StackRadar

CVE-2026-101913

Medium

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
557
of 17,939 indexed, latest versions
Container images
568
deployed by those charts
Fix available
1 of 1
affected package

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

Carried by container images the latest versions of 557 of 17,939 indexed charts deploy, on 568 images.

Affected packageAffected versionsFixed inImages
ip-addressnpm5.9.4, 6.1.0, 6.4.0, 7.1.0+9 more10.5.1568
OSV records
GHSA-rpw4-54j3-4h4q
Trending
Rank 14 in indexed charts, since 29 Sept 2026. See the ranking →

Charts affected

557 by stars
ChartLatestAffected imagesRadar Score
uptime-kumahelmforgeVerified publisher1.5.151 of 1See more

uptime-kuma helmforge 1.5.15

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.5c74379ac4509
ip-address@10.1.0
10.5.1

Open the chart page →

31,945
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
ip-address@9.0.5
10.5.1

Open the chart page →

4,345
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
ip-address@10.1.0
10.5.1

Open the chart page →

68,884
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
ip-address@9.0.5
10.5.1

Open the chart page →

16,850
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
ip-address@9.0.5
10.5.1

Open the chart page →

5,486
keycloak-reporterkeycloak-reporterVerified publisher1.4.151 of 1See more

keycloak-reporter keycloak-reporter 1.4.15

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
ip-address@10.2.0
10.5.1

Open the chart page →

1,517
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
ip-address@10.1.0
10.5.1

Open the chart page →

2,603
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
langgenius/dify-web:0.6.11a2a294743634
ip-address@9.0.5
10.5.1

Open the chart page →

21,412
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
ip-address@10.0.1
10.5.1

Open the chart page →

1,510
chibisafel4gVerified publisher0.1.12 of 3See more

chibisafe l4g 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
chibisafe/chibisafe:latest836467a50792
ip-address@9.0.5
10.5.1
chibisafe/chibisafe-server:latest3da4fcbc1a18
ip-address@9.0.5
10.5.1

Open the chart page →

5,206
langflow-idelangflow0.1.21 of 2See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
langflowai/langflow:latest79c02794adeb
ip-address@10.3.1
10.5.1

Open the chart page →

4,270
langflow-runtimelangflow0.1.11 of 1See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
langflowai/langflow:latest79c02794adeb
ip-address@10.3.1
10.5.1

Open the chart page →

159
bitwarden-crd-operatorlerentisVerified publisher0.19.01 of 1See more

bitwarden-crd-operator lerentis 0.19.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/lerentis/bitwarden-crd-operator:0.18.0912b19a7f09a
ip-address@10.1.0
10.5.1

Open the chart page →

555
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
ip-address@9.0.5
10.5.1

Open the chart page →

4,703
litlyxlitlyx0.2.03 of 5See more

litlyx litlyx 0.2.0

3 of the 5 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
litlyx/litlyx-consumer:latest02225e77d316
ip-address@9.0.5
10.5.1
litlyx/litlyx-dashboard:lateste64ff2d52385
ip-address@10.1.0
10.5.1
litlyx/litlyx-producer:latest10407f36613f
ip-address@9.0.5
10.5.1

Open the chart page →

8,270
actualbudgetm0nsterrr-actualbudgetVerified publisher2.10.01 of 1See more

actualbudget m0nsterrr-actualbudget 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
actualbudget/actual-server:26.9.0552beab3dec8
ip-address@10.2.0
10.5.1

Open the chart page →

1,240
mend-renovate-enterprise-editionmend-renovateVerified publisher10.6.01 of 2See more

mend-renovate-enterprise-edition mend-renovate 10.6.0

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/mend/renovate-ee-server:15.6.087b77989f48d
ip-address@10.2.0
10.5.1

Open the chart page →

38,104
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
ip-address@9.0.5
10.5.1

Open the chart page →

14,487
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
ip-address@10.1.1
10.5.1

