StackRadar

CVE-2026-3449

Low

Advisory

Published 3 Mar 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
3.3
base score, highest
EPSS
0.001
2nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
366
of 17,781 indexed, latest versions
Container images
358
deployed by those charts
Fix available
1 of 1
affected package

@tootallnate/once vulnerable to Incorrect Control Flow Scoping

Carried by container images the latest versions of 366 of 17,781 indexed charts deploy, on 358 images.

Affected packageAffected versionsFixed inImages
@tootallnate/oncenpm1.1.2, 2.0.0, 3.0.02.0.1, 3.0.1358
OSV records
GHSA-vpq2-c234-7xj6

Charts affected

366 by stars
ChartLatestAffected imagesRadar Score
uptime-kumauptime-kumaVerified publisher4.2.01 of 1See more

uptime-kuma uptime-kuma 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

30,159
opensearch-dashboardsopensearch-project-helm-chartsVerified publisher3.8.01 of 1See more

opensearch-dashboards opensearch-project-helm-charts 3.8.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.8.0ca28e40a095f
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

280
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

11,384
stacks-blockchain-apihirosystemsVerified publisher6.5.11 of 5See more

stacks-blockchain-api hirosystems 6.5.1

1 of the 5 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

8,364
outlineoutline0.0.91 of 4See more

outline outline 0.0.9

1 of the 4 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

4,431
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

5,352
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

3,004
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
supabase/postgres-meta:v0.84.2d0a96973e9f1
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

23,123
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

5,639
sorry-cypresssorry-cypressVerified publisher1.20.02 of 4See more

sorry-cypress sorry-cypress 1.20.0

2 of the 4 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
agoldis/sorry-cypress-api:2.5.11afaa5a84051d
@tootallnate/once@2.0.0
2.0.1
agoldis/sorry-cypress-director:2.5.1110228ecd353b
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

4,285
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

2,938
code-serverdeploy-code-server1.0.31 of 2See more

code-server deploy-code-server 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
codercom/code-server:3.10.247605610ad8d
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

4,577
echo-serverealenn0.5.01 of 1See more

echo-server ealenn 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ealen/echo-server:0.6.0359761caae37
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

766
homarroben01Verified publisher1.4.01 of 1See more

homarr oben01 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

2,581
umamiwaldo-visionVerified publisher0.0.11 of 1See more

umami waldo-vision 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

1,255
uptime-kumaduyet0.1.71 of 1See more

uptime-kuma duyet 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.18.5a84767d7934f
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

4,515
redisinsightheywood8-helm-chartsVerified publisher0.4.51 of 1See more

redisinsight heywood8-helm-charts 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
heywood8/redisinsight:2.28.00bc9ab313d37
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

2,828
redisinsight-secureredisinsight-secureVerified publisher1.0.21 of 1See more

redisinsight-secure redisinsight-secure 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
redis/redisinsight:2.68019fcf774631
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

1,721
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

1,339
servarrservarr1.0.21 of 10See more

servarr servarr 1.0.2

1 of the 10 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

14,238
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

6,168
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

5,251
graphql-gatewaygraphql-gatewayVerified publisher0.1.51 of 1See more

graphql-gateway graphql-gateway 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
hansehe/graphql-gateway:1.0.458e09540afbc
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

1,660
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
kyleslugg/klusterview:latestba8c36dfdfbd
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

3,795
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

10,530
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

2,654
grafana-pdf-exporterwiremindVerified publisher2.1.11 of 1See more

grafana-pdf-exporter wiremind 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

9,746
code-serveralekcVerified publisher0.1.11 of 1See more

code-server alekc 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
linuxserver/code-server:4.10.1a5e43a05ae79
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

8,212
community-solid-servercommunity-solid-server3.0.01 of 1See more

community-solid-server community-solid-server 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
solidproject/community-server:6.0.2ccc4acb7e9a1
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

1,613
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

17,404
nightscoutgabe565Verified publisher0.13.01 of 2See more

nightscout gabe565 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

2,521
audiobookshelfgeek-cookbookVerified publisher1.2.21 of 1See more

audiobookshelf geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.0.3140aed2752c3
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

