b403888c8f
ip-address@10.1.0
10.5.1

Open the chart page →

238
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
requarks/wiki:2af71a17dc27c
ip-address@10.2.0
10.5.1

Open the chart page →

3,698
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
ip-address@9.0.5
10.5.1

Open the chart page →

6,636
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
ip-address@9.0.5
10.5.1

Open the chart page →

14,832
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
ip-address@6.4.0
10.5.1

Open the chart page →

9,718

Container images carrying it

568 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/sct/overseerr:1.35.06197516c9d7b
ip-address@9.0.5
10.5.1
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
ip-address@9.0.5
10.5.1
1
ghcr.io/seanmorley15/adventurelog-frontend:v0.13.051ee22428b41
ip-address@10.2.0
10.5.1
1
ghcr.io/seerr-team/seerr:v3.5.027602401178d
ip-address@9.0.5
10.5.1
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
ip-address@9.0.5
10.5.1
1
ghcr.io/shuguet/pacman:latesta0ec71732c3c
ip-address@10.1.0
10.5.1
1
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
ip-address@10.0.1
10.5.1
1
ghcr.io/tale/headplane:0.5.50dbc52cffc19
ip-address@9.0.5
10.5.1
1
ghcr.io/talhajuikar/stateful-data-generator:v1.1.1dfd7ea7303a2
ip-address@9.0.5
10.5.1
1
ghcr.io/tarampampam/video-dl-bot:1.4.36daa2dc7556b
ip-address@10.2.0
10.5.1
1
ghcr.io/theconnman/docker-hub-rss:0.6.238eba84b2be8
ip-address@9.0.5
10.5.1
1
ghcr.io/theduffman85/crowdsec-web-ui:2026.9.162614fd45986
ip-address@10.1.1
10.5.1
1
ghcr.io/thm-mni-ii/fbs-collab:v2.0.1366bc4ec1079
ip-address@10.1.0
10.5.1
1
ghcr.io/thm-mni-ii/fbs-qcm-backend:v2.0.12633b7c61fb1
ip-address@9.0.5
10.5.1
1
ghcr.io/thm-mni-ii/fbs-qcm-frontend:v2.0.128c98d86ed77
ip-address@9.0.5
10.5.1
1
ghcr.io/thotischner/observability-mcp:3.9.11775e1e84d5d1
ip-address@10.3.1
10.5.1
1
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
ip-address@10.4.0
10.5.1
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
ip-address@9.0.5
10.5.1
1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
ip-address@9.0.5
10.5.1
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
ip-address@9.0.5
10.5.1
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
ip-address@10.1.0
10.5.1
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
ip-address@9.0.5
10.5.1
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
ip-address@10.1.0
10.5.1
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
ip-address@10.1.0
10.5.1
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
ip-address@10.0.1
10.5.1
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
ip-address@9.0.5
10.5.1
1
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
ip-address@10.2.0
10.5.1
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
ip-address@9.0.5
10.5.1
1
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
ip-address@9.0.5
10.5.1
1
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
ip-address@9.0.5
10.5.1
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
ip-address@9.0.5
10.5.1
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
ip-address@9.0.5
10.5.1
1
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
ip-address@10.1.0
10.5.1
1
ghcr.io/zazukoians/qlever-ui:v0.10.151a7ec1c2de4
ip-address@9.0.5
10.5.1
1
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
ip-address@9.0.5
10.5.1
1
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
ip-address@10.1.0
10.5.1
1
mcr.microsoft.com/playwright/mcp:v0.0.43e101b832b34d
ip-address@9.0.5
10.5.1
1
public.ecr.aws/aktosecurity/akto-puppeteer-replay:1.49.4_latestf1c5763d565e
ip-address@10.1.0
10.5.1
1
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
ip-address@9.0.5
10.5.1
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
ip-address@9.0.5
10.5.1
1
public.ecr.aws/jtekt-corporation/api-key-manager-api:v0.1.175a48d987e0f
ip-address@10.2.0
10.5.1
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
ip-address@9.0.5
10.5.1
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
ip-address@9.0.5
10.5.1
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
ip-address@9.0.5
10.5.1
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
ip-address@6.4.0
10.5.1
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
ip-address@10.1.0
10.5.1
1
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
ip-address@10.2.0
10.5.1
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
ip-address@10.1.0
10.5.1
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
ip-address@10.1.0
10.5.1
1
quay.io/mittwald/kube-mail:latest04f1099241fc
ip-address@9.0.5
10.5.1
1

syft 1.42.1 · advisories as of 29 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.