StackRadar

CVE-2026-101913

Medium

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
557
of 17,939 indexed, latest versions
Container images
568
deployed by those charts
Fix available
1 of 1
affected package

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

Carried by container images the latest versions of 557 of 17,939 indexed charts deploy, on 568 images.

Affected packageAffected versionsFixed inImages
ip-addressnpm5.9.4, 6.1.0, 6.4.0, 7.1.0+9 more10.5.1568
OSV records
GHSA-rpw4-54j3-4h4q
Trending
Rank 14 in indexed charts, since 29 Sept 2026. See the ranking →

Charts affected

557 by stars
ChartLatestAffected imagesRadar Score
opencloudcommunity-opencloud3.1.01 of 13See more

opencloud community-opencloud 3.1.0

1 of the 13 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
opencloudeu/yjs:1.0.02beddf0cc6db
ip-address@10.2.0
10.5.1

Open the chart page →

9,829
conversor-temperaturaconversor-temperaturaVerified publisher0.1.01 of 1See more

conversor-temperatura conversor-temperatura 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
felipecs8/conversor-temperatura:v1f945423be36d
ip-address@9.0.5
10.5.1

Open the chart page →

1,730
cors-proxycors-proxyVerified publisher1.2.01 of 1See more

cors-proxy cors-proxy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/hiteshnayak305/cors-proxy:1.2.0e6ff0a131556
ip-address@9.0.5
10.5.1

Open the chart page →

1,686
cortezacorteza1.1.01 of 3See more

corteza corteza 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
cortezaproject/corteza-server-corredor:2024.9.44ea78dfe5364
ip-address@9.0.5
10.5.1

Open the chart page →

8,868
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
ip-address@9.0.5
10.5.1

Open the chart page →

15,508
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.4.11787550d2358
ip-address@6.4.0
10.5.1

Open the chart page →

14,397
cspconsolecspconsole1.3.111 of 5See more

cspconsole cspconsole 1.3.11

1 of the 5 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
cspconsole/report-processor:1.0.279a2d8840bfdf
ip-address@10.1.0
10.5.1

Open the chart page →

13,010
kuberay-dashboarddanchevVerified publisher0.0.51 of 1See more

kuberay-dashboard danchev 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
ip-address@10.2.0
10.5.1

Open the chart page →

592
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
ip-address@9.0.5
10.5.1

Open the chart page →

23,176
datacube-wpsdatacube-charts0.9.01 of 1See more

datacube-wps datacube-charts 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
opendatacube/wps:latest80df355a660b
ip-address@9.0.5
10.5.1

Open the chart page →

6,571
dbgatedbgate-helm-chartVerified publisher0.1.81 of 1See more

dbgate dbgate-helm-chart 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
dbgate/dbgate:7.2.3f2dc7423ea88
ip-address@10.1.0
10.5.1

Open the chart page →

1,544
decisionrules-aksdecisionrules-aksVerified publisher0.2.01 of 2See more

decisionrules-aks decisionrules-aks 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
ip-address@10.5.0
10.5.1

Open the chart page →

280
decisionrules-eksdecisionrules-eksVerified publisher0.3.01 of 2See more

decisionrules-eks decisionrules-eks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
ip-address@10.5.0
10.5.1

Open the chart page →

280
decisionrules-ingressdecisionrules-ingressVerified publisher0.2.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
ip-address@10.5.0
10.5.1

Open the chart page →

280
decisionrules-ocpdecisionrules-ocpVerified publisher0.1.02 of 4See more

decisionrules-ocp decisionrules-ocp 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
decisionrules/business-intelligence:latest45a54ef6ade6
ip-address@10.1.0
10.5.1
decisionrules/server:latest6a8f32aa11bc
ip-address@10.5.0
10.5.1

Open the chart page →

1,525
defactopsdefactops1.0.91 of 2See more

defactops defactops 1.0.9

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
defactops/defactops-backend:1.0.2307b663c0092a
ip-address@9.0.5
10.5.1

