StackRadar

CVE-2026-102414

Low

Advisory

Published 6 Oct 2026In the index since 7 Oct 2026
Severity
Low
worst across findings
CVSS
3.7
base score, highest
EPSS
0.003
20th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
82
of 18,176 indexed, latest versions
Container images
73
deployed by those charts
Fix available
1 of 1
affected package

pbkdf2 rehashes long passwords on every iteration, enabling denial of service

Carried by container images the latest versions of 82 of 18,176 indexed charts deploy, on 73 images.

Affected packageAffected versionsFixed inImages
pbkdf2npm3.0.14, 3.0.16, 3.0.17, 3.1.1+3 more3.1.773
OSV records
GHSA-477h-4r7f-fvrx

Charts affected

82 by stars
ChartLatestAffected imagesRadar Score
sorry-cypresssorry-cypressVerified publisher1.20.01 of 4See more

sorry-cypress sorry-cypress 1.20.0

1 of the 4 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
agoldis/sorry-cypress-director:2.5.1110228ecd353b
pbkdf2@3.1.1
3.1.7

Open the chart page →

4,488
penpotcodechemVerified publisher1.0.101 of 3See more

penpot codechem 1.0.10

1 of the 3 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
penpotapp/exporter:1.16.0-betafa7086ad92b1
pbkdf2@3.1.2
3.1.7

Open the chart page →

31,328
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
microcks/microcks-postman-runtime:latestcb72e46a1b3c
pbkdf2@3.0.17
3.1.7

Open the chart page →

10,831
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
pbkdf2@3.1.1
3.1.7

Open the chart page →

5,619
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
pbkdf2@3.1.2
3.1.7

Open the chart page →

3,260
open5gsopen5gsVerified publisher2.3.81 of 5See more

open5gs open5gs 2.3.8

1 of the 5 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
pbkdf2@3.0.16
3.1.7

Open the chart page →

13,000
codetogethercodetogether1.4.251 of 1See more

codetogether codetogether 1.4.25

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
codetogether/codetogether:latest4348c8a38752
pbkdf2@3.1.2
3.1.7

Open the chart page →

8,067
convertigoconvertigoOfficialVerified publisher8.4.61 of 5See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
pbkdf2@3.1.2
3.1.7

Open the chart page →

17,602
nightscoutgabe565Verified publisher0.13.01 of 2See more

nightscout gabe565 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
pbkdf2@3.1.2
3.1.7

Open the chart page →

2,752
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
pbkdf2@3.1.2
3.1.7

Open the chart page →

9,383
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
pbkdf2@3.0.17
3.1.7

Open the chart page →

8,113
data-fairdata354-helmVerified publisher1.1.22 of 12See more

data-fair data354-helm 1.1.2

2 of the 12 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ghcr.io/data-fair/metrics:0a8d40779eeae
pbkdf2@3.1.2
3.1.7
ghcr.io/data-fair/simple-directory:438a4f32fad82
pbkdf2@3.1.2
3.1.7

Open the chart page →

42,993
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
pbkdf2@3.1.1
3.1.7

Open the chart page →

5,743
api-umbrellafiware0.2.01 of 1See more

api-umbrella fiware 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
fiware/api-umbrella:0.18.06e5159d29c3c
pbkdf2@3.0.17
3.1.7

Open the chart page →

78,122
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
pbkdf2@3.1.1
3.1.7

Open the chart page →

3,603
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
pbkdf2@3.1.2
3.1.7

Open the chart page →

8,718
dashykrzwiatrzyk1.0.01 of 1See more

dashy krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
pbkdf2@3.1.2
3.1.7

Open the chart page →

3,345
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
pbkdf2@3.1.2
3.1.7

Open the chart page →

6,138
pixapopnicholaswildeVerified publisher1.0.01 of 1See more

pixapop nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/pixapop:v1.2-ls15605ebc091fa1
pbkdf2@3.0.17
3.1.7

Open the chart page →

3,581
open5gs-webuiopen5gs-webuiVerified publisher2.3.31 of 2See more

open5gs-webui open5gs-webui 2.3.3

1 of the 2 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
pbkdf2@3.0.16
3.1.7

