StackRadar

CVE-2026-17495

Medium

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.004
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
237
of 17,957 indexed, latest versions
Container images
229
deployed by those charts
Fix available
1 of 1
affected package

moment vulnerable to Path Traversal via crafted non-string locale name

Carried by container images the latest versions of 237 of 17,957 indexed charts deploy, on 229 images.

Affected packageAffected versionsFixed inImages
momentnpm2.29.2, 2.29.3, 2.29.4, 2.30.12.31.0229
OSV records
GHSA-4p3w-j4w9-5jqw

Charts affected

237 by stars
ChartLatestAffected imagesRadar Score
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
moment@2.30.1
2.31.0

Open the chart page →

12,024
homebridgegeek-cookbookVerified publisher5.3.21 of 1See more

homebridge geek-cookbook 5.3.2

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
moment@2.29.4
2.31.0

Open the chart page →

90,830
ghostgroundhog2k0.212.141 of 1See more

ghost groundhog2k 0.212.14

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
library/ghost:6.65.090592b712b6b
moment@2.30.1
2.31.0

Open the chart page →

2,282
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
moment@2.29.4
2.31.0

Open the chart page →

545
elasticinseefrlab2.2.01 of 2See more

elastic inseefrlab 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
library/kibana:7.17.3e2e2031c15be
moment@2.29.2
2.31.0

Open the chart page →

17,965
jupyterhub-outpostjupyter-jscVerified publisher2.4.11 of 1See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
moment@2.30.1
2.31.0

Open the chart page →

1,840
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
moment@2.30.1
2.31.0

Open the chart page →

5,605
chibisafel4gVerified publisher0.1.11 of 3See more

chibisafe l4g 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
chibisafe/chibisafe-server:latest3da4fcbc1a18
moment@2.30.1
2.31.0

Open the chart page →

5,379
plane-enterprisemakeplaneOfficialVerified publisher3.10.13 of 13See more

plane-enterprise makeplane 3.10.1

3 of the 13 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
makeplane/live-commercial:v3.3.0488a6684637c
moment@2.30.1
2.31.0
makeplane/silo-commercial:v3.3.027bf6bbf59bd
moment@2.30.1
2.31.0
makeplane/space-commercial:v3.3.03dba6a659fb9
moment@2.30.1
2.31.0

Open the chart page →

4,114
mend-renovate-enterprise-editionmend-renovateVerified publisher10.6.01 of 2See more

mend-renovate-enterprise-edition mend-renovate 10.6.0

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/mend/renovate-ee-server:15.6.087b77989f48d
moment@2.30.1
2.31.0

Open the chart page →

38,423
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
moment@2.30.1
2.31.0

Open the chart page →

3,070
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
growthbook/growthbook:latestcbf1bc59e9a9
moment@2.29.4
2.31.0

Open the chart page →

1,364
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
moment@2.30.1
2.31.0

Open the chart page →

7,918
kibanaromanow-helm-chartsVerified publisher1.7.11 of 1See more

kibana romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
library/kibana:7.17.8c5781ba340ef
moment@2.29.4
2.31.0

Open the chart page →

7,226
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
moment@2.30.1
2.31.0

Open the chart page →

3,207
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
speckle/speckle-server:2.26.379f14a2bf931
moment@2.29.4
2.31.0

Open the chart page →

11,459
switcher-apiswitcherapiOfficialVerified publisher1.3.52 of 3See more

switcher-api switcherapi 1.3.5

2 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
trackerforce/switcher-api:latest28ee0c4e0b88
moment@2.30.1
2.31.0
trackerforce/switcher-resolver-node:latest67e2c261f7b4
moment@2.30.1
2.31.0

Open the chart page →

888
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
moment@2.30.1
2.31.0

Open the chart page →

4,129
youtubedl-materialyoutubedl-materialVerified publisher0.0.11 of 1See more

youtubedl-material youtubedl-material 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:latest2f943d584711
moment@2.29.4
2.31.0

Open the chart page →

10,289
lhciadnoctemVerified publisher0.1.01 of 1See more

lhci adnoctem 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
moment@2.30.1
2.31.0

Open the chart page →

1,481
outlineadnoctemVerified publisher0.1.21 of 1See more

outline adnoctem 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
outlinewiki/outline:1.10.1832051f039b4
moment@2.30.1
2.31.0

Open the chart page →

1,678
cross-seedalekcVerified publisher7.19.01 of 1See more

cross-seed alekc 7.19.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/cross-seed/cross-seed:6.13.7a1fed512261f
moment@2.30.1
2.31.0

Open the chart page →

1,478
jellyseerralexmorbo-jellyseerrVerified publisher1.0.31 of 1See more

jellyseerr alexmorbo-jellyseerr 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:2.2.3a324fa4d81cc
moment@2.30.1
2.31.0

Open the chart page →

3,559
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
moment@2.29.4
2.31.0

Open the chart page →

3,567
platform-uiappscodeVerified publisher2026.9.111 of 1See more

platform-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/appscode/platform-ui:2.5.0c27cafe398c2
moment@2.30.1
2.31.0

