StackRadar

CVE-2026-27601

Medium

Advisory

Published 3 Mar 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.010
60th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
160
of 17,781 indexed, latest versions
Container images
157
deployed by those charts
Fix available
1 of 2
affected packages

Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

Carried by container images the latest versions of 160 of 17,781 indexed charts deploy, on 157 images.

Affected packageAffected versionsFixed inImages
underscorenpm1.1.7, 1.4.4, 1.5.2, 1.6.0+13 more1.13.8135
underscoredeb1.13.4~dfsg+~1.11.4-3no fix listed22
OSV records
DEBIAN-CVE-2026-27601GHSA-qpx9-hpmf-5gmw

Charts affected

160 by stars
ChartLatestAffected imagesRadar Score
jupyterhubjupyterhubOfficialVerified publisher4.4.21 of 7See more

jupyterhub jupyterhub 4.4.2

1 of the 7 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
underscore@1.13.7
1.13.8

Open the chart page →

7,894
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

10,622
outlineoutline0.0.91 of 4See more

outline outline 0.0.9

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
underscore@1.13.1
1.13.8

Open the chart page →

4,431
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
underscore@1.13.1
1.13.8

Open the chart page →

5,352
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
underscore@1.13.7
1.13.8

Open the chart page →

3,004
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
underscore@1.13.6
1.13.8

Open the chart page →

5,639
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
microcks/microcks-postman-runtime:latestcb72e46a1b3c
underscore@1.7.0
1.13.8

Open the chart page →

10,732
netris-controllernetrisai2.8.22 of 14See more

netris-controller netrisai 2.8.2

2 of the 14 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
underscore@1.4.4
1.13.8
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
underscore@1.8.3
1.13.8

Open the chart page →

30,326
lighthouse-cicowboysysopVerified publisher9.0.01 of 1See more

lighthouse-ci cowboysysop 9.0.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
patrickhulce/lhci-server:0.8.174b4b6a3954d
underscore@1.13.1
1.13.8

Open the chart page →

2,213
servarrservarr1.0.21 of 10See more

servarr servarr 1.0.2

1 of the 10 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
underscore@1.13.6
1.13.8

Open the chart page →

14,238
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
underscore@1.11.0
1.13.8

Open the chart page →

8,213
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
underscore@1.12.1
1.13.8

Open the chart page →

5,946
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
kyleslugg/klusterview:latestba8c36dfdfbd
underscore@1.13.6
1.13.8

Open the chart page →

3,795
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
kubeflownotebookswg/centraldashboard:v1.6.137300551dea6
underscore@1.1.7
1.13.8

Open the chart page →

96,941
codetogethercodetogether1.4.251 of 1See more

codetogether codetogether 1.4.25

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
codetogether/codetogether:latest4348c8a38752
underscore@1.13.1
1.13.8

Open the chart page →

7,450
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

17,404
zwavejs2mqttgeek-cookbookVerified publisher5.4.21 of 1See more

zwavejs2mqtt geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
underscore@1.4.4
1.13.8

Open the chart page →

3,476
kongakonga1.1.01 of 1See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
underscore@1.6.0
1.13.8

Open the chart page →

5,209
kubeviouskubevious1.2.22 of 7See more

kubevious kubevious 1.2.2

2 of the 7 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
kubevious/backend:1.2.22d9ba6eb46b6
underscore@1.13.6
1.13.8
kubevious/parser:1.2.299ae7a5168c2
underscore@1.13.6
1.13.8

Open the chart page →

14,204
kobotoolboxone-acre-fundVerified publisher0.7.41 of 9See more

kobotoolbox one-acre-fund 0.7.4

1 of the 9 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
kobotoolbox/kpi:2.022.24dbcacc01bccd4
underscore@1.13.2
1.13.8

Open the chart page →

18,517
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
underscore@1.12.1
1.13.8

Open the chart page →

7,776
overseerrpree-helm-chartsVerified publisher1.2.01 of 1See more

overseerr pree-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.35.06197516c9d7b
underscore@1.13.6
1.13.8

Open the chart page →

2,702
pretixtechwolf12Verified publisher2026.7.01 of 3See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
pretix/standalone:2026.7.05df3b7aa852e
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

9,770
predatorzooz1.7.01 of 1See more

predator zooz 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
zooz/predator:1.6f491d1f7a865
underscore@1.13.1
1.13.8

Open the chart page →

2,851
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

5,880
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
underscore@1.13.4
1.13.8

Open the chart page →

77,706
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
underscore@1.13.4
1.13.8

Open the chart page →

77,687
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
underscore@1.13.7
1.13.8

Open the chart page →

1,991
skoonerchristianhuthVerified publisher0.4.01 of 1See more

skooner christianhuth 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
underscore@1.13.6
1.13.8

Open the chart page →

1,341
rstudiodsri-helm-charts0.1.281 of 1See more

rstudio dsri-helm-charts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
underscore@1.13.7
1.13.8

Open the chart page →

5,670
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

11,458
ranetogabisonfire0.1.21 of 1See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
underscore@1.12.0
1.13.8

Open the chart page →

2,519
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
underscore@1.12.1
1.13.8

Open the chart page →

4,260
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
underscore@1.13.1
1.13.8

Open the chart page →

3,444
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
underscore@1.13.6
1.13.8

Open the chart page →

3,123
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

6,374
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
underscore@1.13.6
1.13.8

Open the chart page →

4,196
knot-resolverknot-resolverVerified publisher1.0.51 of 1See more

knot-resolver knot-resolver 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
cznic/knot-resolver:v6.4.2fe71c5214fdc
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

2,049
open-api-discoveryopen-api-discoveryVerified publisher0.1.11 of 1See more

open-api-discovery open-api-discovery 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
lukasreining/open-api-schema-collector:0.1.050e021c42e33
underscore@1.13.6
1.13.8

Open the chart page →

2,473
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
underscore@1.13.7
1.13.8

Open the chart page →

6,883
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

8,158
flamerlex0.3.01 of 1See more

flame rlex 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
pawelmalak/flame:2.1.193e7b0abb603
underscore@1.13.1
1.13.8

Open the chart page →

2,449
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
underscore@1.13.7
1.13.8

Open the chart page →

2,823
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
underscore@1.13.7
1.13.8

Open the chart page →

38,107
statsdstatsd-airflow-smd0.1.191 of 1See more

statsd statsd-airflow-smd 0.1.19

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
statsd/statsd:v0.8.6dab129e74c25
underscore@1.4.4
1.13.8

Open the chart page →

4,185
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
underscore@1.12.1
1.13.8

Open the chart page →

12,581
waldurwaldur-chartsVerified publisher8.1.21 of 3See more

waldur waldur-charts 8.1.2

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
opennode/waldur-mastermind:8.1.24c82b15d9042
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

4,839
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
underscore@1.6.0
1.13.8

Open the chart page →

3,833
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
underscore@1.13.6
1.13.8

Open the chart page →

3,437
speech-to-phraseandrenarchyVerified publisher1.3.01 of 1See more

speech-to-phrase andrenarchy 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
rhasspy/wyoming-speech-to-phrase:1.4.3e532f0dbc6b2
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed

Open the chart page →

3,991

Container images carrying it

157 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/helmpack/monocular-ui:v1.10.086b71e90319f
underscore@1.6.0
1.13.8
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
underscore@1.7.0
1.13.8
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
underscore@1.13.7
1.13.8
1
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
underscore@1.13.6
1.13.8
1
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
underscore@1.5.2
1.13.8
1
quay.io/wekan/wekan:v5.65cb17600883a3
underscore@1.9.1
1.13.8
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
underscore@1.13.7
1.13.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.