StackRadar

CVE-2026-27601

Medium

Advisory

Published 3 Mar 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.010
60th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
160
of 17,781 indexed, latest versions
Container images
157
deployed by those charts
Fix available
1 of 2
affected packages

Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

Carried by container images the latest versions of 160 of 17,781 indexed charts deploy, on 157 images.

Affected packageAffected versionsFixed inImages
underscorenpm1.1.7, 1.4.4, 1.5.2, 1.6.0+13 more1.13.8135
underscoredeb1.13.4~dfsg+~1.11.4-3no fix listed22
OSV records
DEBIAN-CVE-2026-27601GHSA-qpx9-hpmf-5gmw

Charts affected

160 by stars
ChartLatestAffected imagesRadar Score
jupyterhubjupyterhubOfficialVerified publisher4.4.21 of 7See more

jupyterhub jupyterhub 4.4.2

1 of the 7 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
underscore@1.13.7
1.13.8

Open the chart page →

7,894
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

10,622
outlineoutline0.0.91 of 4See more

outline outline 0.0.9

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
underscore@1.13.1
1.13.8

Open the chart page →

4,431
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
underscore@1.13.1
1.13.8

Open the chart page →

5,352
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
underscore@1.13.7
1.13.8

Open the chart page →

3,004
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
underscore@1.13.6
1.13.8

Open the chart page →

5,639
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
microcks/microcks-postman-runtime:latestcb72e46a1b3c
underscore@1.7.0
1.13.8

Open the chart page →

10,732
netris-controllernetrisai2.8.22 of 14See more

netris-controller netrisai 2.8.2

2 of the 14 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
underscore@1.4.4
1.13.8
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
underscore@1.8.3
1.13.8

Open the chart page →

30,326
lighthouse-cicowboysysopVerified publisher9.0.01 of 1See more

lighthouse-ci cowboysysop 9.0.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
patrickhulce/lhci-server:0.8.174b4b6a3954d
underscore@1.13.1
1.13.8

Open the chart page →

2,213
servarrservarr1.0.21 of 10See more

servarr servarr 1.0.2

1 of the 10 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
underscore@1.13.6
1.13.8

Open the chart page →

14,238
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
underscore@1.11.0
1.13.8

Open the chart page →

8,213
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
underscore@1.12.1
1.13.8

Open the chart page →

5,946
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
kyleslugg/klusterview:latestba8c36dfdfbd
underscore@1.13.6
1.13.8

Open the chart page →

3,795
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
kubeflownotebookswg/centraldashboard:v1.6.137300551dea6
underscore@1.1.7
1.13.8

Open the chart page →

96,941
codetogethercodetogether1.4.251 of 1See more

codetogether codetogether 1.4.25

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
codetogether/codetogether:latest4348c8a38752
underscore@1.13.1
1.13.8

Open the chart page →

7,450
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

17,404
zwavejs2mqttgeek-cookbookVerified publisher5.4.21 of 1See more

zwavejs2mqtt geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
underscore@1.4.4
1.13.8

Open the chart page →

3,476
kongakonga1.1.01 of 1See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
underscore@1.6.0
1.13.8

Open the chart page →

5,209
kubeviouskubevious1.2.22 of 7See more

kubevious kubevious 1.2.2

2 of the 7 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
kubevious/backend:1.2.22d9ba6eb46b6
underscore@1.13.6
1.13.8
kubevious/parser:1.2.299ae7a5168c2
underscore@1.13.6
1.13.8

Open the chart page →

14,204
kobotoolboxone-acre-fundVerified publisher0.7.41 of 9See more

kobotoolbox one-acre-fund 0.7.4

1 of the 9 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
kobotoolbox/kpi:2.022.24dbcacc01bccd4
underscore@1.13.2
1.13.8

Open the chart page →

18,517
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
underscore@1.12.1
1.13.8