Open the chart page →

7,183
openccuopenccuVerified publisher3.89.111 of 1See more

openccu openccu 3.89.11

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ghcr.io/openccu/openccu:3.89.11.202609193cfcb30e1921
pbkdf2@3.1.6
3.1.7

Open the chart page →

1,943
testhubteshubVerified publisher0.1.41 of 3See more

testhub teshub 0.1.4

1 of the 3 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
testhubio/testhub-frontend:on-preme86c2db53be8
pbkdf2@3.0.17
3.1.7

Open the chart page →

8,747
open5gsadaptivenetlabVerified publisher1.0.31 of 3See more

open5gs adaptivenetlab 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
pbkdf2@3.0.16
3.1.7

Open the chart page →

103,650
angular-chartangular-application0.1.01 of 1See more

angular-chart angular-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ibarreche/cloud-front-ci:latestc8970ac1c8dc
pbkdf2@3.1.2
3.1.7

Open the chart page →

3,492
angular-node-chartangular-webapp2.0.01 of 1See more

angular-node-chart angular-webapp 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
rakii8585/angular-node-webapp:latest026082a515ac
pbkdf2@3.0.17
3.1.7

Open the chart page →

3,307
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
pbkdf2@3.1.2
3.1.7

Open the chart page →

5,409
daskcloudnativeapp2.2.11 of 2See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
daskdev/dask-notebook:1.1.0052630f5ca04
pbkdf2@3.0.17
3.1.7

Open the chart page →

31,709
developer-dashboardcloud-native-toolkit1.4.11 of 1See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
pbkdf2@3.0.17
3.1.7

Open the chart page →

26,762
conduction-uiconduction-ui0.1.01 of 6See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
conduction/conduction-ui-app:devd591f5e6f2a9
pbkdf2@3.1.1
3.1.7

Open the chart page →

15,703
amundsenduyet1.1.01 of 7See more

amundsen duyet 1.1.0

1 of the 7 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
amundsendev/amundsen-frontend:2.1.169e7915e61c1
pbkdf2@3.0.17
3.1.7

Open the chart page →

12,971
frontend-charteks-3-tier-app-chart0.1.01 of 1See more

frontend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
arfath29/3-tier-app-frontend:latest384b3e377f47
pbkdf2@3.1.2
3.1.7

Open the chart page →

4,289
testnet-faucetethereum-helm-chartsVerified publisher0.1.31 of 1See more

testnet-faucet ethereum-helm-charts 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
parithoshj/testnet-faucet:9859e0dcdca426fea6d
pbkdf2@3.0.17
3.1.7

Open the chart page →

3,117
bee-localchainethersphereVerified publisher0.2.01 of 1See more

bee-localchain ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
pbkdf2@3.1.2
3.1.7

Open the chart page →

2,507
bzz-token-serviceethersphereVerified publisher0.2.01 of 1See more

bzz-token-service ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ethersphere/bzz-token-service:latest7624f11a72ad
pbkdf2@3.1.2
3.1.7

Open the chart page →

3,863
geth-swapethersphereVerified publisher0.6.31 of 2See more

geth-swap ethersphere 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
pbkdf2@3.1.2
3.1.7

Open the chart page →

6,068
onboarding-faucetethersphereVerified publisher0.2.01 of 1See more

onboarding-faucet ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ethersphere/onboarding-faucet:0.3.0513154aab230
pbkdf2@3.1.2
3.1.7

Open the chart page →

4,320
wekan-oldgabisonfire0.1.21 of 1See more

wekan-old gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
wekanteam/wekan:v4.2268a51f0327df
pbkdf2@3.0.16
3.1.7

Open the chart page →

6,323
rtlgaloymoney0.4.31 of 2See more

rtl galoymoney 0.4.3

1 of the 2 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
shahanafarooqui/rtl:0.13.3e2195188a451
pbkdf2@3.1.2
3.1.7

Open the chart page →

2,184
rtlgaloymoney20.4.31 of 2See more

rtl galoymoney2 0.4.3

1 of the 2 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
shahanafarooqui/rtl:0.13.3e2195188a451
pbkdf2@3.1.2
3.1.7