Open the chart page →

2,875
oadaoadaVerified publisher5.0.610 of 11See more

oada oada 5.0.6

10 of the 11 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
oada/auth:4.0.0c0d077e79ef4
ip-address@9.0.5
10.5.1
oada/http-handler:4.0.0d87efe8ba4b0
ip-address@9.0.5
10.5.1
oada/rev-graph-update:4.0.0ebc8343f05ff
ip-address@9.0.5
10.5.1
oada/shares:4.0.0c6ffb4e8ed63
ip-address@9.0.5
10.5.1
oada/startup:4.0.0fc09495e2f3c
ip-address@9.0.5
10.5.1
oada/sync-handler:4.0.0b7a2cfc137cf
ip-address@9.0.5
10.5.1
oada/users:4.0.0b6c562fa5b1b
ip-address@9.0.5
10.5.1
oada/webhooks:4.0.06590c60de347
ip-address@9.0.5
10.5.1
oada/well-known:4.0.07943fde43b19
ip-address@9.0.5
10.5.1
oada/write-handler:4.0.08464c7f48aae
ip-address@9.0.5
10.5.1

Open the chart page →

13,869
dashdotoben01Verified publisher1.5.01 of 1See more

dashdot oben01 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
mauricenino/dashdot:5.9.2236997816917
ip-address@9.0.5
10.5.1

Open the chart page →

1,444
observability-mcpobservability-mcpOfficialVerified publisher2.9.121 of 2See more

observability-mcp observability-mcp 2.9.12

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/thotischner/observability-mcp:3.9.11775e1e84d5d1
ip-address@10.3.1
10.5.1

Open the chart page →

37
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
growthbook/growthbook:latestcbf1bc59e9a9
ip-address@10.5.0
10.5.1

Open the chart page →

1,249
kuttone-acre-fundVerified publisher0.2.51 of 1See more

kutt one-acre-fund 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
kutt/kutt:latestfa3d24a89b04
ip-address@10.2.0
10.5.1

Open the chart page →

525
openccuopenccuVerified publisher3.89.111 of 1See more

openccu openccu 3.89.11

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/openccu/openccu:3.89.11.202609193cfcb30e1921
ip-address@10.1.0
10.5.1

Open the chart page →

1,527
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
ip-address@9.0.5
10.5.1

Open the chart page →

7,294
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
ip-address@10.0.1
10.5.1

Open the chart page →

7,229
patchworkpatchworkVerified publisher0.8.61 of 2See more

patchwork patchwork 0.8.6

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/patchwork:mainc01e018bced4
ip-address@9.0.5
10.5.1

Open the chart page →

2,170
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
ip-address@10.2.0
10.5.1

Open the chart page →

7,722
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
ip-address@10.1.0
10.5.1

Open the chart page →

33,426
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
ip-address@10.0.1
10.5.1

Open the chart page →

9,037
psa-restricted-patcherpsa-restricted-patcherVerified publisher0.10.11 of 1See more

psa-restricted-patcher psa-restricted-patcher 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/psa-restricted-patcher:maina53ef16b024a
ip-address@9.0.5
10.5.1

Open the chart page →

1,478
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
ip-address@10.1.0
10.5.1

Open the chart page →

5,898
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
ip-address@9.0.5
10.5.1

Open the chart page →

3,066
kyoorubxkubeVerified publisher0.1.101 of 9See more

kyoo rubxkube 0.1.10

1 of the 9 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
ip-address@9.0.5
10.5.1

Open the chart page →

32,223
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
ip-address@10.0.1
10.5.1

Open the chart page →

40,413
immichsecustorVerified publisher2.0.61 of 1See more

immich secustor 2.0.6

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.2.279cc1623323d
ip-address@10.2.0
10.5.1

Open the chart page →

3,427
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
ip-address@9.0.5
10.5.1

Open the chart page →

5,413
helm64-toolboxserdigital64Verified publisher0.4.01 of 1See more

helm64-toolbox serdigital64 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/automation64/toolbox/oraclelinux-9-toolbox:latest7af2216c7b9e
ip-address@10.2.0
10.5.1

