StackRadar

CVE-2026-17495

Medium

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.004
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
237
of 17,957 indexed, latest versions
Container images
229
deployed by those charts
Fix available
1 of 1
affected package

moment vulnerable to Path Traversal via crafted non-string locale name

Carried by container images the latest versions of 237 of 17,957 indexed charts deploy, on 229 images.

Affected packageAffected versionsFixed inImages
momentnpm2.29.2, 2.29.3, 2.29.4, 2.30.12.31.0229
OSV records
GHSA-4p3w-j4w9-5jqw

Charts affected

237 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.421 of 1See more

n8n community-charts 1.24.42

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
n8nio/n8n:2.40.59f693fd55655
moment@2.30.1
2.31.0

Open the chart page →

1,076
jupyterhubjupyterhubOfficialVerified publisher4.4.22 of 7See more

jupyterhub jupyterhub 4.4.2

2 of the 7 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
moment@2.30.1
2.31.0
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
moment@2.29.4
2.31.0

Open the chart page →

8,785
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
moment@2.30.1
2.31.0

Open the chart page →

1,441
opensearch-dashboardsopensearch-project-helm-chartsVerified publisher3.9.01 of 1See more

opensearch-dashboards opensearch-project-helm-charts 3.9.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
moment@2.29.4
2.31.0

Open the chart page →

110
node-rednode-redVerified publisher0.40.21 of 1See more

node-red node-red 0.40.2

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
nodered/node-red:4.1.2216e7403aab9
moment@2.30.1
2.31.0

Open the chart page →

2,379
mongo-expresscowboysysopVerified publisher7.0.01 of 1See more

mongo-express cowboysysop 7.0.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
library/mongo-express:1.0.21b23d7976f02
moment@2.29.4
2.31.0

Open the chart page →

1,312
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
moment@2.29.4
2.31.0

Open the chart page →

12,133
oneuptimeoneuptimeOfficialVerified publisher14.0.93 of 7See more

oneuptime oneuptime 14.0.9

3 of the 7 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
oneuptime/nginx:release906acce7e252
moment@2.30.1
2.31.0
oneuptime/probe:release2a170032aee8
moment@2.30.1
2.31.0
oneuptime/runner:release86060743a718
moment@2.30.1
2.31.0

Open the chart page →

8,770
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
moment@2.29.4
2.31.0

Open the chart page →

5,826
outlineoutline0.0.91 of 4See more

outline outline 0.0.9

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
moment@2.29.4
2.31.0

Open the chart page →

4,640
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
moment@2.30.1
2.31.0

Open the chart page →

3,321
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
budibase/apps:3.41.344fe6feab985
moment@2.30.1
2.31.0

Open the chart page →

11,186
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
moment@2.30.1
2.31.0

Open the chart page →

6,067
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
moment@2.30.1
2.31.0

Open the chart page →

3,434
n8nhelmforgeVerified publisher2.1.22 of 2See more

n8n helmforge 2.1.2

2 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
n8nio/n8n:2.41.3fdce8f852ac7
moment@2.30.1
2.31.0
n8nio/runners:2.41.31522f8179b76
moment@2.30.1
2.31.0

Open the chart page →

1,114
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
moment@2.30.1
2.31.0

Open the chart page →

31,338
umamiwaldo-visionVerified publisher0.0.11 of 1See more

umami waldo-vision 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
moment@2.29.4
2.31.0

Open the chart page →

1,312
redisinsightheywood8-helm-chartsVerified publisher0.4.51 of 1See more

redisinsight heywood8-helm-charts 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
heywood8/redisinsight:2.28.00bc9ab313d37
moment@2.29.4
2.31.0

Open the chart page →

2,992
servarrservarr1.0.21 of 10See more

servarr servarr 1.0.2

1 of the 10 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
moment@2.29.4
2.31.0

Open the chart page →

14,384
snyk-monitorsnyk2.23.261 of 2See more

snyk-monitor snyk 2.23.26

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
snyk/kubernetes-monitor:2.23.26fb5ad76ce84e
moment@2.30.1
2.31.0

Open the chart page →

704
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
moment@2.29.4
2.31.0

Open the chart page →

6,599
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
baserow/web-frontend:2.3.3566d24c7d9f5
moment@2.30.1
2.31.0

Open the chart page →

18,749
daskhubdask2024.1.12 of 9See more

daskhub dask 2024.1.1

2 of the 9 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
moment@2.29.4
2.31.0
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
moment@2.29.4
2.31.0

Open the chart page →

14,861
heimdallheimdallOfficialVerified publisher3.3.31 of 2See more

heimdall heimdall 3.3.3

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
mitre/heimdall2:release-latest06f6e72d416a
moment@2.30.1
2.31.0

Open the chart page →

2,154
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
kubeflownotebookswg/centraldashboard:v1.6.137300551dea6
moment@2.29.2
2.31.0

