StackRadar

CVE-2026-101913

Medium

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
557
of 17,939 indexed, latest versions
Container images
568
deployed by those charts
Fix available
1 of 1
affected package

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

Carried by container images the latest versions of 557 of 17,939 indexed charts deploy, on 568 images.

Affected packageAffected versionsFixed inImages
ip-addressnpm5.9.4, 6.1.0, 6.4.0, 7.1.0+9 more10.5.1568
OSV records
GHSA-rpw4-54j3-4h4q
Trending
Rank 14 in indexed charts, since 29 Sept 2026. See the ranking →

Charts affected

557 by stars
ChartLatestAffected imagesRadar Score
findery-marketfindery-market0.1.01 of 7See more

findery-market findery-market 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
chandanteekinavar/findery-market-user-service:1.049e164a9a439
ip-address@9.0.5
10.5.1

Open the chart page →

8,117
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
ip-address@9.0.5
10.5.1

Open the chart page →

118,033
consent-managerfiware0.1.21 of 1See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
quay.io/wi_stefan/consent-manager:0.0.656399619568b
ip-address@10.1.0
10.5.1

Open the chart page →

2,066
fdsc-dashboardfiware0.6.101 of 1See more

fdsc-dashboard fiware 0.6.10

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
quay.io/seamware/fdsc-dashboard:0.6.51b02c5685f01
ip-address@9.0.5
10.5.1

Open the chart page →

739
onboarding-portalfiware1.4.31 of 1See more

onboarding-portal fiware 1.4.3

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
quay.io/seamware/onboarding:0.2.2b406475f9f00
ip-address@10.1.0
10.5.1

Open the chart page →

1,676
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
ip-address@9.0.5
10.5.1

Open the chart page →

4,827
facetflanksourceVerified publisher0.1.731 of 1See more

facet flanksource 0.1.73

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
ip-address@10.1.0
10.5.1

Open the chart page →

22,454
flanksource-uiflanksourceVerified publisher1.4.3201 of 1See more

flanksource-ui flanksource 1.4.320

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.320d952c2a774a2
ip-address@9.0.5
10.5.1

Open the chart page →

2,734
mission-controlflanksourceVerified publisher0.1.3381 of 8See more

mission-control flanksource 0.1.338

1 of the 8 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
ip-address@9.0.5
10.5.1

Open the chart page →

9,456
uptime-kumafluent-operatorVerified publisher0.1.01 of 1See more

uptime-kuma fluent-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
louislam/uptime-kuma:170233f4acb51
ip-address@10.0.1
10.5.1

Open the chart page →

3,627
fluxer-helmfluxer-helm0.3.01 of 18See more

fluxer-helm fluxer-helm 0.3.0

1 of the 18 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/fluxerapp/fluxer-api:2026.820.164808f683541d5374
ip-address@10.2.0
10.5.1

Open the chart page →

29,230
activepiecesfmjstudios0.2.31 of 1See more

activepieces fmjstudios 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
activepieces/activepieces:0.28.0a12efde0c535
ip-address@9.0.5
10.5.1

Open the chart page →

3,395
linkwardenfmjstudios0.3.61 of 2See more

linkwarden fmjstudios 0.3.6

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.5.398214faf09f7
ip-address@9.0.5
10.5.1

Open the chart page →

3,436
uptime-kumafmjstudios0.2.21 of 1See more

uptime-kuma fmjstudios 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
ip-address@9.0.5
10.5.1

Open the chart page →

4,345
mod-graphqlfolio-org0.1.301 of 1See more

mod-graphql folio-org 0.1.30

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
folioci/mod-graphql:latestf0655a6a08fd
ip-address@9.0.5
10.5.1

Open the chart page →

1,088
frinx-frontendfrinx-helm-charts4.1.01 of 2See more

frinx-frontend frinx-helm-charts 4.1.0

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
frinx/frinx-graphql-proxy:6.1.05f1368ef47b8
ip-address@9.0.5
10.5.1

Open the chart page →

4,955
frinx-machinefrinx-helm-charts11.0.02 of 26See more

frinx-machine frinx-helm-charts 11.0.0

2 of the 26 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
frinx/frinx-graphql-proxy:7.0.017a139608024
ip-address@9.0.5
10.5.1
frinx/frinx-inventory-server:7.0.16b1992c79e78
ip-address@9.0.5
10.5.1

