StackRadar

CVE-2026-27601

Medium

Advisory

Published 3 Mar 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.010
60th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
160
of 17,781 indexed, latest versions
Container images
157
deployed by those charts
Fix available
1 of 2
affected packages

Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

Carried by container images the latest versions of 160 of 17,781 indexed charts deploy, on 157 images.

Affected packageAffected versionsFixed inImages
underscorenpm1.1.7, 1.4.4, 1.5.2, 1.6.0+13 more1.13.8135
underscoredeb1.13.4~dfsg+~1.11.4-3no fix listed22
OSV records
DEBIAN-CVE-2026-27601GHSA-qpx9-hpmf-5gmw

Charts affected

160 by stars
ChartLatestAffected imagesRadar Score
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
underscore@1.13.4
1.13.8

Open the chart page →

4,944
interbtc-hydrainterlay0.1.151 of 4See more

interbtc-hydra interlay 0.1.15

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
interlayhq/interbtc-hydra-processor:master-2c6e16e-1637088364423d567d47aa
underscore@1.6.0
1.13.8

Open the chart page →

6,831
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
underscore@1.13.1
1.13.8

Open the chart page →

7,232
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
underscore@1.13.7
1.13.8

Open the chart page →

5,826
jasperjasperVerified publisher1.0.2021 of 2See more

jasper jasper 1.0.202

1 of the 2 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/cjmalloy/jasper:v1.3.282726a947bb65b
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

5,998
monocularjenkins-x0.6.41 of 4See more

monocular jenkins-x 0.6.4

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
underscore@1.6.0
1.13.8

Open the chart page →

4,614
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
underscore@1.13.1
1.13.8

Open the chart page →

6,454
shinobik8s-home-lab-repo2.1.11 of 1See more

shinobi k8s-home-lab-repo 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
shinobisystems/shinobi:latestc2f5ce2e1067
underscore@1.4.4
1.13.8

Open the chart page →

4,667
kube-admission-controller-starterk8s-validating-webhook0.2.01 of 2See more

kube-admission-controller-starter k8s-validating-webhook 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/kube-admission-controller-starter:maine9716966f30b
underscore@1.13.4
1.13.8

Open the chart page →

2,166
statsdkeyporttech0.1.191 of 1See more

statsd keyporttech 0.1.19

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
statsd/statsd:v0.8.6dab129e74c25
underscore@1.4.4
1.13.8

Open the chart page →

4,185
skoonerkfirfer0.0.61 of 1See more

skooner kfirfer 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
underscore@1.13.6
1.13.8

Open the chart page →

1,341
visual-regression-trackerkokuwa5.1.01 of 4See more

visual-regression-tracker kokuwa 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
visualregressiontracker/api:5.0.11941aeb8c8bf9
underscore@1.13.6
1.13.8

Open the chart page →

9,098
sqlpadkronkltdVerified publisher0.1.01 of 1See more

sqlpad kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
sqlpad/sqlpad:6.7d3d2f430dffd
underscore@1.13.1
1.13.8

Open the chart page →

3,397
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
underscore@1.13.2
1.13.8

Open the chart page →

5,410
component-storekubebb0.0.231 of 1See more

component-store kubebb 0.0.23

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
kubebb/component-store:latestfd8ecbd73213
underscore@1.13.6
1.13.8

Open the chart page →

2,178
u4a-componentkubebb0.2.101 of 8See more

u4a-component kubebb 0.2.10

1 of the 8 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
kubebb/bff-server:v0.2.0-202312040fbb732379bc
underscore@1.13.4
1.13.8

Open the chart page →

13,819
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
underscore@1.13.7
1.13.8

Open the chart page →

2,548
multitenantkvalitetsitVerified publisher2.2.181 of 1See more

multitenant kvalitetsit 2.2.18

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
kvalitetsit/kithosting-networkpolicytests:0.0.12b99cfa3c5df
underscore@1.12.1
1.13.8

Open the chart page →

1,614
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
underscore@1.13.7
1.13.8

Open the chart page →

3,555
kubevismario-fVerified publisher2.0.11 of 1See more

kubevis mario-f 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
underscore@1.13.1
1.13.8

Open the chart page →

5,287
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
underscore@1.13.6
1.13.8

Open the chart page →

9,668
kommandermesosphere-stable0.39.21 of 29See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
underscore@1.9.1
1.13.8

Open the chart page →

68,284
opsportalmesosphere-stable0.9.51 of 3See more

opsportal mesosphere-stable 0.9.5

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
underscore@1.9.1
1.13.8

Open the chart page →

7,027
middleware-odigosmiddleware-labsVerified publisher0.2.411 of 6See more

middleware-odigos middleware-labs 0.2.41

1 of the 6 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/odigos-ui:middleware-test-0.0.787120a4561a9
underscore@1.13.4
1.13.8

