StackRadar

CVE-2026-33532

Medium

Advisory

Published 25 Mar 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
4.3
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
184
of 17,781 indexed, latest versions
Container images
177
deployed by those charts
Fix available
1 of 1
affected package

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Carried by container images the latest versions of 184 of 17,781 indexed charts deploy, on 177 images.

Affected packageAffected versionsFixed inImages
yamlnpm1.0.0, 1.8.2, 1.9.2, 1.10.0+18 more1.10.3, 2.8.3177
OSV records
GHSA-48c2-rrv3-qjmp

Charts affected

184 by stars
ChartLatestAffected imagesRadar Score
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
yaml@1.10.2
1.10.3

Open the chart page →

5,940
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
yaml@1.10.2
1.10.3

Open the chart page →

6,873
portraitportraitVerified publisher0.2.132 of 8See more

portrait portrait 0.2.13

2 of the 8 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
codercom/code-server:4.11.0-debian1e2cc688008e
yaml@1.0.0
1.10.3
treskon/portrait-ui:DEV-lateste7970783bc8d
yaml@2.3.4
2.8.3

Open the chart page →

31,844
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
yaml@2.7.0
2.8.3

Open the chart page →

2,823
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
supabase/postgres-meta:v0.96.6a84cc713585e
yaml@2.7.0
2.8.3

Open the chart page →

18,075
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
yaml@2.5.0
2.8.3

Open the chart page →

12,581
activepiecesadnoctemVerified publisher0.5.01 of 1See more

activepieces adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
activepieces/activepieces:0.90.430c10a04fe3d
yaml@2.5.1
2.8.3

Open the chart page →

1,055
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
yaml@2.8.2
2.8.3

Open the chart page →

3,820
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
yaml@2.6.1
2.8.3

Open the chart page →

4,880
katalogalpineworks0.1.21 of 5See more

katalog alpineworks 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/alpineworks/katalog-frontend:v1.0.734b76dcb1c10
yaml@2.4.1
2.8.3

Open the chart page →

4,497
lametric-nightscout-proxyaolde0.1.01 of 1See more

lametric-nightscout-proxy aolde 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/aolde/lametric-nightscout-proxy:latest7d1951b6baf5
yaml@1.10.2
1.10.3

Open the chart page →

1,186
apimap-developerapimapOfficialVerified publisher1.4.11 of 1See more

apimap-developer apimap 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
apimap/developer:v1.3.1406d3858e20c
yaml@1.10.2
1.10.3

Open the chart page →

2,353
apimap-portalapimapOfficialVerified publisher2.4.01 of 1See more

apimap-portal apimap 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
apimap/portal:v2.4.0041a4790c65c
yaml@1.10.2
1.10.3

Open the chart page →

2,396
fl-orchestrator-guiassist-iot-fl-orchestrator0.1.01 of 3See more

fl-orchestrator-gui assist-iot-fl-orchestrator 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
assistiot/fl_orchestrator:api-latest7473d77448e1
yaml@1.10.2
1.10.3

Open the chart page →

9,369
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
assistiot/open_api_frontend:1.0.1f11d82defc70
yaml@1.10.2
1.10.3

Open the chart page →

18,277
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
yaml@2.3.4
2.8.3

Open the chart page →

32,501
opendistro-esbeeinventor1.15.11 of 3See more

opendistro-es beeinventor 1.15.1

1 of the 3 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
yaml@1.10.0
1.10.3

Open the chart page →

5,806
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
yaml@1.10.2
1.10.3

Open the chart page →

4,455
overseerrbrandan-schmitz-helm-chartsVerified publisher1.4.01 of 1See more

overseerr brandan-schmitz-helm-charts 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
linuxserver/overseerr:1.35.06108ed066d4a
yaml@1.10.2
1.10.3

Open the chart page →

3,071
syslog-portalbryopsida0.3.11 of 1See more

syslog-portal bryopsida 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/syslog-portal:main3947bfd04f49
yaml@1.10.2
1.10.3

Open the chart page →

1,306
caninecanine0.1.101 of 7See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/caninehq/canine:latesta058034ca006
yaml@2.5.1
2.8.3

Open the chart page →

14,130
developer-dashboardcloud-native-toolkit1.4.11 of 1See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
yaml@1.8.2
1.10.3

Open the chart page →

25,456
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad3 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

3 of the 6 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
yaml@2.6.1
2.8.3
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
yaml@2.7.1
2.8.3
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
yaml@2.7.1
2.8.3

Open the chart page →

18,293
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
yaml@1.10.2
1.10.3

Open the chart page →

5,141
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
yaml@1.10.2
1.10.3

Open the chart page →

5,141
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
yaml@1.10.2
1.10.3

Open the chart page →

5,141
conduction-uiconduction-ui0.1.01 of 6See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
conduction/conduction-ui-app:devd591f5e6f2a9
yaml@1.10.0
1.10.3

Open the chart page →

12,907
containers-security-chartscontainers-security0.1.01 of 7See more

containers-security-charts containers-security 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
coldatom/containers-security-front:latest7c2fbbb41bcf
yaml@1.10.2
1.10.3

Open the chart page →

9,146
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
yaml@1.0.0
1.10.3

Open the chart page →

14,559
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
yaml@1.10.2
1.10.3

Open the chart page →

3,769
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.4.11787550d2358
yaml@1.10.0
1.10.3