1,959
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

7,579
zwavejs2mqttgeek-cookbookVerified publisher5.4.21 of 1See more

zwavejs2mqtt geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

3,476
graphql-hivegraphql-hive1.0.09 of 17See more

graphql-hive graphql-hive 1.0.0

9 of the 17 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
@tootallnate/once@2.0.0
2.0.1
ghcr.io/kamilkisiela/graphql-hive/emails:59b64c36c866b3555c135c70de76a884e63f86197d2d6d7c099a
@tootallnate/once@2.0.0
2.0.1
ghcr.io/kamilkisiela/graphql-hive/schema:59b64c36c866b3555c135c70de76a884e63f8619931d1f6e5ad4
@tootallnate/once@2.0.0
2.0.1
ghcr.io/kamilkisiela/graphql-hive/server:59b64c36c866b3555c135c70de76a884e63f86196d3899d281cc
@tootallnate/once@2.0.0
2.0.1
ghcr.io/kamilkisiela/graphql-hive/storage:59b64c36c866b3555c135c70de76a884e63f86199808dac13353
@tootallnate/once@2.0.0
2.0.1
ghcr.io/kamilkisiela/graphql-hive/tokens:59b64c36c866b3555c135c70de76a884e63f86190f3416d940b4
@tootallnate/once@2.0.0
2.0.1
ghcr.io/kamilkisiela/graphql-hive/usage:59b64c36c866b3555c135c70de76a884e63f861953619ee7614e
@tootallnate/once@2.0.0
2.0.1
ghcr.io/kamilkisiela/graphql-hive/usage-ingestor:59b64c36c866b3555c135c70de76a884e63f861947b87c071af4
@tootallnate/once@2.0.0
2.0.1
ghcr.io/kamilkisiela/graphql-hive/webhooks:59b64c36c866b3555c135c70de76a884e63f861918a5c5b5b671
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

10,311
kubeviouskubevious1.2.21 of 7See more

kubevious kubevious 1.2.2

1 of the 7 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
kubevious/collector:1.2.1f58226f9d84e
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

14,204
activepiecesmeyerchartsVerified publisher0.1.61 of 1See more

activepieces meyercharts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
activepieces/activepieces:0.23.0c26188b44e62
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

2,635
kobotoolboxone-acre-fundVerified publisher0.7.42 of 9See more

kobotoolbox one-acre-fund 0.7.4

2 of the 9 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
enketo/enketo-express:3.0.4dcad9c2273f6
@tootallnate/once@1.1.2
2.0.1
kobotoolbox/kpi:2.022.24dbcacc01bccd4
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

18,517
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

7,776
kratos-selfservice-ui-nodeory0.64.01 of 1See more

kratos-selfservice-ui-node ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
oryd/kratos-selfservice-ui-node:v26.2.046a7bac1ad0c
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

1,966
overseerrpree-helm-chartsVerified publisher1.2.01 of 1See more

overseerr pree-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.35.06197516c9d7b
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

2,702
laravelrenoki-co1.0.01 of 2See more

laravel renoki-co 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:0.6.03207f957e80c
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

6,931
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

977
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

24,488
soketisoketi2.0.01 of 1See more

soketi soketi 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
quay.io/soketi/soketi:1.6-16-debian713223456cf1
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

1,636
thingsboard-clusterthingsboard-cluster-bettaVerified publisher0.2.261 of 6See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

1 of the 6 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
thingsboard/tb-web-ui:3.6.0d388378062cc
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

14,566
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

4,016
bredbandskollen-prometheus-exporteraolde0.2.31 of 1See more

bredbandskollen-prometheus-exporter aolde 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
aolde/bredbandskollen-prometheus-exporter:1.0.2dc61ee713720
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

1,972
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

77,706
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

77,687

Container images carrying it

358 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
@tootallnate/once@2.0.0
2.0.1
1
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
@tootallnate/once@1.1.2
2.0.1
1
quay.io/soketi/soketi:1.6-16-debian713223456cf1
@tootallnate/once@2.0.0
2.0.1
1
quay.io/wekan/wekan:v5.65cb17600883a3
@tootallnate/once@1.1.2
2.0.1
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
@tootallnate/once@2.0.0
2.0.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
@tootallnate/once@1.1.2
2.0.1
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbce6d452ad08
@tootallnate/once@2.0.0
2.0.1
1
registry.gitlab.com/timvisee/send:v3.4.2047986cf6ef69
@tootallnate/once@2.0.0
2.0.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.