StackRadar

CVE-2026-17495

Medium

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.004
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
237
of 17,957 indexed, latest versions
Container images
229
deployed by those charts
Fix available
1 of 1
affected package

moment vulnerable to Path Traversal via crafted non-string locale name

Carried by container images the latest versions of 237 of 17,957 indexed charts deploy, on 229 images.

Affected packageAffected versionsFixed inImages
momentnpm2.29.2, 2.29.3, 2.29.4, 2.30.12.31.0229
OSV records
GHSA-4p3w-j4w9-5jqw

Charts affected

237 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.421 of 1See more

n8n community-charts 1.24.42

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
n8nio/n8n:2.40.59f693fd55655
moment@2.30.1
2.31.0

Open the chart page →

1,076
jupyterhubjupyterhubOfficialVerified publisher4.4.22 of 7See more

jupyterhub jupyterhub 4.4.2

2 of the 7 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
moment@2.30.1
2.31.0
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
moment@2.29.4
2.31.0

Open the chart page →

8,785
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
moment@2.30.1
2.31.0

Open the chart page →

1,441
opensearch-dashboardsopensearch-project-helm-chartsVerified publisher3.9.01 of 1See more

opensearch-dashboards opensearch-project-helm-charts 3.9.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
moment@2.29.4
2.31.0

Open the chart page →

110
node-rednode-redVerified publisher0.40.21 of 1See more

node-red node-red 0.40.2

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
nodered/node-red:4.1.2216e7403aab9
moment@2.30.1
2.31.0

Open the chart page →

2,379
mongo-expresscowboysysopVerified publisher7.0.01 of 1See more

mongo-express cowboysysop 7.0.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
library/mongo-express:1.0.21b23d7976f02
moment@2.29.4
2.31.0

Open the chart page →

1,312
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
moment@2.29.4
2.31.0

Open the chart page →

12,133
oneuptimeoneuptimeOfficialVerified publisher14.0.93 of 7See more

oneuptime oneuptime 14.0.9

3 of the 7 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
oneuptime/nginx:release906acce7e252
moment@2.30.1
2.31.0
oneuptime/probe:release2a170032aee8
moment@2.30.1
2.31.0
oneuptime/runner:release86060743a718
moment@2.30.1
2.31.0

Open the chart page →

8,770
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
moment@2.29.4
2.31.0

Open the chart page →

5,826
outlineoutline0.0.91 of 4See more

outline outline 0.0.9

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
moment@2.29.4
2.31.0

Open the chart page →

4,640
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
moment@2.30.1
2.31.0

Open the chart page →

3,321
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
budibase/apps:3.41.344fe6feab985
moment@2.30.1
2.31.0

Open the chart page →

11,186
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
moment@2.30.1
2.31.0

Open the chart page →

6,067
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
moment@2.30.1
2.31.0

Open the chart page →

3,434
n8nhelmforgeVerified publisher2.1.22 of 2See more

n8n helmforge 2.1.2

2 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
n8nio/n8n:2.41.3fdce8f852ac7
moment@2.30.1
2.31.0
n8nio/runners:2.41.31522f8179b76
moment@2.30.1
2.31.0

Open the chart page →

1,114
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
moment@2.30.1
2.31.0

Open the chart page →

31,338
umamiwaldo-visionVerified publisher0.0.11 of 1See more

umami waldo-vision 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
moment@2.29.4
2.31.0

Open the chart page →

1,312
redisinsightheywood8-helm-chartsVerified publisher0.4.51 of 1See more

redisinsight heywood8-helm-charts 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
heywood8/redisinsight:2.28.00bc9ab313d37
moment@2.29.4
2.31.0

Open the chart page →

2,992
servarrservarr1.0.21 of 10See more

servarr servarr 1.0.2

1 of the 10 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
moment@2.29.4
2.31.0

Open the chart page →

14,384
snyk-monitorsnyk2.23.261 of 2See more

snyk-monitor snyk 2.23.26

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
snyk/kubernetes-monitor:2.23.26fb5ad76ce84e
moment@2.30.1
2.31.0

Open the chart page →

704
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
moment@2.29.4
2.31.0

Open the chart page →

6,599
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
baserow/web-frontend:2.3.3566d24c7d9f5
moment@2.30.1
2.31.0

Open the chart page →

18,749
daskhubdask2024.1.12 of 9See more

daskhub dask 2024.1.1

2 of the 9 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
moment@2.29.4
2.31.0
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
moment@2.29.4
2.31.0

Open the chart page →

14,861
heimdallheimdallOfficialVerified publisher3.3.31 of 2See more

heimdall heimdall 3.3.3

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
mitre/heimdall2:release-latest06f6e72d416a
moment@2.30.1
2.31.0