Open the chart page →

8,370
middleware-visionmiddleware-labsVerified publisher0.2.651 of 6See more

middleware-vision middleware-labs 0.2.65

1 of the 6 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/vision-ui:middleware-test-0.0.853772b7b42c7
underscore@1.13.4
1.13.8

Open the chart page →

8,361
iotmmontesVerified publisher0.3.23 of 7See more

iot mmontes 0.3.2

3 of the 7 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/mmontes11/iot-back:v3.11.096683c54ae65
underscore@1.13.6
1.13.8
ghcr.io/mmontes11/iot-biot:v3.11.033f7976b26a8
underscore@1.13.6
1.13.8
ghcr.io/mmontes11/iot-worker:v3.11.0491bb243f555
underscore@1.13.6
1.13.8

Open the chart page →

10,608
finance-portalmojaloop5.1.41 of 11See more

finance-portal mojaloop 5.1.4

1 of the 11 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
mojaloop/reporting:v12.1.0d480a62103d6
underscore@1.13.7
1.13.8

Open the chart page →

14,809
reporting-legacy-apimojaloop2.2.01 of 1See more

reporting-legacy-api mojaloop 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
mojaloop/reporting:v12.1.0d480a62103d6
underscore@1.13.7
1.13.8

Open the chart page →

1,948
monocularmonocular1.4.152 of 5See more

monocular monocular 1.4.15

2 of the 5 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
underscore@1.6.0
1.13.8
quay.io/helmpack/monocular-ui:v1.10.086b71e90319f
underscore@1.6.0
1.13.8

Open the chart page →

7,048
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
underscore@1.8.3
1.13.8

Open the chart page →

4,960
myweatherhelmmyweather1.3.111 of 7See more

myweatherhelm myweather 1.3.11

1 of the 7 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
underscore@1.12.1
1.13.8

Open the chart page →

17,929
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
underscore@1.8.3
1.13.8

Open the chart page →

27,465
flomesh-consoleopenshift0.70.0-30-ubi81 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

1 of the 2 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
underscore@1.13.1
1.13.8

Open the chart page →

9,968
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
openwhisk/ow-utils:1.0.0c80dba0de3aa
underscore@1.8.3
1.13.8

Open the chart page →

36,215
dummy-servicephanVerified publisher0.3.41 of 1See more

dummy-service phan 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
phan2410/dummy-service:0.0.89c6ed6de26ca
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

5,706
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
underscore@1.13.6
1.13.8

Open the chart page →

6,524
relfinder-reformedrelfinderreformed2.0.01 of 2See more

relfinder-reformed relfinderreformed 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
underscore@1.13.6
1.13.8

Open the chart page →

6,282
gristrlex0.1.01 of 1See more

grist rlex 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
gristlabs/grist:0.7.96e71b1914a7e
underscore@1.12.1
1.13.8

Open the chart page →

5,215
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

15,591
evsantisbon0.2.02 of 5See more

ev santisbon 0.2.0

2 of the 5 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
santisbon/evwatcher:latestc4e994ca4540
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
santisbon/evworker:lateste807283f8d69
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

14,179
speedtestsantisbon0.1.01 of 3See more

speedtest santisbon 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
santisbon/speedtest:latest8ee3a1697227
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

12,668
hedgedocschmitzis0.1.121 of 1See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
underscore@1.13.4
1.13.8

Open the chart page →

3,118
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
underscore@1.13.1
1.13.8

Open the chart page →

4,431
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
underscore@1.9.1
1.13.8

Open the chart page →

3,638
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
underscore@1.12.1
1.13.8

Open the chart page →

5,497
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
underscore@1.13.7
1.13.8

Open the chart page →

1,991
skoonerskooner0.2.21 of 1See more

skooner skooner 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
underscore@1.13.6
1.13.8

Open the chart page →

1,341
k8soketisoketi1.0.11 of 1See more

k8soketi soketi 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
underscore@1.13.6
1.13.8

Open the chart page →

2,267
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f81 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

1 of the 5 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
underscore@1.13.6
1.13.8

Open the chart page →

14,679
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4691 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

1 of the 5 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d4694bd113093583
underscore@1.13.6
1.13.8

