StackRadar

CVE-2026-41988

High

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
603
of 17,787 indexed, latest versions
Container images
602
deployed by those charts
Fix available
1 of 2
affected packages

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Carried by container images the latest versions of 603 of 17,787 indexed charts deploy, on 602 images.

Affected packageAffected versionsFixed inImages
uuidnpm2.0.2, 2.0.3, 3.0.1, 3.1.0+15 more11.1.1, 13.0.1600
node-uuiddeb1.4.0-1, 1.4.7-5, 3.3.2-2, 8.3.2+~8.3.3-4+1 moreno fix listed7
OSV records
GHSA-w5hq-g745-h8pqDEBIAN-CVE-2026-41988UBUNTU-CVE-2026-41988
Also known as
CVE-2026-41907

Charts affected

603 by stars
ChartLatestAffected imagesRadar Score
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
uuid@9.0.0
11.1.1

Open the chart page →

9,381
helloworldyotron-helm-charts0.1.01 of 1See more

helloworld yotron-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
a5hut0sh/helloworld:1.02ae77620e616
uuid@3.3.2
11.1.1

Open the chart page →

1,309
alertmanager-matrix-forwarderzloi-space1.0.11 of 2See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
zl0i/alertmanager-matrix-forwarder:v1.0.0e94047931739
uuid@3.4.0
11.1.1

Open the chart page →

3,118

Container images carrying it

602 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
wazuh/wazuh-dashboard:4.4.11787550d2358
uuid@8.3.2
11.1.1
1
wazuh/wazuh-dashboard:4.14.491c8d793746f
uuid@9.0.0
11.1.1
1
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
uuid@3.3.2
11.1.1
1
wekanteam/wekan:v4.2268a51f0327df
uuid@3.3.3
11.1.1
1
willwill/kube-slack:v4.1.1d443017aae98
uuid@3.3.2
11.1.1
1
winfred008/amazon:910a68de5b398
uuid@8.3.2
11.1.1
1
wiremind/scrapoxy:lateste7048929a676
uuid@3.1.0
11.1.1
1
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
uuid@8.3.2
11.1.1
1
ymuski/skooner:latest67819ca511b5
uuid@3.4.0
11.1.1
1
yuzutech/kroki-excalidraw:0.29.157917319ea70
uuid@9.0.1
11.1.1
1
zazuko/trifid:2.3.7054be137de70
uuid@3.4.0
11.1.1
1
zimengxiong/excalidash-backend:0.4.271273af713c91
uuid@13.0.0
13.0.1
1
zl0i/alertmanager-matrix-forwarder:v1.0.0e94047931739
uuid@3.4.0
11.1.1
1
zooz/predator:1.6f491d1f7a865
uuid@3.4.0
11.1.1
1
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
uuid@3.4.0
11.1.1
1
gcr.io/google-samples/microservices-demo/currencyservice:v0.2.349d458a3650f
uuid@3.3.3
11.1.1
1
gcr.io/google-samples/microservices-demo/paymentservice:v0.2.36eb201217a8f
uuid@8.3.2
11.1.1
1
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
uuid@8.3.2
11.1.1
1
ghcr.io/advplyr/audiobookshelf:2.32.1a52dc5db694a
uuid@8.3.2
11.1.1
1
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
uuid@9.0.1
11.1.1
1
ghcr.io/ajnart/homarr:0.13.4985456bdfb46
uuid@9.0.0
11.1.1
1
ghcr.io/ajnart/homarr:lateste103abadfb52
uuid@9.0.1
11.1.1
1
ghcr.io/aolde/lametric-nightscout-proxy:latest7d1951b6baf5
uuid@3.4.0
11.1.1
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
uuid@9.0.1
11.1.1
1
ghcr.io/backstage/backstage:latest792e262ea504
uuid@8.3.2
11.1.1
1
ghcr.io/beluga-cloud/actual/actualserver:23.12.1c8a0d5ec5a12
uuid@9.0.0
11.1.1
1
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
uuid@9.0.1
11.1.1
1
ghcr.io/bryopsida/patchwork:mainc01e018bced4
uuid@8.3.2
11.1.1
1
ghcr.io/bryopsida/psa-restricted-patcher:maina53ef16b024a
uuid@3.4.0
11.1.1
1
ghcr.io/bryopsida/syslog-portal:main3947bfd04f49
uuid@8.3.2
11.1.1
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
uuid@9.0.1
11.1.1
1
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
uuid@3.4.0
11.1.1
1
ghcr.io/colanode/server:latest7006cac874fd
uuid@9.0.1
11.1.1
1
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
uuid@8.3.2
11.1.1
1
ghcr.io/ctron/streamsheets-base:2.4.00cf25ed621e2
uuid@3.3.3
11.1.1
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
uuid@3.3.3
11.1.1
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
uuid@8.1.0
11.1.1
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
uuid@3.3.2
11.1.1
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
uuid@3.4.0
11.1.1
1
ghcr.io/curium-rocks/k8s-jacoco-operator:maina558ceae6cdb
uuid@3.4.0
11.1.1
1
ghcr.io/curium-rocks/k8s-mutating-webhook:mainaaab005242ae
uuid@3.4.0
11.1.1
1
ghcr.io/curium-rocks/k8s-validating-webhook:main8344061b2f22
uuid@3.4.0
11.1.1
1
ghcr.io/curium-rocks/kube-admission-controller-starter:maine9716966f30b
uuid@3.4.0
11.1.1
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
uuid@10.0.0
11.1.1
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
uuid@9.0.1
11.1.1
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
uuid@8.3.2
11.1.1
1
ghcr.io/data-fair/notify:3c739b74dabb0
uuid@8.3.2
11.1.1
1
ghcr.io/data-fair/processings:15a9216989707
uuid@8.3.2
11.1.1
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
uuid@8.3.2
11.1.1
1
ghcr.io/ding113/claude-code-hub:latest87f9e8a92bd7
uuid@8.3.2
11.1.1
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.