Open the chart page →

166,582
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
moment@2.29.4
2.31.0

Open the chart page →

11,206
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
moment@2.30.1
2.31.0

Open the chart page →

3,061
ghostcloudpirates-ghostVerified publisher0.20.261 of 3See more

ghost cloudpirates-ghost 0.20.26

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
library/ghost:6.64.0586821cfebac
moment@2.30.1
2.31.0

Open the chart page →

7,632
codetogethercodetogether1.4.251 of 1See more

codetogether codetogether 1.4.25

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
codetogether/codetogether:latest4348c8a38752
moment@2.29.4
2.31.0

Open the chart page →

7,779
convertigoconvertigoOfficialVerified publisher8.4.51 of 5See more

convertigo convertigo 8.4.5

1 of the 5 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
moment@2.29.4
2.31.0

Open the chart page →

15,947
defectdojodefectdojo1.9.541 of 4See more

defectdojo defectdojo 1.9.54

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
defectdojo/defectdojo-nginx:3.3.3002804d871ed73
moment@2.30.1
2.31.0

Open the chart page →

2,018
nightscoutgabe565Verified publisher0.13.01 of 2See more

nightscout gabe565 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
moment@2.29.4
2.31.0

Open the chart page →

2,640
audiobookshelfgeek-cookbookVerified publisher1.2.21 of 1See more

audiobookshelf geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.0.3140aed2752c3
moment@2.29.2
2.31.0

Open the chart page →

2,025
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:main06adb21bfdfc
moment@2.30.1
2.31.0

Open the chart page →

1,739
kubeviouskubevious1.2.24 of 7See more

kubevious kubevious 1.2.2

4 of the 7 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
kubevious/backend:1.2.22d9ba6eb46b6
moment@2.29.4
2.31.0
kubevious/collector:1.2.1f58226f9d84e
moment@2.29.4
2.31.0
kubevious/guard:1.2.19bf567704de2
moment@2.29.4
2.31.0
kubevious/parser:1.2.299ae7a5168c2
moment@2.29.4
2.31.0

Open the chart page →

14,670
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
moment@2.29.4
2.31.0

Open the chart page →

8,102
overseerrpree-helm-chartsVerified publisher1.2.01 of 1See more

overseerr pree-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.35.06197516c9d7b
moment@2.29.4
2.31.0

Open the chart page →

2,915
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
moment@2.30.1
2.31.0

Open the chart page →

1,242
thingsboard-clusterthingsboard-cluster-bettaVerified publisher0.2.261 of 6See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

1 of the 6 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
thingsboard/tb-web-ui:3.6.0d388378062cc
moment@2.29.3
2.31.0

Open the chart page →

15,137
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
moment@2.30.1
2.31.0

Open the chart page →

4,582
predatorzooz1.7.01 of 1See more

predator zooz 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
zooz/predator:1.6f491d1f7a865
moment@2.29.2
2.31.0

Open the chart page →

3,004
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
moment@2.30.1
2.31.0

Open the chart page →

2,303
opensearch-dashboardscaptnbpVerified publisher2.2.11 of 1See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
moment@2.29.4
2.31.0

Open the chart page →

1,977
node-redcharts-derwitt-devVerified publisher2.1.21 of 1See more

node-red charts-derwitt-dev 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
nodered/node-red:5.0.7a649dd711d55
moment@2.30.1
2.31.0

Open the chart page →

245
squestchristianhuthVerified publisher6.6.81 of 4See more

squest christianhuth 6.6.8

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
moment@2.29.4
2.31.0

Open the chart page →

10,858
data-fairdata354-helmVerified publisher1.1.23 of 12See more

data-fair data354-helm 1.1.2

3 of the 12 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
moment@2.29.4
2.31.0
ghcr.io/data-fair/notify:3c739b74dabb0
moment@2.30.1
2.31.0
ghcr.io/data-fair/processings:15a9216989707
moment@2.29.4
2.31.0

Open the chart page →

40,129
joplin-serverdjjudas21Verified publisher6.0.01 of 1See more

joplin-server djjudas21 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
joplin/server:3.7.23f7b852959aa
moment@2.30.1
2.31.0

Open the chart page →

2,858
rstudiodsri-helm-charts0.1.281 of 1See more

rstudio dsri-helm-charts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
moment@2.30.1
2.31.0

Open the chart page →

75,874
enbuildenbuildVerified publisher0.0.501 of 6See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
moment@2.30.1
2.31.0

Open the chart page →

33,660
ethereumjsethereum-helm-chartsVerified publisher0.1.21 of 2See more

ethereumjs ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ethpandaops/ethereumjs:masterfb84b718500f
moment@2.30.1
2.31.0

