StackRadar

CVE-2026-17495

Medium

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.004
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
237
of 17,957 indexed, latest versions
Container images
229
deployed by those charts
Fix available
1 of 1
affected package

moment vulnerable to Path Traversal via crafted non-string locale name

Carried by container images the latest versions of 237 of 17,957 indexed charts deploy, on 229 images.

Affected packageAffected versionsFixed inImages
momentnpm2.29.2, 2.29.3, 2.29.4, 2.30.12.31.0229
OSV records
GHSA-4p3w-j4w9-5jqw

Charts affected

237 by stars
ChartLatestAffected imagesRadar Score
template-servicekrateo1.2.131 of 1See more

template-service krateo 1.2.13

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/template-service:1.2.139f82e7cb2348
moment@2.29.4
2.31.0

Open the chart page →

6,231
kubeflowkromanow94-kubeflow0.5.11 of 30See more

kubeflow kromanow94-kubeflow 0.5.1

1 of the 30 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
kubeflownotebookswg/centraldashboard:v1.9.2af55c22ef5de
moment@2.29.4
2.31.0

Open the chart page →

74,154
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
moment@2.30.1
2.31.0

Open the chart page →

3,642
component-storekubebb0.0.231 of 1See more

component-store kubebb 0.0.23

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
kubebb/component-store:latestfd8ecbd73213
moment@2.29.4
2.31.0

Open the chart page →

2,264
u4a-componentkubebb0.2.101 of 8See more

u4a-component kubebb 0.2.10

1 of the 8 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
kubebb/bff-server:v0.2.0-202312040fbb732379bc
moment@2.29.4
2.31.0

Open the chart page →

13,953
jupyterhubkubeblocksVerified publisher0.1.02 of 7See more

jupyterhub kubeblocks 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
moment@2.29.4
2.31.0
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
moment@2.29.4
2.31.0

Open the chart page →

7,645
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
moment@2.30.1
2.31.0

Open the chart page →

3,111
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
moment@2.30.1
2.31.0

Open the chart page →

2,813
kubevious-agentkubevious1.0.41 of 1See more

kubevious-agent kubevious 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
kubevious/parser:1.0.151acf1a1f0b47
moment@2.29.4
2.31.0

Open the chart page →

2,031
workload-operatorkubevious0.0.31 of 1See more

workload-operator kubevious 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
kubevious/workload-operator:1.0.20b0f4c507eb6
moment@2.29.4
2.31.0

Open the chart page →

2,109
kyso-frontkyso1.0.01 of 1See more

kyso-front kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
kyso/kyso-front:lateste52595c5c16f
moment@2.29.4
2.31.0

Open the chart page →

2,806
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
moment@2.30.1
2.31.0

Open the chart page →

3,817
node-redlmatfyVerified publisher0.1.61 of 1See more

node-red lmatfy 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
nodered/node-red:4.1.10-minimald73ae167cb9b
moment@2.30.1
2.31.0

Open the chart page →

1,974
efklovemew67Verified publisher0.0.11 of 2See more

efk lovemew67 0.0.1

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
nshou/elasticsearch-kibana:kibana7a1d1e36814d1
moment@2.29.4
2.31.0

Open the chart page →

3,989
wudm0sh1-helm-charts0.2.01 of 1See more

wud m0sh1-helm-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
getwud/wud:8.1.1b1cd01c43839
moment@2.30.1
2.31.0

Open the chart page →

6,860
mauticmautic-chartVerified publisher1.0.21 of 3See more

mautic mautic-chart 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
mautic/mautic:7-apacheeb8cc73d97e1
moment@2.30.1
2.31.0

Open the chart page →

9,063
eoloplantmca-eoloplaner0.1.01 of 7See more

eoloplant mca-eoloplaner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
hugohg34/server:0.0.2503e5d8960ff
moment@2.29.2
2.31.0