Open the chart page →

2,154
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
kubeflownotebookswg/centraldashboard:v1.6.137300551dea6
moment@2.29.2
2.31.0

Open the chart page →

166,582
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
moment@2.29.4
2.31.0

Open the chart page →

11,206
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
moment@2.30.1
2.31.0

Open the chart page →

3,061
ghostcloudpirates-ghostVerified publisher0.20.261 of 3See more

ghost cloudpirates-ghost 0.20.26

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
library/ghost:6.64.0586821cfebac
moment@2.30.1
2.31.0

Open the chart page →

7,632
codetogethercodetogether1.4.251 of 1See more

codetogether codetogether 1.4.25

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
codetogether/codetogether:latest4348c8a38752
moment@2.29.4
2.31.0

Open the chart page →

7,779
convertigoconvertigoOfficialVerified publisher8.4.51 of 5See more

convertigo convertigo 8.4.5

1 of the 5 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
moment@2.29.4
2.31.0

Open the chart page →

15,947
defectdojodefectdojo1.9.541 of 4See more

defectdojo defectdojo 1.9.54

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
defectdojo/defectdojo-nginx:3.3.3002804d871ed73
moment@2.30.1
2.31.0

Open the chart page →

2,018
nightscoutgabe565Verified publisher0.13.01 of 2See more

nightscout gabe565 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
moment@2.29.4
2.31.0

Open the chart page →

2,640
audiobookshelfgeek-cookbookVerified publisher1.2.21 of 1See more

audiobookshelf geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.0.3140aed2752c3
moment@2.29.2
2.31.0

Open the chart page →

2,025
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:main06adb21bfdfc
moment@2.30.1
2.31.0

Open the chart page →

1,739
kubeviouskubevious1.2.24 of 7See more

kubevious kubevious 1.2.2

4 of the 7 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
kubevious/backend:1.2.22d9ba6eb46b6
moment@2.29.4
2.31.0
kubevious/collector:1.2.1f58226f9d84e
moment@2.29.4
2.31.0
kubevious/guard:1.2.19bf567704de2
moment@2.29.4
2.31.0
kubevious/parser:1.2.299ae7a5168c2
moment@2.29.4
2.31.0

Open the chart page →

14,670
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
moment@2.29.4
2.31.0

Open the chart page →

8,102
overseerrpree-helm-chartsVerified publisher1.2.01 of 1See more

overseerr pree-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.35.06197516c9d7b
moment@2.29.4
2.31.0

Open the chart page →

2,915
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
moment@2.30.1
2.31.0

Open the chart page →

1,242
thingsboard-clusterthingsboard-cluster-bettaVerified publisher0.2.261 of 6See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

1 of the 6 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
thingsboard/tb-web-ui:3.6.0d388378062cc
moment@2.29.3
2.31.0

Open the chart page →

15,137
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
moment@2.30.1
2.31.0

Open the chart page →

4,582
predatorzooz1.7.01 of 1See more

predator zooz 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
zooz/predator:1.6f491d1f7a865
moment@2.29.2
2.31.0

Open the chart page →

3,004
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
moment@2.30.1
2.31.0

Open the chart page →

2,303
opensearch-dashboardscaptnbpVerified publisher2.2.11 of 1See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
moment@2.29.4
2.31.0

Open the chart page →

1,977
node-redcharts-derwitt-devVerified publisher2.1.21 of 1See more

node-red charts-derwitt-dev 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
nodered/node-red:5.0.7a649dd711d55
moment@2.30.1
2.31.0

Open the chart page →

245
squestchristianhuthVerified publisher6.6.81 of 4See more

squest christianhuth 6.6.8

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
moment@2.29.4
2.31.0

Open the chart page →

10,858
data-fairdata354-helmVerified publisher1.1.23 of 12See more

data-fair data354-helm 1.1.2

3 of the 12 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
moment@2.29.4
2.31.0
ghcr.io/data-fair/notify:3c739b74dabb0
moment@2.30.1
2.31.0
ghcr.io/data-fair/processings:15a9216989707
moment@2.29.4
2.31.0

Open the chart page →

40,129
joplin-serverdjjudas21Verified publisher6.0.01 of 1See more

joplin-server djjudas21 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
joplin/server:3.7.23f7b852959aa
moment@2.30.1
2.31.0

Open the chart page →

2,858
rstudiodsri-helm-charts0.1.281 of 1See more

rstudio dsri-helm-charts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
moment@2.30.1
2.31.0

Open the chart page →

75,874
enbuildenbuildVerified publisher0.0.501 of 6See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
moment@2.30.1
2.31.0

