StackRadar

CVE-2026-3449

Low

Advisory

Published 3 Mar 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
3.3
base score, highest
EPSS
0.001
2nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
366
of 17,781 indexed, latest versions
Container images
358
deployed by those charts
Fix available
1 of 1
affected package

@tootallnate/once vulnerable to Incorrect Control Flow Scoping

Carried by container images the latest versions of 366 of 17,781 indexed charts deploy, on 358 images.

Affected packageAffected versionsFixed inImages
@tootallnate/oncenpm1.1.2, 2.0.0, 3.0.02.0.1, 3.0.1358
OSV records
GHSA-vpq2-c234-7xj6

Charts affected

366 by stars
ChartLatestAffected imagesRadar Score
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

1,991
actualbeluga-cloudVerified publisher2.0.01 of 1See more

actual beluga-cloud 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/beluga-cloud/actual/actualserver:23.12.1c8a0d5ec5a12
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

1,262
opensearch-dashboardscaptnbpVerified publisher2.2.11 of 1See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

1,843
skoonerchristianhuthVerified publisher0.4.01 of 1See more

skooner christianhuth 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

1,341
squestchristianhuthVerified publisher6.6.71 of 4See more

squest christianhuth 6.6.7

1 of the 4 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

9,971
data-fairdata354-helmVerified publisher1.1.26 of 12See more

data-fair data354-helm 1.1.2

6 of the 12 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
@tootallnate/once@2.0.0
2.0.1
ghcr.io/data-fair/metrics:0a8d40779eeae
@tootallnate/once@2.0.0
2.0.1
ghcr.io/data-fair/notify:3c739b74dabb0
@tootallnate/once@2.0.0
2.0.1
ghcr.io/data-fair/portals:18b621866ceb2
@tootallnate/once@2.0.0
2.0.1
ghcr.io/data-fair/processings:15a9216989707
@tootallnate/once@2.0.0
2.0.1
ghcr.io/data-fair/simple-directory:438a4f32fad82
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

38,346
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

5,056
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

7,473
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

3,925
enbuildenbuildVerified publisher0.0.501 of 6See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

31,510
taigafermosit0.0.111 of 7See more

taiga fermosit 0.0.11

1 of the 7 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
taigaio/taiga-events:latest92fc0822564f
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

8,496
foundryvttgeek-cookbookVerified publisher3.4.21 of 1See more

foundryvtt geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
felddy/foundryvtt:0.8.36c5d90b90349
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

2,042
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

4,260
homebridgegeek-cookbookVerified publisher5.3.21 of 1See more

homebridge geek-cookbook 5.3.2

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

15,653
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

3,444
sendgeek-cookbookVerified publisher1.2.21 of 1See more

send geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
registry.gitlab.com/timvisee/send:v3.4.2047986cf6ef69
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

1,148
uptime-kumageek-cookbookVerified publisher1.4.21 of 1See more

uptime-kuma geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.17.1a4eab252e5a2
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

5,079
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

4,196
elasticinseefrlab2.2.01 of 2See more

elastic inseefrlab 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
library/kibana:7.17.3e2e2031c15be
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

17,284
todo-appjunktext-direct1.1.41 of 1See more

todo-app junktext-direct 1.1.4

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
junktext/getting-started:1.0.5a70936c04aed
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

3,369
dashykrzwiatrzyk1.0.01 of 1See more

dashy krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

3,143
lifecycle-jira-integrationlifecycle-jira-integration1.0.01 of 1See more

lifecycle-jira-integration lifecycle-jira-integration 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
anoopnair/lifecycle-jira-integration:latestd80c73a6089d
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

927
jspolicyloftVerified publisher0.2.21 of 1See more

jspolicy loft 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
loftsh/jspolicy:0.2.225deb9bd2683
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

2,309
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

2,575
tristian-idnonkronk0.1.31 of 1See more

tristian-id nonkronk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
nonkronk/tristian-id:latest0a3694d70647
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

1,105
open-api-discoveryopen-api-discoveryVerified publisher0.1.11 of 1See more

open-api-discovery open-api-discovery 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
lukasreining/open-api-schema-collector:0.1.050e021c42e33
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

2,473
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

6,883
pdf-editor-helmpdf-editor-web1.0.01 of 4See more

pdf-editor-helm pdf-editor-web 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
dipugodocker/pdf-editor:1.0-frontendd431c37fe1cd
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