Open the chart page →

2,184
nightscoutgeek-cookbookVerified publisher1.2.21 of 1See more

nightscout geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
pbkdf2@3.1.1
3.1.7

Open the chart page →

4,238
ibm-app-navigatoribm-charts1.0.11 of 5See more

ibm-app-navigator ibm-charts 1.0.1

1 of the 5 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ibmcom/app-nav-ui:1.0.1e2a86997b36b
pbkdf2@3.0.17
3.1.7

Open the chart page →

33,559
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
pbkdf2@3.1.1
3.1.7

Open the chart page →

5,951
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
pbkdf2@3.1.2
3.1.7

Open the chart page →

6,914
cdashkitwareVerified publisher0.20.01 of 3See more

cdash kitware 0.20.0

1 of the 3 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
kitware/cdash:v5.4.0da5abe941506
pbkdf2@3.1.3
3.1.7

Open the chart page →

13,717
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
pbkdf2@3.1.2
3.1.7

Open the chart page →

6,736
penpotkubitodevVerified publisher1.2.11 of 5See more

penpot kubitodev 1.2.1

1 of the 5 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
penpotapp/exporter:2.2.15c835ffd87ab
pbkdf2@3.1.2
3.1.7

Open the chart page →

19,855
opendistro-eslsst-sqre1.4.11 of 3See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
pbkdf2@3.0.14
3.1.7

Open the chart page →

8,164
squareonelsst-sqre0.4.11 of 1See more

squareone lsst-sqre 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
lsstsqre/squareone:0.4.09ded78e7fe03
pbkdf2@3.1.2
3.1.7

Open the chart page →

2,318
frontendluiscajl0.1.71 of 1See more

frontend luiscajl 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
lavandadelpatio/frontend:latest501c3f31e0bc
pbkdf2@3.0.17
3.1.7

Open the chart page →

3,774
kubevismario-fVerified publisher2.0.11 of 1See more

kubevis mario-f 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-102414.

Container imageDigestPackageFixed in
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
pbkdf2@3.1.2
3.1.7

Open the chart page →

6,491

Container images carrying it

73 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
rakii8585/angular-node-webapp:latest026082a515ac
pbkdf2@3.0.17
3.1.7
1
samajh/alprfrontend:latest05ef4fddbb75
pbkdf2@3.1.2
3.1.7
1
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
pbkdf2@3.1.2
3.1.7
1
testhubio/testhub-frontend:on-preme86c2db53be8
pbkdf2@3.0.17
3.1.7
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
pbkdf2@3.1.2
3.1.7
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
pbkdf2@3.1.2
3.1.7
1
wekanteam/wekan:v4.2268a51f0327df
pbkdf2@3.0.16
3.1.7
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
pbkdf2@3.1.2
3.1.7
1
ghcr.io/data-fair/metrics:0a8d40779eeae
pbkdf2@3.1.2
3.1.7
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
pbkdf2@3.1.2
3.1.7
1
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
pbkdf2@3.1.3
3.1.7
1
ghcr.io/linuxserver/pixapop:v1.2-ls15605ebc091fa1
pbkdf2@3.0.17
3.1.7
1
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
pbkdf2@3.1.2
3.1.7
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
pbkdf2@3.1.1
3.1.7
1
ghcr.io/openccu/openccu:3.89.11.202609193cfcb30e1921
pbkdf2@3.1.6
3.1.7
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
pbkdf2@3.1.1
3.1.7
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
pbkdf2@3.1.1
3.1.7
1
ghcr.io/vincenttaglia/indexer-tools:v3.4.45bae30456ddb
pbkdf2@3.1.2
3.1.7
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
pbkdf2@3.1.2
3.1.7
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
pbkdf2@3.0.17
3.1.7
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
pbkdf2@3.1.1
3.1.7
1
quay.io/wekan/wekan:v5.65cb17600883a3
pbkdf2@3.1.2
3.1.7
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
pbkdf2@3.0.16
3.1.7
1

syft 1.42.1 · advisories as of 18 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.