Open the chart page →

30,741
iotmmontesVerified publisher0.3.21 of 7See more

iot mmontes 0.3.2

1 of the 7 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/mmontes11/iot-back:v3.11.096683c54ae65
moment@2.29.4
2.31.0

Open the chart page →

10,855
bofmojaloop5.1.61 of 1See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
moment@2.30.1
2.31.0

Open the chart page →

2,736
finance-portalmojaloop5.1.43 of 11See more

finance-portal mojaloop 5.1.4

3 of the 11 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
moment@2.30.1
2.31.0
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
moment@2.30.1
2.31.0
mojaloop/role-assignment-service:v2.1.0def4bf273721
moment@2.29.4
2.31.0

Open the chart page →

16,206
reporting-events-processor-svcmojaloop3.5.31 of 1See more

reporting-events-processor-svc mojaloop 3.5.3

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
moment@2.30.1
2.31.0

Open the chart page →

2,897
reporting-hub-bop-experience-api-svcmojaloop1.0.31 of 1See more

reporting-hub-bop-experience-api-svc mojaloop 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
moment@2.30.1
2.31.0

Open the chart page →

2,716
role-assignment-servicemojaloop3.1.01 of 1See more

role-assignment-service mojaloop 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
mojaloop/role-assignment-service:v2.1.0def4bf273721
moment@2.29.4
2.31.0

Open the chart page →

2,436
security-role-perm-operator-svcmojaloop3.0.01 of 1See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
moment@2.30.1
2.31.0

Open the chart page →

2,736
mongodb-admin-interfacemongo-db-admin-interfaceVerified publisher0.1.01 of 2See more

mongodb-admin-interface mongo-db-admin-interface 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
library/mongo-express:latest1b23d7976f02
moment@2.29.4
2.31.0

Open the chart page →

5,474
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
moment@2.29.4
2.31.0

Open the chart page →

5,425
nightscoutmt1905021.1.01 of 3See more

nightscout mt190502 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.3f604dc4c03ca
moment@2.29.4
2.31.0

Open the chart page →

6,918
cloudcmdmy0nVerified publisher0.0.31 of 1See more

cloudcmd my0n 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
coderaiser/cloudcmd:16.6.1b34a9775c7ce
moment@2.29.4
2.31.0

Open the chart page →

3,377
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
moment@2.30.1
2.31.0

Open the chart page →

1,441
remminanicholaswildeVerified publisher0.1.41 of 1See more

remmina nicholaswilde 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/remmina:version-1.2.0-rcgit.29dfsg-1ubuntu105955792e00f
moment@2.29.3
2.31.0

Open the chart page →

23,256
indexer-toolsnodeifyVerified publisher2.1.11 of 1See more

indexer-tools nodeify 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/vincenttaglia/indexer-tools:v3.4.45bae30456ddb
moment@2.29.4
2.31.0

Open the chart page →

3,042
praecoone-acre-fundVerified publisher0.2.02 of 3See more

praeco one-acre-fund 0.2.0

2 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
praecoapp/elastalert-server:202302195a0d8715e8b1
moment@2.29.4
2.31.0
praecoapp/praeco:1.8.1322be3218d7df
moment@2.29.4
2.31.0

Open the chart page →

9,205
raspberrymaticopenccuVerified publisher3.83.61 of 1See more

raspberrymatic openccu 3.83.6

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
moment@2.30.1
2.31.0

Open the chart page →

2,657
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
moment@2.30.1
2.31.0

Open the chart page →

1,441
console-apiovrclk-20.1.11 of 1See more

console-api ovrclk-2 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/akash-network/console-api:2.64.0ba359097329d
moment@2.30.1
2.31.0

Open the chart page →

3,822
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
moment@2.29.4
2.31.0

Open the chart page →

6,653
powerdnspuckpuck2.0.01 of 4See more

powerdns puckpuck 2.0.0

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
pschiffe/pdns-admin:0.4.137ebba8c2b8f
moment@2.29.4
2.31.0