4,206
portraitportraitVerified publisher0.2.132 of 8See more

portrait portrait 0.2.13

2 of the 8 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
codercom/code-server:4.11.0-debian1e2cc688008e
@tootallnate/once@2.0.0
2.0.1
treskon/portrait-ui:DEV-lateste7970783bc8d
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

31,844
pumejwebapppumejnodejswebapp0.1.01 of 1See more

pumejwebapp pumejnodejswebapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
pumejlab/nodejs-webapp:latestf563eabcb819
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

1,164
flamerlex0.3.01 of 1See more

flame rlex 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
pawelmalak/flame:2.1.193e7b0abb603
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

2,449
kibanaromanow-helm-chartsVerified publisher1.7.11 of 1See more

kibana romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
library/kibana:7.17.8c5781ba340ef
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

6,879
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

2,823
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

38,107
speckle-serverspeckleVerified publisher2.26.32 of 4See more

speckle-server speckle 2.26.3

2 of the 4 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.26.3092384dba45d
@tootallnate/once@2.0.0
2.0.1
speckle/speckle-server:2.26.379f14a2bf931
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

10,380
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

12,581
taigaunxwaresVerified publisher2026.3.81 of 6See more

taiga unxwares 2026.3.8

1 of the 6 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
taigaio/taiga-events:latest92fc0822564f
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

9,148
tdarrvhdirkVerified publisher5.0.51 of 2See more

tdarr vhdirk 5.0.5

1 of the 2 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
haveagitgat/tdarr_node:2.17.013ff0913202dd
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

26,657
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

3,833
youtubedl-materialyoutubedl-materialVerified publisher0.0.11 of 1See more

youtubedl-material youtubedl-material 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:latest2f943d584711
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

9,783
admin-portaladmin-web-portal1.2.11 of 2See more

admin-portal admin-web-portal 1.2.1

1 of the 2 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
soulou2019/node-server:latest5e6ecfcc109e
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

3,419
activepiecesadnoctemVerified publisher0.5.01 of 1See more

activepieces adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
activepieces/activepieces:0.90.430c10a04fe3d
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

1,055
lhciadnoctemVerified publisher0.1.01 of 1See more

lhci adnoctem 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

1,248
uptime-kumaadnoctemVerified publisher0.4.11 of 1See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

30,028
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
@tootallnate/once@1.1.2
2.0.1

Open the chart page →

3,437
lametric-nightscout-proxyaolde0.1.01 of 1See more

lametric-nightscout-proxy aolde 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/aolde/lametric-nightscout-proxy:latest7d1951b6baf5
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

1,186
apimap-developerapimapOfficialVerified publisher1.4.11 of 1See more

apimap-developer apimap 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
apimap/developer:v1.3.1406d3858e20c
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

2,353
apimap-portalapimapOfficialVerified publisher2.4.01 of 1See more

apimap-portal apimap 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
apimap/portal:v2.4.0041a4790c65c
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

2,396
mongo-uiappscodeVerified publisher2026.3.301 of 1See more

mongo-ui appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/kubedb/mongo-gui:latestee0354b7a57a
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

912
arma-reforgerarma-reforger0.5.31 of 8See more

arma-reforger arma-reforger 0.5.3

1 of the 8 container images this version deploys carry CVE-2026-3449.

Container imageDigestPackageFixed in
ghcr.io/brittonhayes/arma-reforger:latest6fde1edc0983
@tootallnate/once@2.0.0
2.0.1

Open the chart page →

23,353

Container images carrying it

358 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
@tootallnate/once@2.0.0
2.0.1
1
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
@tootallnate/once@1.1.2
2.0.1
1
quay.io/soketi/soketi:1.6-16-debian713223456cf1
@tootallnate/once@2.0.0
2.0.1
1
quay.io/wekan/wekan:v5.65cb17600883a3
@tootallnate/once@1.1.2
2.0.1
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
@tootallnate/once@2.0.0
2.0.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
@tootallnate/once@1.1.2
2.0.1
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbce6d452ad08
@tootallnate/once@2.0.0
2.0.1
1
registry.gitlab.com/timvisee/send:v3.4.2047986cf6ef69
@tootallnate/once@2.0.0
2.0.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.