Open the chart page →

13,852
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
yaml@2.7.0
2.8.3

Open the chart page →

2,529
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
yaml@1.10.2
1.10.3

Open the chart page →

4,551
dumpstoredumpstore0.1.12 of 2See more

dumpstore dumpstore 0.1.1

2 of the 2 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
yaml@2.8.0
2.8.3
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
yaml@2.5.1
2.8.3

Open the chart page →

4,251
frontend-charteks-3-tier-app-chart0.1.01 of 1See more

frontend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
arfath29/3-tier-app-frontend:latest384b3e377f47
yaml@1.10.2
1.10.3

Open the chart page →

3,744
blobscanethereum-helm-chartsVerified publisher0.1.11 of 1See more

blobscan ethereum-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ethpandaops/blobscan:latest7a9ab6370657
yaml@1.10.2
1.10.3

Open the chart page →

1,329
lodestarethereum-helm-chartsVerified publisher1.2.21 of 2See more

lodestar ethereum-helm-charts 1.2.2

1 of the 2 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
chainsafe/lodestar:latest5593f6e97912
yaml@2.7.0
2.8.3

Open the chart page →

2,522
onboarding-faucetethersphereVerified publisher0.2.01 of 1See more

onboarding-faucet ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ethersphere/onboarding-faucet:0.3.0513154aab230
yaml@1.10.2
1.10.3

Open the chart page →

3,320
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
yaml@2.3.4
2.8.3

Open the chart page →

4,650
qryn-helmgigapipeVerified publisher0.1.91 of 1See more

qryn-helm gigapipe 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
qxip/qryn:3.2.3977acc9c7a9fd
yaml@1.10.2
1.10.3

Open the chart page →

2,973
Governify-Bluejaygovernify0.1.05 of 12See more

Governify-Bluejay governify 0.1.0

5 of the 12 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
yaml@1.10.2
1.10.3
governify/director:v1.4.0608c6940bb98
yaml@1.10.2
1.10.3
governify/registry:v3.4.0d3f37f4f8168
yaml@1.10.0
1.10.3
governify/render:v2.2.0daeca1ce28e6
yaml@1.10.2
1.10.3
governify/reporter:v2.2.038595913458f
yaml@1.10.2
1.10.3

Open the chart page →

22,512
Governify-Falcongovernify0.1.06 of 10See more

Governify-Falcon governify 0.1.0

6 of the 10 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
yaml@1.10.2
1.10.3
governify/collector-dynamic:v1.3.06d3d1a5b46a9
yaml@1.10.2
1.10.3
governify/director:v1.4.0608c6940bb98
yaml@1.10.2
1.10.3
governify/registry:v3.4.0d3f37f4f8168
yaml@1.10.0
1.10.3
governify/render:v2.2.0daeca1ce28e6
yaml@1.10.2
1.10.3
governify/reporter:v2.2.038595913458f
yaml@1.10.2
1.10.3

Open the chart page →

24,319
hive-appgraphql-hive1.0.01 of 1See more

hive-app graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
yaml@1.10.2
1.10.3

Open the chart page →

2,682
hive-appgraphql-hive-subcharts1.0.01 of 1See more

hive-app graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
yaml@1.10.2
1.10.3

Open the chart page →

2,682
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
yaml@2.7.0
2.8.3

Open the chart page →

2,950
lobe-chathelm-charts-darox0.1.561 of 1See more

lobe-chat helm-charts-darox 0.1.56

1 of the 1 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
lobehub/lobe-chat:1.96.9da0c21fefcd3
yaml@2.8.0
2.8.3

Open the chart page →

666
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
yaml@1.10.0
1.10.3

Open the chart page →

8,213
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
yaml@1.10.2
1.10.3

Open the chart page →

5,769
townsquarehuscker-chartsVerified publisher1.0.41 of 2See more

townsquare huscker-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
yaml@1.10.2
1.10.3

Open the chart page →

3,407
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-33532.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
yaml@1.10.2
1.10.3

Open the chart page →

11,812

Container images carrying it

177 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
yaml@2.7.1
2.8.3
1
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
yaml@1.10.2
1.10.3
1
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
yaml@2.5.0
2.8.3
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
yaml@2.8.2
2.8.3
1
ghcr.io/m0nsterrr/hyperglass:v2.0.4f7b5d20c5e42
yaml@1.10.2
1.10.3
1
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
yaml@2.3.4
2.8.3
1
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
yaml@2.8.0
2.8.3
1
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
yaml@2.5.1
2.8.3
1
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
yaml@1.10.2
1.10.3
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
yaml@1.10.2
1.10.3
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
yaml@2.4.0
2.8.3
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
yaml@2.7.0
2.8.3
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
yaml@1.10.2
1.10.3
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
yaml@1.10.0
1.10.3
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
yaml@1.10.2
1.10.3
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
yaml@2.5.0
2.8.3
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
yaml@1.10.2
1.10.3
1
ghcr.io/tale/headplane:0.5.50dbc52cffc19
yaml@2.7.0
2.8.3
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
yaml@2.8.0
2.8.3
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
yaml@1.10.2
1.10.3
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
yaml@2.8.0
2.8.3
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
yaml@1.8.2
1.10.3
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
yaml@1.10.0
1.10.3
1
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
yaml@2.8.2
2.8.3
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
yaml@2.8.0
2.8.3
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-events:prod470da8f8730c
yaml@2.8.2
2.8.3
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbce6d452ad08
yaml@2.8.2
2.8.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.