Open the chart page →

4,705
airtraildefault-ghVerified publisher0.2.21 of 2See more

airtrail default-gh 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
johly/airtrail:v3.11.19f702b91e0e7
ip-address@10.1.0
10.5.1

Open the chart page →

1,621
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
ip-address@9.0.5
10.5.1

Open the chart page →

2,581
backend-servicedev-krishan-dhaka-charts1.0.31 of 1See more

backend-service dev-krishan-dhaka-charts 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
devkrishan001/backend:latestf1c3acadeabe
ip-address@9.0.5
10.5.1

Open the chart page →

1,304
devtron-enterprisedevtron48.0.01 of 28See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
ip-address@10.0.1
10.5.1

Open the chart page →

71,259
devtron-enterprisedevtron-labs48.0.01 of 28See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
ip-address@10.0.1
10.5.1

Open the chart page →

71,259
dial-admindialVerified publisher0.19.01 of 3See more

dial-admin dial 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
epam/ai-dial-admin-frontend:0.21.01ecee9f1aa09
ip-address@10.4.0
10.5.1

Open the chart page →

3,846
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
langgenius/dify-web:1.0.0d64914ff0d6d
ip-address@9.0.5
10.5.1

Open the chart page →

56,138
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
ip-address@9.0.5
10.5.1

Open the chart page →

4,754
node-reddjdl-charts0.33.01 of 1See more

node-red djdl-charts 0.33.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
nodered/node-red:latesta649dd711d55
ip-address@10.2.0
10.5.1

Open the chart page →

156
adventurelogdjjudas21Verified publisher0.1.11 of 3See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/seanmorley15/adventurelog-frontend:v0.13.051ee22428b41
ip-address@10.2.0
10.5.1

Open the chart page →

7,928
uptime-kumadjjudas21Verified publisher1.5.181 of 1See more

uptime-kuma djjudas21 1.5.18

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.12bc6f244ecf27
ip-address@9.0.5
10.5.1

Open the chart page →

4,366
documensodocumensoVerified publisher0.0.61 of 2See more

documenso documenso 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
documenso/documenso:v1.8.17f16a9449f18
ip-address@9.0.5
10.5.1

Open the chart page →

2,746
dumpstoredumpstore0.1.12 of 2See more

dumpstore dumpstore 0.1.1

2 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
ip-address@9.0.5
10.5.1
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
ip-address@9.0.5
10.5.1

Open the chart page →

4,439
clickhouse-monitoringduyet0.1.31 of 2See more

clickhouse-monitoring duyet 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/duyet/clickhouse-monitoring:latest84edfe8a67a8
ip-address@10.2.0
10.5.1

Open the chart page →

1,093
dyff-frontenddyff-frontendVerified publisher0.20.21 of 1See more

dyff-frontend dyff-frontend 0.20.2

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/dyff-frontend:0.20.2481be0beaafe
ip-address@9.0.5
10.5.1

Open the chart page →

1,180
benchmarking-tooleclipse-aeriosVerified publisher1.0.01 of 1See more

benchmarking-tool eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
eclipseaerios/benchmarking-tool:1.0.0a4b4c2e7fe62
ip-address@10.2.0
10.5.1

Open the chart page →

744
self-orchestratoreclipse-aeriosVerified publisher1.2.01 of 1See more

self-orchestrator eclipse-aerios 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
eclipseaerios/self-orchestrator:1.2.08b123bec5679
ip-address@9.0.5
10.5.1

Open the chart page →

2,558
dashboardedu1.0.01 of 1See more

dashboard edu 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
sysnet4admin/dashboard:bluec5bd3bb1b5a6
ip-address@9.0.5
10.5.1

Open the chart page →

1,494
node-redegebackVerified publisher2.0.131 of 1See more

node-red egeback 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
nodered/node-red:5.0.410f40d0a83e7
ip-address@10.3.1
10.5.1

Open the chart page →

1,105
uptime-kumaegebackVerified publisher2.0.121 of 1See more

uptime-kuma egeback 2.0.12

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
ip-address@10.2.0
10.5.1

Open the chart page →

32,092
elk-stackelk-stack-test1.0.21 of 9See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
library/node:18-alpine8d6421d663b4
ip-address@9.0.5
10.5.1