Open the chart page →

7,776
overseerrpree-helm-chartsVerified publisher1.2.01 of 1See more

overseerr pree-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.35.06197516c9d7b
underscore@1.13.6
1.13.8

Open the chart page →

2,702
pretixtechwolf12Verified publisher2026.7.01 of 3See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
pretix/standalone:2026.7.05df3b7aa852e
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

9,770
predatorzooz1.7.01 of 1See more

predator zooz 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
zooz/predator:1.6f491d1f7a865
underscore@1.13.1
1.13.8

Open the chart page →

2,851
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

5,880
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
underscore@1.13.4
1.13.8

Open the chart page →

77,706
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
underscore@1.13.4
1.13.8

Open the chart page →

77,687
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
underscore@1.13.7
1.13.8

Open the chart page →

1,991
skoonerchristianhuthVerified publisher0.4.01 of 1See more

skooner christianhuth 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
underscore@1.13.6
1.13.8

Open the chart page →

1,341
rstudiodsri-helm-charts0.1.281 of 1See more

rstudio dsri-helm-charts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
underscore@1.13.7
1.13.8

Open the chart page →

5,670
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

11,458
ranetogabisonfire0.1.21 of 1See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
underscore@1.12.0
1.13.8

Open the chart page →

2,519
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
underscore@1.12.1
1.13.8

Open the chart page →

4,260
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
underscore@1.13.1
1.13.8

Open the chart page →

3,444
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
underscore@1.13.6
1.13.8

Open the chart page →

3,123
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

6,374
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
underscore@1.13.6
1.13.8

Open the chart page →

4,196
knot-resolverknot-resolverVerified publisher1.0.51 of 1See more

knot-resolver knot-resolver 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
cznic/knot-resolver:v6.4.2fe71c5214fdc
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

2,049
open-api-discoveryopen-api-discoveryVerified publisher0.1.11 of 1See more

open-api-discovery open-api-discovery 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
lukasreining/open-api-schema-collector:0.1.050e021c42e33
underscore@1.13.6
1.13.8

Open the chart page →

2,473
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
underscore@1.13.7
1.13.8

Open the chart page →

6,883
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

8,158
flamerlex0.3.01 of 1See more

flame rlex 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
pawelmalak/flame:2.1.193e7b0abb603
underscore@1.13.1
1.13.8

Open the chart page →

2,449
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
underscore@1.13.7
1.13.8

Open the chart page →

2,823
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
underscore@1.13.7
1.13.8

Open the chart page →

38,107
statsdstatsd-airflow-smd0.1.191 of 1See more

statsd statsd-airflow-smd 0.1.19

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
statsd/statsd:v0.8.6dab129e74c25
underscore@1.4.4
1.13.8

Open the chart page →

4,185
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
underscore@1.12.1
1.13.8

Open the chart page →

12,581
waldurwaldur-chartsVerified publisher8.1.21 of 3See more

waldur waldur-charts 8.1.2

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
opennode/waldur-mastermind:8.1.24c82b15d9042
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

4,839
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
underscore@1.6.0
1.13.8

Open the chart page →

3,833
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
underscore@1.13.6
1.13.8

Open the chart page →

3,437
speech-to-phraseandrenarchyVerified publisher1.3.01 of 1See more

speech-to-phrase andrenarchy 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
rhasspy/wyoming-speech-to-phrase:1.4.3e532f0dbc6b2
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