Open the chart page →

44,191
inventoryfrinx-helm-charts6.0.21 of 4See more

inventory frinx-helm-charts 6.0.2

1 of the 4 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
frinx/frinx-inventory-server:6.1.086c9ce1f5e31
ip-address@9.0.5
10.5.1

Open the chart page →

4,830
game2048game20481.0.01 of 1See more

game2048 game2048 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
letsbootch/argocd-game2048-app:1.0.0288abd32b2b7
ip-address@9.0.5
10.5.1

Open the chart page →

941
garge-appgargeVerified publisher0.1.531 of 1See more

garge-app garge 0.1.53

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
sondresjo/garge-app:v1.22.0c4b8f096df6b
ip-address@10.5.0
10.5.1

Open the chart page →

646
floodgeek-cookbookVerified publisher6.4.21 of 1See more

flood geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
jesec/flood:4.6.060bd59cfb4eb
ip-address@6.4.0
10.5.1

Open the chart page →

2,026
mopidygeek-cookbookVerified publisher0.1.21 of 1See more

mopidy geek-cookbook 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
jaedb/iris:latest048cfbf58d57
ip-address@9.0.5
10.5.1

Open the chart page →

13,962
rtorrent-floodgeek-cookbookVerified publisher9.4.21 of 1See more

rtorrent-flood geek-cookbook 9.4.2

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
jesec/rtorrent-flood:latestf0c894ec459e
ip-address@6.4.0
10.5.1

Open the chart page →

2,026
genieacsgenieacsVerified publisher0.5.11 of 2See more

genieacs genieacs 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
drumsergio/genieacs:1.2.16.028244054e1bf
ip-address@10.1.0
10.5.1

Open the chart page →

4,479
qryn-helmgigapipeVerified publisher0.1.91 of 1See more

qryn-helm gigapipe 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
qxip/qryn:3.2.3977acc9c7a9fd
ip-address@9.0.5
10.5.1

Open the chart page →

3,185
redis-uigin0.0.11 of 1See more

redis-ui gin 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
patrikx3/p3x-redis-ui:latestf19eb45b0694
ip-address@10.2.0
10.5.1

Open the chart page →

1,223
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
ip-address@9.0.5
10.5.1

Open the chart page →

12,364
opentelemetry-demogpg-dev0.33.83 of 27See more

opentelemetry-demo gpg-dev 0.33.8

3 of the 27 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
ip-address@9.0.5
10.5.1
ghcr.io/open-telemetry/demo:1.12.0-paymentserviceb0f13eef3abf
ip-address@9.0.5
10.5.1
ghcr.io/open-telemetry/demo:1.12.0-flagduif6bdafaa9075
ip-address@9.0.5
10.5.1

Open the chart page →

51,929
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
ip-address@9.0.5
10.5.1

Open the chart page →

3,285
web-checkhajowielandVerified publisher1.0.11 of 1See more

web-check hajowieland 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/lissy93/web-check:latest7e2ef5261764
ip-address@10.1.0
10.5.1

Open the chart page →

6,984
home-assistant-matter-hubhelm-chart-roeiVerified publisher3.0.21 of 1See more

home-assistant-matter-hub helm-chart-roei 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
luligu/matterbridge:3.0.28f97884bebc2
ip-address@9.0.5
10.5.1

Open the chart page →

4,028
nodeapphelmcharts0.1.41 of 1See more

nodeapp helmcharts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
kaushaln1/helm_node_app:lateste9f2d5dfdba0
ip-address@9.0.5
10.5.1

Open the chart page →

999
hoppscotchhelm-charts-nr0.3.11 of 1See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
ip-address@9.0.5
10.5.1

Open the chart page →

3,583
crucixhelm-crucix0.2.01 of 1See more

crucix helm-crucix 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/calesthio/crucix:latest67c5244b6acf
ip-address@10.1.0
10.5.1

Open the chart page →

821
affinehelmforgeVerified publisher1.0.11 of 3See more

affine helmforge 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
ip-address@10.4.0
10.5.1