Open the chart page →

3,416
azuriteemberstackVerified publisher1.0.211 of 1See more

azurite emberstack 1.0.21

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
ip-address@10.1.0
10.5.1

Open the chart page →

411
edp-installepmdedpOfficialVerified publisher3.15.01 of 7See more

edp-install epmdedp 3.15.0

1 of the 7 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
epamedp/krci-portal:0.8.0687acf641097
ip-address@9.0.5
10.5.1

Open the chart page →

2,184
krci-portalepmdedpVerified publisher0.8.01 of 1See more

krci-portal epmdedp 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
epamedp/krci-portal:0.8.0687acf641097
ip-address@9.0.5
10.5.1

Open the chart page →

888
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
ip-address@10.1.0
10.5.1

Open the chart page →

1,899
assertoorethereum-helm-chartsVerified publisher1.2.01 of 1See more

assertoor ethereum-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ethpandaops/assertoor:latest1efa2fba6711
ip-address@10.2.0
10.5.1

Open the chart page →

2,927
ethstatsethereum-helm-chartsVerified publisher0.1.41 of 1See more

ethstats ethereum-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
skylenet/ethstats-server:pow-latestd757cc016198
ip-address@5.9.4
10.5.1

Open the chart page →

1,135
lodestarethereum-helm-chartsVerified publisher1.2.21 of 2See more

lodestar ethereum-helm-charts 1.2.2

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
chainsafe/lodestar:latestd717e4193699
ip-address@10.2.0
10.5.1

Open the chart page →

2,670
beeport-uiethersphereVerified publisher0.76.21 of 3See more

beeport-ui ethersphere 0.76.2

1 of the 3 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
library/node:lts64af3819f927
ip-address@10.2.0
10.5.1

Open the chart page →

7,377
multichain-proxyethersphereVerified publisher0.1.01 of 1See more

multichain-proxy ethersphere 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ethersphere/multichain-proxy:0.0.261f5419afbcd
ip-address@9.0.5
10.5.1

Open the chart page →

993
multichain-uiethersphereVerified publisher0.73.11 of 3See more

multichain-ui ethersphere 0.73.1

1 of the 3 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
library/node:lts64af3819f927
ip-address@10.2.0
10.5.1

Open the chart page →

7,377
static-siteethersphereVerified publisher0.73.11 of 2See more

static-site ethersphere 0.73.1

1 of the 2 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
library/node:latestfa271c47a5d8
ip-address@10.5.0
10.5.1

Open the chart page →

6,195
express-ts-app-helm-chartsexpress-ts-app-helm-chartsVerified publisher1.0.01 of 4See more

express-ts-app-helm-charts express-ts-app-helm-charts 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/marcuwynu23/express-typescript-sample:latest9ef671b78ea8
ip-address@10.1.0
10.5.1

Open the chart page →

5,971
fauxgpufauxgpuVerified publisher0.2.41 of 4See more

fauxgpu fauxgpu 0.2.4

1 of the 4 container images this version deploys carry CVE-2026-101913.

Container imageDigestPackageFixed in
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
ip-address@10.1.0
10.5.1