Open the chart page →

660
audiobookshelfbdclark-helm-chartsVerified publisher0.1.41 of 1See more

audiobookshelf bdclark-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
moment@2.29.4
2.31.0

Open the chart page →

1,899
pangolinbdcode0.14.11 of 1See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
fosrl/pangolin:latest00cfb631097a
moment@2.30.1
2.31.0

Open the chart page →

2,084
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
moment@2.29.4
2.31.0

Open the chart page →

4,777
overseerrbrandan-schmitz-helm-chartsVerified publisher1.4.01 of 1See more

overseerr brandan-schmitz-helm-charts 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
linuxserver/overseerr:1.35.06108ed066d4a
moment@2.29.4
2.31.0

Open the chart page →

3,257
cross-seedcfi20176.13.61 of 1See more

cross-seed cfi2017 6.13.6

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/cross-seed/cross-seed:6.13.381afafdd96a5
moment@2.30.1
2.31.0

Open the chart page →

1,461
qbittorrentcfi20176.13.31 of 1See more

qbittorrent cfi2017 6.13.3

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/cross-seed/cross-seed:6.13.381afafdd96a5
moment@2.30.1
2.31.0

Open the chart page →

1,461
ghostchart-ghost0.1.61 of 2See more

ghost chart-ghost 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
library/ghost:6.65.0-alpine3.23fea3264f902e
moment@2.30.1
2.31.0

Open the chart page →

1,283
audiobookshelfcharts-derwitt-devVerified publisher1.1.21 of 1See more

audiobookshelf charts-derwitt-dev 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.37.06432d1dc5895
moment@2.29.4
2.31.0

Open the chart page →

1,403
audiobookshelfchristianhuthVerified publisher2.5.01 of 1See more

audiobookshelf christianhuth 2.5.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.37.06432d1dc5895
moment@2.29.4
2.31.0

Open the chart page →

1,403
countlychristianhuthVerified publisher5.3.22 of 3See more

countly christianhuth 5.3.2

2 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
countly/api:25.05.4f4cc7447c4f5
moment@2.30.1
2.31.0
countly/frontend:25.05.42acbc11499b6
moment@2.30.1
2.31.0

Open the chart page →

8,059
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
jupyterhub/jupyterhub:5.4.63974ba945e65
moment@2.30.1
2.31.0

Open the chart page →

14,240
cortezacorteza1.1.01 of 3See more

corteza corteza 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
cortezaproject/corteza-server-corredor:2024.9.44ea78dfe5364
moment@2.30.1
2.31.0

Open the chart page →

8,992
quickchartcowboysysopVerified publisher5.0.01 of 1See more

quickchart cowboysysop 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ianw/quickchart:v1.7.1dc49dd460c37
moment@2.29.4
2.31.0

Open the chart page →

5,590
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.4.11787550d2358
moment@2.29.4
2.31.0

Open the chart page →

14,511
jupyterhubd4nVerified publisher3.3.72 of 7See more

jupyterhub d4n 3.3.7

2 of the 7 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
moment@2.29.4
2.31.0
aristidetm/k8s-hub:3.3.7ccb516cb8474
moment@2.30.1
2.31.0

Open the chart page →

17,520
decisionrules-aksdecisionrules-aksVerified publisher0.2.01 of 2See more

decisionrules-aks decisionrules-aks 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
moment@2.30.1
2.31.0

Open the chart page →

436
decisionrules-eksdecisionrules-eksVerified publisher0.3.01 of 2See more

decisionrules-eks decisionrules-eks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
moment@2.30.1
2.31.0

Open the chart page →

436
decisionrules-ingressdecisionrules-ingressVerified publisher0.2.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
moment@2.30.1
2.31.0

Open the chart page →

436
decisionrules-ocpdecisionrules-ocpVerified publisher0.1.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
decisionrules/server:latest6a8f32aa11bc
moment@2.30.1
2.31.0

Open the chart page →

1,881
backend-servicedev-krishan-dhaka-charts1.0.31 of 1See more

backend-service dev-krishan-dhaka-charts 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
devkrishan001/backend:latestf1c3acadeabe
moment@2.30.1
2.31.0

Open the chart page →

1,366
devtron-enterprisedevtron48.0.01 of 28See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
moment@2.30.1
2.31.0

Open the chart page →

71,602
devtron-enterprisedevtron-labs48.0.01 of 28See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
moment@2.30.1
2.31.0

Open the chart page →

71,602
node-reddjdl-charts0.33.01 of 1See more

node-red djdl-charts 0.33.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
nodered/node-red:latesta649dd711d55
moment@2.30.1
2.31.0

Open the chart page →

245
node-redegebackVerified publisher2.0.131 of 1See more

node-red egeback 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
nodered/node-red:5.0.410f40d0a83e7
moment@2.30.1
2.31.0