Open the chart page →

4,361
jupyterhubquench-jupyterhubVerified publisher0.0.41 of 2See more

jupyterhub quench-jupyterhub 0.0.4

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/jupyterhubdigest-pinned0f3223ae012b
moment@2.30.1
2.31.0

Open the chart page →

119
ml-stackquench-ml-stackVerified publisher0.0.51 of 5See more

ml-stack quench-ml-stack 0.0.5

1 of the 5 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/jupyterhubdigest-pinned0f3223ae012b
moment@2.30.1
2.31.0

Open the chart page →

503
relfinder-reformedrelfinderreformed2.0.01 of 2See more

relfinder-reformed relfinderreformed 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
moment@2.29.4
2.31.0

Open the chart page →

6,430
claude-relayrevolution10.1.371 of 4See more

claude-relay revolution1 0.1.37

1 of the 4 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
moment@2.30.1
2.31.0

Open the chart page →

5,168
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
moment@2.30.1
2.31.0

Open the chart page →

16,776
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
moment@2.30.1
2.31.0

Open the chart page →

71,602
audiobookshelfrubxkubeVerified publisher0.1.31 of 1See more

audiobookshelf rubxkube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
moment@2.29.4
2.31.0

Open the chart page →

1,899
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
moment@2.30.1
2.31.0

Open the chart page →

7,939
samplesample0.1.01 of 2See more

sample sample 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
library/mongo-express:1.0.2-20-alpine3.191aae00775251
moment@2.29.4
2.31.0

Open the chart page →

2,136
grocysarab97Verified publisher0.1.11 of 1See more

grocy sarab97 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
linuxserver/grocy:4.0.1f8f5f96b6ea8
moment@2.29.4
2.31.0

Open the chart page →

2,472
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
moment@2.29.4
2.31.0

Open the chart page →

5,147
unifi-protectschichtelVerified publisher0.10.11 of 1See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
moment@2.29.4
2.31.0

Open the chart page →

5,751
hedgedocschmitzis0.1.121 of 1See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-17495.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
moment@2.29.4
2.31.0

Open the chart page →

3,278

Container images carrying it

229 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/krateoplatformops/template-service:1.2.139f82e7cb2348
moment@2.29.4
2.31.0
1
ghcr.io/linuxserver/remmina:version-1.2.0-rcgit.29dfsg-1ubuntu105955792e00f
moment@2.29.3
2.31.0
1
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
moment@2.30.1
2.31.0
1
ghcr.io/mend/renovate-ee-server:15.6.087b77989f48d
moment@2.30.1
2.31.0
1
ghcr.io/mmontes11/iot-back:v3.11.096683c54ae65
moment@2.29.4
2.31.0
1
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
moment@2.29.4
2.31.0
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
moment@2.30.1
2.31.0
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
moment@2.29.4
2.31.0
1
ghcr.io/seerr-team/seerr:v3.5.027602401178d
moment@2.30.1
2.31.0
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
moment@2.30.1
2.31.0
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:main06adb21bfdfc
moment@2.30.1
2.31.0
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
moment@2.29.4
2.31.0
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
moment@2.29.4
2.31.0
1
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
moment@2.29.4
2.31.0
1
ghcr.io/vincenttaglia/indexer-tools:v3.4.45bae30456ddb
moment@2.29.4
2.31.0
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
moment@2.30.1
2.31.0
1
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
moment@2.29.4
2.31.0
1
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
moment@2.30.1
2.31.0
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
moment@2.30.1
2.31.0
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
moment@2.29.4
2.31.0
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
moment@2.30.1
2.31.0
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
moment@2.30.1
2.31.0
1
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
moment@2.29.4
2.31.0
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
moment@2.30.1
2.31.0
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
moment@2.29.4
2.31.0
1
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
moment@2.29.4
2.31.0
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
moment@2.30.1
2.31.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
moment@2.30.1
2.31.0
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
moment@2.30.1
2.31.0
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.