StackRadar

CVE-2026-24400

High

Advisory

Published 26 Jan 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.005
43rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
24
of 17,781 indexed, latest versions
Container images
23
deployed by those charts
Fix available
1 of 1
affected package

AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion

Carried by container images the latest versions of 24 of 17,781 indexed charts deploy, on 23 images.

Affected packageAffected versionsFixed inImages
assertj-coremaven2.6.0, 2.9.1, 3.6.1, 3.8.0+10 more3.27.723
OSV records
GHSA-rqfh-9r24-8c9r

Charts affected

24 by stars
ChartLatestAffected imagesRadar Score
mcpmcp-chartsVerified publisher0.0.231 of 7See more

mcp mcp-charts 0.0.23

1 of the 7 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
glarad/mc-service-registry:latest7b02b9e7f1ef
assertj-core@3.18.1
3.27.7

Open the chart page →

6,929
graylogt3n1.0.01 of 3See more

graylog t3n 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
graylog2/server:2.4.3-38ff28c66e6c1
assertj-core@3.8.0
3.27.7

Open the chart page →

8,063
tocktock0.6.33 of 9See more

tock tock 0.6.3

3 of the 9 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
tock/bot_admin:25.10.7df3e38c77a38
assertj-core@3.16.1
3.27.7
tock/bot_api:25.10.7dd5d5c70e333
assertj-core@3.16.1
3.27.7
tock/kotlin_compiler:25.10.7c9c0fb40089a
assertj-core@3.16.1
3.27.7

Open the chart page →

12,907
migrationadeptia-automate-migration5.2.91 of 1See more

migration adeptia-automate-migration 5.2.9

1 of the 1 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
adeptiainc/adeptia-connect-migration:5.2.98607f4f29732
assertj-core@3.27.6
3.27.7

Open the chart page →

395
james-komposeappscodeVerified publisher0.1.01 of 4See more

james-kompose appscode 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
assertj-core@3.24.2
3.27.7

Open the chart page →

16,975
pulsarcnieg1.0.81 of 2See more

pulsar cnieg 1.0.8

1 of the 2 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
assertj-core@3.9.1
3.27.7

Open the chart page →

16,860
shenyuerdeng2.4.211 of 2See more

shenyu erdeng 2.4.21

1 of the 2 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
assertj-core@3.13.2
3.27.7

Open the chart page →

12,513
fineractfineract-openshift0.1.11 of 4See more

fineract fineract-openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
assertj-core@3.26.3
3.27.7

Open the chart page →

7,792
mod-codex-ekbfolio-org0.1.341 of 1See more

mod-codex-ekb folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
folioci/mod-codex-ekb:latest235a3fa4adc9
assertj-core@2.9.1
3.27.7

Open the chart page →

2,113
ibm-microclimateibm-charts0.1.02 of 8See more

ibm-microclimate ibm-charts 0.1.0

2 of the 8 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
assertj-core@2.6.0
3.27.7
ibmcom/microclimate-theia:lateste17bdccc5030
assertj-core@2.6.0
3.27.7

Open the chart page →

57,669
tapm-componentkubebb5.7.11 of 3See more

tapm-component kubebb 5.7.1

1 of the 3 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
refar/apm-api:v5.7.1241373fa2972
assertj-core@3.16.1
3.27.7

Open the chart page →

10,264
filebot-botluiscajl0.0.111 of 1See more

filebot-bot luiscajl 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
lavandadelpatio/filebot-bot:0.0.1-SNAPSHOTd2cba20aa4d8
assertj-core@3.21.0
3.27.7

Open the chart page →

3,679
tmdbluiscajl0.2.41 of 1See more

tmdb luiscajl 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
lavandadelpatio/tmdb:latestded9377636e9
assertj-core@3.24.2
3.27.7

Open the chart page →

2,234
pulsarv2milvus-helm2.7.81 of 4See more

pulsarv2 milvus-helm 2.7.8

1 of the 4 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
assertj-core@3.9.1
3.27.7

Open the chart page →

15,855
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
assertj-core@3.26.3
3.27.7

Open the chart page →

7,792
smsf-momtopenshift1.0.41 of 1See more

smsf-momt openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
gurolakman/smsf-momt:1.0.4ce23b20a8a17
assertj-core@3.21.0
3.27.7