Open the chart page →

3,037

Container images carrying it

568 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
decisionrules/server:latest6a8f32aa11bc
ip-address@10.5.0
10.5.1
4
redis/redisinsight:3.8:latestb5e19ee240ab
ip-address@9.0.5
10.5.1
4
joplin/server:3.7.2:latest3f7b852959aa
ip-address@10.2.0
10.5.1
3
library/node:lts64af3819f927
ip-address@10.2.0
10.5.1
3
library/node:24.21.0-alpine:lts-alpineebfe2f904627
ip-address@10.2.0
10.5.1
3
localstack/localstack:latest4abc29e923e5
ip-address@10.5.0
10.5.1
3
opensearchproject/opensearch-dashboards:3.8.07fb7ec1b33f1
ip-address@10.2.0
10.5.1
3
verdaccio/verdaccio:6.10.209b403888c8f
ip-address@10.1.0
10.5.1
3
ghcr.io/api7/adc:0.27.1f65f53dd9668
ip-address@10.1.0
10.5.1
3
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
ip-address@10.2.0
10.5.1
3
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
ip-address@10.1.0
10.5.1
3
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
ip-address@10.0.1
10.5.1
3
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
ip-address@10.5.0
10.5.1
3
actualbudget/actual-server:26.9.0552beab3dec8
ip-address@10.2.0
10.5.1
2
advplyr/audiobookshelf:2.36.13528a93b6442
ip-address@9.0.5
10.5.1
2
epamedp/krci-portal:0.8.0687acf641097
ip-address@9.0.5
10.5.1
2
homebridge/homebridge:latest77c685a40911
ip-address@10.2.0
10.5.1
2
hoppscotch/hoppscotch:2024.8.2f1da831950b7
ip-address@9.0.5
10.5.1
2
ilum/ui:6.7.3998937726679
ip-address@10.0.1
10.5.1
2
kutt/kutt:latest:v3.2.6fa3d24a89b04
ip-address@10.2.0
10.5.1
2
langflowai/langflow:latest79c02794adeb
ip-address@10.3.1
10.5.1
2
library/ghost:6.65.090592b712b6b
ip-address@10.1.0
10.5.1
2
library/mongo-express:1.0.2:latest1b23d7976f02
ip-address@9.0.5
10.5.1
2
library/node:24.21.0-alpine3.239ec4a2e28987
ip-address@10.2.0
10.5.1
2
louislam/uptime-kuma:2.5.4917318f9d7be
ip-address@10.1.0
10.5.1
2
louislam/uptime-kuma:1.23.1396510915e6be
ip-address@9.0.5
10.5.1
2
louislam/uptime-kuma:2.3.29aeb4e51d038
ip-address@10.1.0
10.5.1
2
louislam/uptime-kuma:2.5.0a8610b3b4c38
ip-address@10.2.0
10.5.1
2
louislam/uptime-kuma:2.5.5c74379ac4509
ip-address@10.1.0
10.5.1
2
mojaloop/reporting:v12.1.0d480a62103d6
ip-address@9.0.5
10.5.1
2
mojaloop/reporting-aggregator-svc:v0.0.92635baf23298
ip-address@9.0.5
10.5.1
2
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
ip-address@9.0.5
10.5.1
2
mojaloop/reporting-hub-bop-api-svc:v4.1.2b45a2d6f0f2a
ip-address@9.0.5
10.5.1
2
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
ip-address@9.0.5
10.5.1
2
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
ip-address@10.0.1
10.5.1
2
n8nio/n8n:2.36.714c4285bc303
ip-address@10.2.0
10.5.1
2
nodered/node-red:5.0.7:latesta649dd711d55
ip-address@10.2.0
10.5.1
2
nousresearch/hermes-agent:v2026.9.24fca358f12efd
ip-address@10.2.0
10.5.1
2
opensearchproject/opensearch-dashboards:1.0.039695180364b
ip-address@6.4.0
10.5.1
2
patrikx3/p3x-redis-ui:latestf19eb45b0694
ip-address@10.2.0
10.5.1
2
rajnandan1/kener:3.2.1930407afca731
ip-address@9.0.5
10.5.1
2
redis/redis-stack:7.2.0-v91c5f43fddcdd
ip-address@9.0.5
10.5.1
2
requarks/wiki:2:latest68f0d1848261
ip-address@5.9.4
10.5.1
2
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
ip-address@10.2.0
10.5.1
2
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d469:2.18.12-branch.testing3.88744-f55b3414bd113093583
ip-address@9.0.5
10.5.1
2
sysnet4admin/dashboard:bluec5bd3bb1b5a6
ip-address@9.0.5
10.5.1
2
taskrabbit/elasticsearch-dump:latestc967fe68b9c7
ip-address@6.1.0
10.5.1
2
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
ip-address@9.0.5
10.5.1
2
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
ip-address@10.5.0
10.5.1
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
ip-address@9.0.5
10.5.1
2

syft 1.42.1 · advisories as of 29 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.