Open the chart page →

14,221

Container images carrying it

157 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ibmcom/microclimate-portal:latested5505e5c7ec
underscore@1.7.0
1.13.8
1
interlayhq/interbtc-hydra-processor:master-2c6e16e-1637088364423d567d47aa
underscore@1.6.0
1.13.8
1
jaedb/iris:latest048cfbf58d57
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
jayfong/yapi:1.10.2163e5d621910
underscore@1.13.1
1.13.8
1
kobotoolbox/kpi:2.022.24dbcacc01bccd4
underscore@1.13.2
1.13.8
1
konradkleine/docker-registry-frontend:v2181aad54ee64
underscore@1.7.0
1.13.8
1
kubebb/bff-server:v0.2.0-202312040fbb732379bc
underscore@1.13.4
1.13.8
1
kubebb/component-store:latestfd8ecbd73213
underscore@1.13.6
1.13.8
1
kubeflownotebookswg/centraldashboard:v1.6.137300551dea6
underscore@1.1.7
1.13.8
1
kubevious/backend:1.2.22d9ba6eb46b6
underscore@1.13.6
1.13.8
1
kubevious/parser:1.2.299ae7a5168c2
underscore@1.13.6
1.13.8
1
kvalitetsit/kithosting-networkpolicytests:0.0.12b99cfa3c5df
underscore@1.12.1
1.13.8
1
kyleslugg/klusterview:latestba8c36dfdfbd
underscore@1.13.6
1.13.8
1
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
underscore@1.12.1
1.13.8
1
library/ghost:6.25.12654b1e90413
underscore@1.8.3
1.13.8
1
library/ghost:4.37.0767230c0f263
underscore@1.12.1
1.13.8
1
library/ghost:5.79.083f7bf209844
underscore@1.12.1
1.13.8
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
underscore@1.7.0
1.13.8
1
linuxserver/codimd:latestb801bbcf6386
underscore@1.8.3
1.13.8
1
linuxserver/overseerr:1.35.06108ed066d4a
underscore@1.13.6
1.13.8
1
louislam/uptime-kuma:13d632903e6af
underscore@1.13.7
1.13.8
1
louislam/uptime-kuma:2.0.24c364ef96aad
underscore@1.13.7
1.13.8
1
louislam/uptime-kuma:1.23.1396510915e6be
underscore@1.13.6
1.13.8
1
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
underscore@1.13.7
1.13.8
1
louislam/uptime-kuma:1.23.12bc6f244ecf27
underscore@1.13.6
1.13.8
1
lukasreining/open-api-schema-collector:0.1.050e021c42e33
underscore@1.13.6
1.13.8
1
makersquad/harp-proxy:0.8.1a40dd258c527
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
matrixdotorg/matrix-appservice-gitter:latest0d37b4d42b47
underscore@1.9.2
1.13.8
1
microcks/microcks-postman-runtime:latestcb72e46a1b3c
underscore@1.7.0
1.13.8
1
minddocdev/hubot:0.1.96c60b11a4fa7
underscore@1.8.3
1.13.8
1
n8nio/n8n:1.86.08b39ed5a2de9
underscore@1.13.7
1.13.8
1
n8nio/n8n:0.212.0a9195bc499a3
underscore@1.12.1
1.13.8
1
n8nio/n8n:1.33.1dd171d45102a
underscore@1.13.6
1.13.8
1
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
underscore@1.8.3
1.13.8
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
obolnetwork/charon-dkg-sidecar:maine263be0a7440
underscore@1.13.4
1.13.8
1
openbas/caldera-server:5.1.0a277796d9724
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
openemr/openemr:6.1.089eaa6d9a4e3
underscore@1.13.2
1.13.8
1
openhab/openhab-cloud:a8138a329dd2bac8c4b
underscore@1.13.6
1.13.8
1
opennode/waldur-mastermind:8.1.24c82b15d9042
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
openthread/otbr:latestf307f59f6432
underscore@1.8.3
1.13.8
1
openwhisk/ow-utils:1.0.0c80dba0de3aa
underscore@1.8.3
1.13.8
1
outlinewiki/outline:0.82.0494dfb9249a6
underscore@1.13.1
1.13.8
1
parithoshj/testnet-faucet:9859e0dcdca426fea6d
underscore@1.8.3
1.13.8
1
patrickhulce/lhci-server:0.8.174b4b6a3954d
underscore@1.13.1
1.13.8
1
pawelmalak/flame:2.1.193e7b0abb603
underscore@1.13.1
1.13.8
1
pawelmalak/flame:multiarch2.3.19f88b17692a0
underscore@1.13.1
1.13.8
1
phan2410/dummy-service:0.0.89c6ed6de26ca
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
phntom/codimd:2.4.31b9aafbb62e6
underscore@1.13.6
1.13.8
1
plumdog/db-operator:latest0c2fa2db0357
underscore@1.13.1
1.13.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.