Open the chart page →

33,660
ethereumjsethereum-helm-chartsVerified publisher0.1.21 of 2See more

ethereumjs ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ethpandaops/ethereumjs:masterfb84b718500f
moment@2.30.1
2.31.0

Open the chart page →

1,728

Container images carrying it

229 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
n8nio/n8n:2.25.7761374d4eb84
moment@2.30.1
2.31.0
1
n8nio/n8n:1.86.08b39ed5a2de9
moment@2.30.1
2.31.0
1
n8nio/n8n:2.40.59f693fd55655
moment@2.30.1
2.31.0
1
n8nio/n8n:0.212.0a9195bc499a3
moment@2.29.4
2.31.0
1
n8nio/n8n:2.36.8cfe2704ff858
moment@2.30.1
2.31.0
1
n8nio/n8n:1.33.1dd171d45102a
moment@2.30.1
2.31.0
1
n8nio/n8n:1.115.1ed16e560c40e
moment@2.30.1
2.31.0
1
n8nio/n8n:2.41.3fdce8f852ac7
moment@2.30.1
2.31.0
1
n8nio/runners:2.41.31522f8179b76
moment@2.30.1
2.31.0
1
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
moment@2.30.1
2.31.0
1
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
moment@2.29.4
2.31.0
1
nightscout/cgm-remote-monitor:15.0.3f604dc4c03ca
moment@2.29.4
2.31.0
1
nocodb/nocodb:latest4ccfc5114506
moment@2.30.1
2.31.0
1
nocodb/nocodb:0.301.5d9516f0bf546
moment@2.30.1
2.31.0
1
nodered/node-red:5.0.410f40d0a83e7
moment@2.30.1
2.31.0
1
nodered/node-red:4.1.2216e7403aab9
moment@2.30.1
2.31.0
1
nodered/node-red:4.1.10-minimald73ae167cb9b
moment@2.30.1
2.31.0
1
nodered/node-red:3.0.2-18e2632a7a35dd
moment@2.29.4
2.31.0
1
nshou/elasticsearch-kibana:kibana7a1d1e36814d1
moment@2.29.4
2.31.0
1
oneuptime/nginx:release906acce7e252
moment@2.30.1
2.31.0
1
oneuptime/probe:release2a170032aee8
moment@2.30.1
2.31.0
1
oneuptime/runner:release86060743a718
moment@2.30.1
2.31.0
1
openhab/openhab-cloud:a8138a329dd2bac8c4b
moment@2.29.4
2.31.0
1
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
moment@2.29.4
2.31.0
1
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
moment@2.29.4
2.31.0
1
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
moment@2.29.4
2.31.0
1
outlinewiki/outline:0.82.0494dfb9249a6
moment@2.29.4
2.31.0
1
outlinewiki/outline:1.10.1832051f039b4
moment@2.30.1
2.31.0
1
pangeo/base-notebook:2024.01.155fbe688a4f80
moment@2.29.4
2.31.0
1
phntom/codimd:2.4.31b9aafbb62e6
moment@2.29.4
2.31.0
1
polonel/trudesk:1.2.60cf6513f6fe3
moment@2.29.4
2.31.0
1
praecoapp/elastalert-server:202302195a0d8715e8b1
moment@2.29.4
2.31.0
1
praecoapp/praeco:1.8.1322be3218d7df
moment@2.29.4
2.31.0
1
pschiffe/pdns-admin:0.4.137ebba8c2b8f
moment@2.29.4
2.31.0
1
requarks/wiki:2af71a17dc27c
moment@2.30.1
2.31.0
1
samajh/alprbackend:latestea742b4372ad
moment@2.29.4
2.31.0
1
sigp/siren:v3.0.42c219b04758e
moment@2.30.1
2.31.0
1
snyk/kubernetes-monitor:2.23.26fb5ad76ce84e
moment@2.30.1
2.31.0
1
soulteary/cronicle:0.9.80ac2512fa6e39
moment@2.30.1
2.31.0
1
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
moment@2.29.4
2.31.0
1
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
moment@2.29.4
2.31.0
1
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
moment@2.29.4
2.31.0
1
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
moment@2.29.4
2.31.0
1
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
moment@2.29.4
2.31.0
1
speckle/speckle-server:2.26.379f14a2bf931
moment@2.29.4
2.31.0
1
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
moment@2.29.4
2.31.0
1
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
moment@2.29.4
2.31.0
1
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
moment@2.29.4
2.31.0
1
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
moment@2.29.4
2.31.0
1
th0th/node-red:4.0.3-debiand06fa39f7406
moment@2.30.1
2.31.0
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.