Open the chart page →

13,568
ussigw-coreopenshift1.0.41 of 1See more

ussigw-core openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
gurolakman/ussigw-core:1.0.48739565c3ea2
assertj-core@3.21.0
3.27.7

Open the chart page →

13,100
operatonoperatonVerified publisher1.0.51 of 1See more

operaton operaton 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
operaton/operaton:1.0.0-beta-4b35867ffe4d8
assertj-core@3.27.3
3.27.7

Open the chart page →

2,003
shenyushenyu0.6.31 of 2See more

shenyu shenyu 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.5.11bd5756f6273
assertj-core@3.21.0
3.27.7

Open the chart page →

8,804
shenyushenyu-helm-chart-test2.4.271 of 2See more

shenyu shenyu-helm-chart-test 2.4.27

1 of the 2 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
assertj-core@3.13.2
3.27.7

Open the chart page →

12,513
newrelic-private-minionsstarcher0.1.21 of 1See more

newrelic-private-minion sstarcher 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
quay.io/newrelic/synthetics-minion:2.2.2198c26e1b8f70
assertj-core@3.8.0
3.27.7

Open the chart page →

3,164
sn-consolestreamnative1.13.01 of 1See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
streamnative/private-cloud-console:v2.3.27-all91e54375e154
assertj-core@3.27.4
3.27.7

Open the chart page →

1,827
shenyutest-helm2.4.211 of 2See more

shenyu test-helm 2.4.21

1 of the 2 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
assertj-core@3.13.2
3.27.7

Open the chart page →

12,513
sonarqubewebencryptor6.7.31 of 3See more

sonarqube webencryptor 6.7.3

1 of the 3 container images this version deploys carry CVE-2026-24400.

Container imageDigestPackageFixed in
library/sonarqube:8.2-communitya246bc64207e
assertj-core@3.6.1
3.27.7

Open the chart page →

5,460

Container images carrying it

23 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
assertj-core@3.13.2
3.27.7
3
apache/fineract:1.12.1a83cf1980609
assertj-core@3.26.3
3.27.7
2
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
assertj-core@3.9.1
3.27.7
2
adeptiainc/adeptia-connect-migration:5.2.98607f4f29732
assertj-core@3.27.6
3.27.7
1
apache/shenyu-bootstrap:2.5.11bd5756f6273
assertj-core@3.21.0
3.27.7
1
folioci/mod-codex-ekb:latest235a3fa4adc9
assertj-core@2.9.1
3.27.7
1
glarad/mc-service-registry:latest7b02b9e7f1ef
assertj-core@3.18.1
3.27.7
1
graylog2/server:2.4.3-38ff28c66e6c1
assertj-core@3.8.0
3.27.7
1
gurolakman/smsf-momt:1.0.4ce23b20a8a17
assertj-core@3.21.0
3.27.7
1
gurolakman/ussigw-core:1.0.48739565c3ea2
assertj-core@3.21.0
3.27.7
1
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
assertj-core@2.6.0
3.27.7
1
ibmcom/microclimate-theia:lateste17bdccc5030
assertj-core@2.6.0
3.27.7
1
lavandadelpatio/filebot-bot:0.0.1-SNAPSHOTd2cba20aa4d8
assertj-core@3.21.0
3.27.7
1
lavandadelpatio/tmdb:latestded9377636e9
assertj-core@3.24.2
3.27.7
1
library/sonarqube:8.2-communitya246bc64207e
assertj-core@3.6.1
3.27.7
1
operaton/operaton:1.0.0-beta-4b35867ffe4d8
assertj-core@3.27.3
3.27.7
1
refar/apm-api:v5.7.1241373fa2972
assertj-core@3.16.1
3.27.7
1
streamnative/private-cloud-console:v2.3.27-all91e54375e154
assertj-core@3.27.4
3.27.7
1
tock/bot_admin:25.10.7df3e38c77a38
assertj-core@3.16.1
3.27.7
1
tock/bot_api:25.10.7dd5d5c70e333
assertj-core@3.16.1
3.27.7
1
tock/kotlin_compiler:25.10.7c9c0fb40089a
assertj-core@3.16.1
3.27.7
1
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
assertj-core@3.24.2
3.27.7
1
quay.io/newrelic/synthetics-minion:2.2.2198c26e1b8f70
assertj-core@3.8.0
3.27.7
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.