Open the chart page →

1,185
azuriteemberstackVerified publisher1.0.211 of 1See more

azurite emberstack 1.0.21

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
moment@2.30.1
2.31.0

Open the chart page →

473

Container images carrying it

229 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
thingsboard/tb-js-executor:3.4.113e1eadf8ace
moment@2.29.3
2.31.0
1
thingsboard/tb-web-ui:3.4.157f98ed53b3d
moment@2.29.3
2.31.0
1
thingsboard/tb-web-ui:3.6.0d388378062cc
moment@2.29.3
2.31.0
1
trackerforce/switcher-api:latest28ee0c4e0b88
moment@2.30.1
2.31.0
1
trackerforce/switcher-resolver-node:latest67e2c261f7b4
moment@2.30.1
2.31.0
1
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
moment@2.30.1
2.31.0
1
twentycrm/twenty:latest:v2.41.047bcefe4e497
moment@2.30.1
2.31.0
1
twentycrm/twenty:v2.43.0b2b662b1bef1
moment@2.30.1
2.31.0
1
twentycrm/twenty:v2.22.0e7d9948bf284
moment@2.30.1
2.31.0
1
vcnngr/pnbackend:latesteaf44ad0ad1f
moment@2.30.1
2.31.0
1
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
moment@2.29.4
2.31.0
1
wazuh/wazuh-dashboard:4.4.11787550d2358
moment@2.29.4
2.31.0
1
wazuh/wazuh-dashboard:4.14.491c8d793746f
moment@2.29.4
2.31.0
1
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
moment@2.29.4
2.31.0
1
zooz/predator:1.6f491d1f7a865
moment@2.29.2
2.31.0
1
zwavejs/zwave-js-ui:11.22.314d018bb689e
moment@2.30.1
2.31.0
1
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
moment@2.30.1
2.31.0
1
ghcr.io/advplyr/audiobookshelf:2.0.3140aed2752c3
moment@2.29.2
2.31.0
1
ghcr.io/advplyr/audiobookshelf:2.32.1a52dc5db694a
moment@2.29.4
2.31.0
1
ghcr.io/akash-network/console-api:2.64.0ba359097329d
moment@2.30.1
2.31.0
1
ghcr.io/appscode/platform-ui:2.5.0c27cafe398c2
moment@2.30.1
2.31.0
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
moment@2.30.1
2.31.0
1
ghcr.io/cross-seed/cross-seed:6.13.7a1fed512261f
moment@2.30.1
2.31.0
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
moment@2.30.1
2.31.0
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
moment@2.30.1
2.31.0
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
moment@2.29.4
2.31.0
1
ghcr.io/data-fair/notify:3c739b74dabb0
moment@2.30.1
2.31.0
1
ghcr.io/data-fair/processings:15a9216989707
moment@2.29.4
2.31.0
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
moment@2.30.1
2.31.0
1
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
moment@2.30.1
2.31.0
1
ghcr.io/k10app/basicuserservice:latest2ee057ad3bef
moment@2.29.4
2.31.0
1
ghcr.io/krateoplatformops/api:1.0.3edbaa031754d
moment@2.29.3
2.31.0
1
ghcr.io/krateoplatformops/argocd-service:1.0.749b727854938
moment@2.29.4
2.31.0
1
ghcr.io/krateoplatformops/auth-service:1.2.36794bc5877f76
moment@2.29.4
2.31.0
1
ghcr.io/krateoplatformops/capi-service:1.1.92eee721260eb
moment@2.29.4
2.31.0
1
ghcr.io/krateoplatformops/codequality-service:1.1.19a9a77b01eb1
moment@2.29.3
2.31.0
1
ghcr.io/krateoplatformops/component-service:0.2.14a5f506c0560
moment@2.29.4
2.31.0
1
ghcr.io/krateoplatformops/deployment-service:1.2.59da9f93f2f731
moment@2.29.4
2.31.0
1
ghcr.io/krateoplatformops/endpoint-service:1.0.16c3777c042f7
moment@2.29.2
2.31.0
1
ghcr.io/krateoplatformops/event-service:1.1.671fd074020f4
moment@2.29.4
2.31.0
1
ghcr.io/krateoplatformops/git-service:1.0.13c22f183fedf0
moment@2.29.4
2.31.0
1
ghcr.io/krateoplatformops/keptn-service:1.0.12f9fef2435636
moment@2.29.3
2.31.0
1
ghcr.io/krateoplatformops/keptn-service-insiel:0.1.3c1d475bb7f06
moment@2.29.3
2.31.0
1
ghcr.io/krateoplatformops/kubernetes-service:1.1.1974fbc0d93ed
moment@2.29.3
2.31.0
1
ghcr.io/krateoplatformops/log-service:1.0.0b431a8154be0
moment@2.29.3
2.31.0
1
ghcr.io/krateoplatformops/notification-service:1.1.6f9eeac1d7e47
moment@2.29.4
2.31.0
1
ghcr.io/krateoplatformops/pipeline-service:1.1.25e6ad7395921
moment@2.29.3
2.31.0
1
ghcr.io/krateoplatformops/provider-service:1.0.8014ed41cb6e5
moment@2.29.4
2.31.0
1
ghcr.io/krateoplatformops/secret-service:1.1.4292bd05fb781
moment@2.29.4
2.31.0
1
ghcr.io/krateoplatformops/service-deployment:0.1.541fb833f36ee
moment@2.29.4
2.31.0
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.