Open the chart page →

1,728

Container images carrying it

229 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
moment@2.29.4
2.31.0
1
fiware/idm:8.3.3a1b6ed4ae84f
moment@2.29.4
2.31.0
1
fiware/iotagent-json:3.1.0879b21a0d36d
moment@2.29.4
2.31.0
1
fosrl/pangolin:latest00cfb631097a
moment@2.30.1
2.31.0
1
fosrl/pangolin:1.13.0c32ad797ab96
moment@2.30.1
2.31.0
1
getwud/wud:8.1.1b1cd01c43839
moment@2.30.1
2.31.0
1
glenndehaan/contentbridge:latest99b9e4f73848
moment@2.29.4
2.31.0
1
growthbook/growthbook:5.1.0c8a124f55dca
moment@2.29.4
2.31.0
1
growthbook/growthbook:latestcbf1bc59e9a9
moment@2.29.4
2.31.0
1
heywood8/redisinsight:2.28.00bc9ab313d37
moment@2.29.4
2.31.0
1
hugohg34/server:0.0.2503e5d8960ff
moment@2.29.2
2.31.0
1
ianw/quickchart:v1.7.1dc49dd460c37
moment@2.29.4
2.31.0
1
infisical/infisical:latest:v0.165.602082bf13163
moment@2.30.1
2.31.0
1
infisical/infisical:latest3365445909be
moment@2.30.1
2.31.0
1
joplin/server:3.0-beta52af57880c0e
moment@2.30.1
2.31.0
1
jupyterhub/jupyterhub:5.4.63974ba945e65
moment@2.30.1
2.31.0
1
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
moment@2.29.4
2.31.0
1
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
moment@2.29.4
2.31.0
1
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
moment@2.30.1
2.31.0
1
kubebb/bff-server:v0.2.0-202312040fbb732379bc
moment@2.29.4
2.31.0
1
kubebb/component-store:latestfd8ecbd73213
moment@2.29.4
2.31.0
1
kubeflownotebookswg/centraldashboard:v1.6.137300551dea6
moment@2.29.2
2.31.0
1
kubeflownotebookswg/centraldashboard:v1.9.2af55c22ef5de
moment@2.29.4
2.31.0
1
kubevious/backend:1.2.22d9ba6eb46b6
moment@2.29.4
2.31.0
1
kubevious/collector:1.2.1f58226f9d84e
moment@2.29.4
2.31.0
1
kubevious/guard:1.2.19bf567704de2
moment@2.29.4
2.31.0
1
kubevious/parser:1.0.151acf1a1f0b47
moment@2.29.4
2.31.0
1
kubevious/parser:1.2.299ae7a5168c2
moment@2.29.4
2.31.0
1
kubevious/workload-operator:1.0.20b0f4c507eb6
moment@2.29.4
2.31.0
1
kyso/kyso-front:lateste52595c5c16f
moment@2.29.4
2.31.0
1
library/ghost:6.37.01ef2e532ca4d
moment@2.30.1
2.31.0
1
library/ghost:6.25.12654b1e90413
moment@2.29.4
2.31.0
1
library/ghost:6.41.129773d6be407
moment@2.30.1
2.31.0
1
library/ghost:6.64.0586821cfebac
moment@2.30.1
2.31.0
1
library/ghost:6.39.0-alpine77196da4b0df
moment@2.30.1
2.31.0
1
library/ghost:6.65.0-alpine3.23fea3264f902e
moment@2.30.1
2.31.0
1
library/kibana:7.17.150172f1c538e7
moment@2.29.4
2.31.0
1
library/kibana:8.19.2235544f1ff28a
moment@2.30.1
2.31.0
1
library/kibana:7.17.8c5781ba340ef
moment@2.29.4
2.31.0
1
library/kibana:7.17.3e2e2031c15be
moment@2.29.2
2.31.0
1
library/mongo-express:1.0.2-20-alpine3.191aae00775251
moment@2.29.4
2.31.0
1
linuxserver/grocy:4.0.1f8f5f96b6ea8
moment@2.29.4
2.31.0
1
linuxserver/overseerr:1.35.06108ed066d4a
moment@2.29.4
2.31.0
1
luligu/matterbridge:3.0.28f97884bebc2
moment@2.30.1
2.31.0
1
makeplane/live-commercial:v3.3.0488a6684637c
moment@2.30.1
2.31.0
1
makeplane/silo-commercial:v3.3.027bf6bbf59bd
moment@2.30.1
2.31.0
1
makeplane/space-commercial:v3.3.03dba6a659fb9
moment@2.30.1
2.31.0
1
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
moment@2.29.4
2.31.0
1
mautic/mautic:7-apacheeb8cc73d97e1
moment@2.30.1
2.31.0
1
mitre/heimdall2:release-latest06f6e72d416a
moment@2.30.1
2.31.0
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.