Open the chart page →

4,030
archiveboxhelmforgeVerified publisher1.1.131 of 1See more

archivebox helmforge 1.1.13

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
archivebox/archivebox:0.9.708c21bb233130
ip-address@10.0.1
10.5.1

Open the chart page →

5,365
automatischhelmforgeVerified publisher1.3.81 of 4See more

automatisch helmforge 1.3.8

1 of the 4 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
ip-address@9.0.5
10.5.1

Open the chart page →

5,469
countlyhelmforgeVerified publisher1.2.81 of 3See more

countly helmforge 1.2.8

1 of the 3 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
ip-address@9.0.5
10.5.1

Open the chart page →

77,199
croniclehelmforgeVerified publisher1.1.101 of 1See more

cronicle helmforge 1.1.10

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
soulteary/cronicle:0.9.80ac2512fa6e39
ip-address@9.0.5
10.5.1

Open the chart page →

1,513
ghosthelmforgeVerified publisher1.2.101 of 3See more

ghost helmforge 1.2.10

1 of the 3 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
library/ghost:6.65.090592b712b6b
ip-address@10.1.0
10.5.1

Open the chart page →

2,591
hermes-agenthelmforgeVerified publisher1.0.11 of 1See more

hermes-agent helmforge 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
ip-address@10.2.0
10.5.1

Open the chart page →

5,766
homarrhelmforgeVerified publisher1.2.111 of 1See more

homarr helmforge 1.2.11

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
ip-address@10.2.0
10.5.1

Open the chart page →

482
hoppscotchhelmforgeVerified publisher1.1.121 of 2See more

hoppscotch helmforge 1.1.12

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2026.8.2e7ba6061a286
ip-address@10.5.0
10.5.1

Open the chart page →

1,736
immichhelmforgeVerified publisher1.2.91 of 5See more

immich helmforge 1.2.9

1 of the 5 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
ip-address@10.1.0
10.5.1

Open the chart page →

11,588
langflowhelmforgeVerified publisher2.0.21 of 1See more

langflow helmforge 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.334055a07d446
ip-address@10.3.1
10.5.1

Open the chart page →

95
matterbridgehelmforgeVerified publisher1.0.51 of 1See more

matterbridge helmforge 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
luligu/matterbridge:3.10.11e278cf685f91
ip-address@10.2.0
10.5.1

Open the chart page →

742
memoshelmforgeVerified publisher2.0.21 of 2See more

memos helmforge 2.0.2

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
library/node:24.21.0-alpine3.239ec4a2e28987
ip-address@10.2.0
10.5.1

Open the chart page →

141
middlewarehelmforgeVerified publisher1.2.71 of 4See more

middleware helmforge 1.2.7

1 of the 4 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
middlewareeng/middleware:0.3.1747d880812f1
ip-address@9.0.5
10.5.1

Open the chart page →

9,356
opencuthelmforgeVerified publisher1.1.101 of 5See more

opencut helmforge 1.1.10

1 of the 5 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
helmforge/opencut:v0.3.0bf11156e0ab5
ip-address@10.2.0
10.5.1

Open the chart page →

3,090
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
ip-address@10.2.0
10.5.1