Open the chart page →

1,551
wg-easyslybase-wg-easyVerified publisher1.2.01 of 1See more

wg-easy slybase-wg-easy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/wg-easy/wg-easy:15.4.00e7bc9d34e86
ip-address@10.2.0
10.5.1

Open the chart page →

775
speckle-serverspeckleVerified publisher2.26.32 of 4See more

speckle-server speckle 2.26.3

2 of the 4 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.26.3092384dba45d
ip-address@9.0.5
10.5.1
speckle/speckle-server:2.26.379f14a2bf931
ip-address@9.0.5
10.5.1

Open the chart page →

11,132
stackradar-scannerstackradarVerified publisher0.4.01 of 1See more

stackradar-scanner stackradar 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/lockdep/stackradar-scanner:0.4.073cbeb990cf4
ip-address@10.1.0
10.5.1

Open the chart page →

1,271
stornxstornxVerified publisher1.1.11 of 9See more

stornx stornx 1.1.1

1 of the 9 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
alazidis/stornx:1.1.1602d4f7f090c
ip-address@9.0.5
10.5.1

Open the chart page →

12,206
supabasesupabse0.8.03 of 11See more

supabase supabse 0.8.0

3 of the 11 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
supabase/postgres-meta:v0.96.6a84cc713585e
ip-address@9.0.5
10.5.1
supabase/storage-api:v1.60.4c8eb9858eafe
ip-address@10.1.0
10.5.1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
ip-address@10.1.0
10.5.1

Open the chart page →

19,207
switcher-apiswitcherapiOfficialVerified publisher1.3.52 of 3See more

switcher-api switcherapi 1.3.5

2 of the 3 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
trackerforce/switcher-api:latest28ee0c4e0b88
ip-address@10.2.0
10.5.1
trackerforce/switcher-resolver-node:latest67e2c261f7b4
ip-address@10.2.0
10.5.1

Open the chart page →

722
tenuretenureVerified publisher1.0.61 of 2See more

tenure tenure 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
tenureai/tenure:v1.0.285f5b222df9a5
ip-address@10.2.0
10.5.1

Open the chart page →

2,667
u-storeunifieVerified publisher1.2.01 of 1See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
ip-address@9.0.5
10.5.1

Open the chart page →

15,891
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
ip-address@9.0.5
10.5.1

Open the chart page →

13,376
vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets0.0.0-main1 of 2See more

vaultwarden-kubernetes-secrets vaultwarden-kubernetes-secrets 0.0.0-main

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
ip-address@9.0.5
10.5.1

Open the chart page →

4,321
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
ip-address@9.0.5
10.5.1

Open the chart page →

5,383

Container images carrying it

568 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
ip-address@9.0.5
10.5.1
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
ip-address@10.4.0
10.5.1
1
quay.io/seamware/fdsc-dashboard:0.6.51b02c5685f01
ip-address@9.0.5
10.5.1
1
quay.io/seamware/onboarding:0.2.2b406475f9f00
ip-address@10.1.0
10.5.1
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
ip-address@10.1.0
10.5.1
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
ip-address@9.0.5
10.5.1
1
registry.gitlab.com/dyff/dyff-frontend:0.20.2481be0beaafe
ip-address@9.0.5
10.5.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
ip-address@10.1.0
10.5.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
ip-address@10.1.0
10.5.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
ip-address@10.1.0
10.5.1
1
registry.gitlab.com/evolves-fr/s3-browser:0.4.1c350c941fe7b
ip-address@10.1.0
10.5.1
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-api-gateway:prodf8474a665b11
ip-address@10.5.0
10.5.1
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-events:prod764ca253f951
ip-address@10.5.0
10.5.1
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbdb1bcedf26f
ip-address@10.5.0
10.5.1
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-workspaces:prode64a1cb3aa42
ip-address@10.5.0
10.5.1
1
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
ip-address@10.4.0
10.5.1
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
ip-address@9.0.5
10.5.1
1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.94.09d9860c05c39
ip-address@10.2.0
10.5.1
1

syft 1.42.1 · advisories as of 29 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.