3,991

Container images carrying it

157 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
underscore@1.13.6
1.13.8
4
assistiot/dlt_api:2.0.0e36a8922fa0c
underscore@1.13.4
1.13.8
3
pantsel/konga:latestc8172b75607d
underscore@1.6.0
1.13.8
3
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
underscore@1.13.7
1.13.8
3
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
underscore@1.11.0
1.13.8
2
mesosphere/kommander:6.100.13917e82333a9
underscore@1.9.1
1.13.8
2
migmartri/prerender:latest486aacfd5aa9
underscore@1.6.0
1.13.8
2
mojaloop/reporting:v12.1.0d480a62103d6
underscore@1.13.7
1.13.8
2
outlinewiki/outline:0.69.1d060dcd8f9aa
underscore@1.13.1
1.13.8
2
requarks/wiki:2:latest68f0d1848261
underscore@1.6.0
1.13.8
2
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d469:2.18.12-branch.testing3.88744-f55b3414bd113093583
underscore@1.13.6
1.13.8
2
statsd/statsd:v0.8.6dab129e74c25
underscore@1.4.4
1.13.8
2
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
underscore@1.13.4
1.13.8
2
allegroai/clearml:2.0.0-613713ae38f7daf
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
assistiot/dlt_api:2.1.0c8a170683be7
underscore@1.13.4
1.13.8
1
assistiot/smart-orchestrator_cluster:latest4f41e1defe99
underscore@1.13.4
1.13.8
1
assistiot/smart-orchestrator_enabler:latest89f37e88c871
underscore@1.13.4
1.13.8
1
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
assistiot/smart-orchestrator_repository:latesta8b8dbed04a4
underscore@1.13.4
1.13.8
1
assistiot/smart-orchestrator_scheduler:latest38b003e55ff3
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
assistiot/smart-orchestrator_scheduler_mc:latestb1dbe4d62a03
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
baserow/backend:1.31.1e0b3c8130b91
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
baserow/baserow:1.30.1df0c42eb67e8
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
bnjbvr/kresus:0.22.137e216b182c8
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
catalysm/csmm:latestf003b35f54d9
underscore@1.13.1
1.13.8
1
codetogether/codetogether:latest4348c8a38752
underscore@1.13.1
1.13.8
1
coldatom/containers-security-api:latesteae9e82da080
underscore@1.13.6
1.13.8
1
countly/api:25.05.4f4cc7447c4f5
underscore@1.13.6
1.13.8
1
countly/countly-server:25.05.4e3c238248f99
underscore@1.13.6
1.13.8
1
countly/frontend:25.05.42acbc11499b6
underscore@1.13.6
1.13.8
1
cryptexlabs/swagger-combine-ui:0.2.1ed0bc94fd412
underscore@1.7.0
1.13.8
1
cznic/knot-resolver:v6.4.2fe71c5214fdc
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
daskdev/dask-notebook:1.1.0052630f5ca04
underscore@1.9.1
1.13.8
1
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
underscore@1.7.0
1.13.8
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
underscore@1.13.4
1.13.8
1
ethersphere/bzz-token-service:latest7624f11a72ad
underscore@1.12.1
1.13.8
1
fallenbagel/jellyseerr:latest4538137bc5af
underscore@1.13.7
1.13.8
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
underscore@1.13.6
1.13.8
1
fanzynoodle/smeejas:0.0.15f9916c1a287
underscore@1.13.2
1.13.8
1
fiware/idm:8.3.3a1b6ed4ae84f
underscore@1.13.6
1.13.8
1
fiware/iotagent-json:3.1.0879b21a0d36d
underscore@1.12.1
1.13.8
1
fiware/iotagent-ul:1.14.0fe11f55a926d
underscore@1.9.1
1.13.8
1
folioci/mod-graphql:latestf0655a6a08fd
underscore@1.13.6
1.13.8
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
underscore@1.13.6
1.13.8
1
governify/collector-dynamic:v1.3.06d3d1a5b46a9
underscore@1.4.4
1.13.8
1
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
underscore@1.4.4
1.13.8
1
gristlabs/grist:0.7.96e71b1914a7e
underscore@1.12.1
1.13.8
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
underscore@1.12.1
1.13.8
1
ianw/quickchart:v1.7.1dc49dd460c37
underscore@1.12.1
1.13.8
1
ibmcom/bai-admin-dev:19.0.202d882f2836e
underscore@1.1.7
1.13.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.