Open the chart page →

2,795

Container images carrying it

568 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/ghost:6.25.12654b1e90413
ip-address@10.1.0
10.5.1
1
library/ghost:6.41.129773d6be407
ip-address@10.1.0
10.5.1
1
library/ghost:6.64.0586821cfebac
ip-address@10.1.0
10.5.1
1
library/ghost:6.39.0-alpine77196da4b0df
ip-address@10.2.0
10.5.1
1
library/ghost:6.65.0-alpine3.23fea3264f902e
ip-address@10.1.0
10.5.1
1
library/kibana:8.18.004c0fc150f3a
ip-address@9.0.5
10.5.1
1
library/mongo-express:1.0.2-20-alpine3.191aae00775251
ip-address@9.0.5
10.5.1
1
library/node:22-bookworm-slim48e4b67d85f8
ip-address@10.1.0
10.5.1
1
library/node:18-alpine8d6421d663b4
ip-address@9.0.5
10.5.1
1
library/node:208f693eaa7e0a
ip-address@9.0.5
10.5.1
1
library/node:latestfa271c47a5d8
ip-address@10.5.0
10.5.1
1
lissy93/domain-locker:latest58a903b2cdd9
ip-address@10.2.0
10.5.1
1
lissy93/networking-toolbox:latest700862839553
ip-address@9.0.5
10.5.1
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
ip-address@10.1.0
10.5.1
1
litlyx/litlyx-consumer:latest02225e77d316
ip-address@9.0.5
10.5.1
1
litlyx/litlyx-dashboard:lateste64ff2d52385
ip-address@10.1.0
10.5.1
1
litlyx/litlyx-producer:latest10407f36613f
ip-address@9.0.5
10.5.1
1
louislam/uptime-kuma:2.2.1-slim059b49d64739
ip-address@9.0.5
10.5.1
1
louislam/uptime-kuma:2.0.24c364ef96aad
ip-address@10.0.1
10.5.1
1
louislam/uptime-kuma:170233f4acb51
ip-address@10.0.1
10.5.1
1
louislam/uptime-kuma:2.4.091e963bfda56
ip-address@10.1.0
10.5.1
1
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
ip-address@10.0.1
10.5.1
1
louislam/uptime-kuma:1.23.12bc6f244ecf27
ip-address@9.0.5
10.5.1
1
lucassandin/welcome-client:latest48468b1ccd16
ip-address@9.0.5
10.5.1
1
luligu/matterbridge:3.0.28f97884bebc2
ip-address@9.0.5
10.5.1
1
luligu/matterbridge:3.10.11e278cf685f91
ip-address@10.2.0
10.5.1
1
maildev/maildev:2.2.1180ef51f65ee
ip-address@9.0.5
10.5.1
1
mauricenino/dashdot:5.9.2236997816917
ip-address@9.0.5
10.5.1
1
mautic/mautic:7-apacheeb8cc73d97e1
ip-address@10.1.0
10.5.1
1
mcp/kubernetes:latest5ffbf7f0a8aa
ip-address@10.2.0
10.5.1
1
mcpuse/inspector:latest4f23f55e7c96
ip-address@10.1.0
10.5.1
1
middlewareeng/middleware:0.3.1747d880812f1
ip-address@9.0.5
10.5.1
1
mishtinetwork/operator:latestbb3fe67a5f7c
ip-address@9.0.5
10.5.1
1
misskey/misskey:12.110.1e08b7c478093
ip-address@7.1.0
10.5.1
1
mitre/heimdall2:release-latest06f6e72d416a
ip-address@10.4.0
10.5.1
1
moonrailgun/tianji:1.11.2b528c8f8fcc4
ip-address@9.0.5
10.5.1
1
moreillon/api-proxy:latestd7d4a5463525
ip-address@9.0.5
10.5.1
1
moreillon/camera-proxy:latestce60056b50c2
ip-address@9.0.5
10.5.1
1
moreillon/food-manager:lateste8fd856e593d
ip-address@9.0.5
10.5.1
1
moreillon/group-manager:latest3caa8f710ee0
ip-address@9.0.5
10.5.1
1
n8nio/n8n:2.25.7761374d4eb84
ip-address@10.1.1
10.5.1
1
n8nio/n8n:1.86.08b39ed5a2de9
ip-address@9.0.5
10.5.1
1
n8nio/n8n:2.40.59f693fd55655
ip-address@10.3.1
10.5.1
1
n8nio/n8n:2.36.8cfe2704ff858
ip-address@10.3.1
10.5.1
1
n8nio/n8n:1.33.1dd171d45102a
ip-address@9.0.5
10.5.1
1
n8nio/n8n:1.115.1ed16e560c40e
ip-address@9.0.5
10.5.1
1
n8nio/n8n:2.41.3fdce8f852ac7
ip-address@10.3.1
10.5.1
1
neoskop/ixy:2.2.015a480e34778
ip-address@10.2.0
10.5.1
1
nocodb/nocodb:0.258.06779a4ddedf2
ip-address@9.0.5
10.5.1
1
nocodb/nocodb:0.301.5d9516f0bf546
ip-address@9.0.5
10.5.1
1

syft 1.42.1 · advisories as of 29 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.