StackRadar

CVE-2026-41988

High

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
603
of 17,787 indexed, latest versions
Container images
602
deployed by those charts
Fix available
1 of 2
affected packages

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Carried by container images the latest versions of 603 of 17,787 indexed charts deploy, on 602 images.

Affected packageAffected versionsFixed inImages
uuidnpm2.0.2, 2.0.3, 3.0.1, 3.1.0+15 more11.1.1, 13.0.1600
node-uuiddeb1.4.0-1, 1.4.7-5, 3.3.2-2, 8.3.2+~8.3.3-4+1 moreno fix listed7
OSV records
GHSA-w5hq-g745-h8pqDEBIAN-CVE-2026-41988UBUNTU-CVE-2026-41988
Also known as
CVE-2026-41907

Charts affected

603 by stars
ChartLatestAffected imagesRadar Score
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
uuid@9.0.0
11.1.1

Open the chart page →

9,381
helloworldyotron-helm-charts0.1.01 of 1See more

helloworld yotron-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
a5hut0sh/helloworld:1.02ae77620e616
uuid@3.3.2
11.1.1

Open the chart page →

1,309
alertmanager-matrix-forwarderzloi-space1.0.11 of 2See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
zl0i/alertmanager-matrix-forwarder:v1.0.0e94047931739
uuid@3.4.0
11.1.1

Open the chart page →

3,118

Container images carrying it

602 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
openwhisk/alarmprovider:2.2.0b695a6ceb406
uuid@3.4.0
11.1.1
1
openwhisk/ow-utils:1.0.0c80dba0de3aa
node-uuid@1.4.7-5
no fix listed
1
oryd/hive-selfservice-ui-node:v0.0.426347ef0a2de
uuid@3.3.2
11.1.1
1
oryd/kratos-selfservice-ui-node:v0.13.0-20d454c21c11bc
uuid@3.4.0
11.1.1
1
otwld/velero-ui:0.10.2d1954b759e47
uuid@13.0.0
13.0.1
1
outlinewiki/outline:0.82.0494dfb9249a6
uuid@9.0.1
11.1.1
1
pachyderm/grpc-proxy:0.4.92b27f41d4d02
uuid@3.3.2
11.1.1
1
parithoshj/testnet-faucet:9859e0dcdca426fea6d
uuid@3.3.3
11.1.1
1
patdada/bella-docker:v1.0.075127147a624
uuid@3.4.0
11.1.1
1
patrickhulce/lhci-server:0.8.174b4b6a3954d
uuid@3.3.2
11.1.1
1
pawelmalak/flame:2.1.193e7b0abb603
uuid@8.3.2
11.1.1
1
pawelmalak/flame:multiarch2.3.19f88b17692a0
uuid@8.3.2
11.1.1
1
phntom/camo:2.3.1a9b1304d6c71
uuid@3.3.3
11.1.1
1
phntom/codimd:2.4.31b9aafbb62e6
uuid@3.4.0
11.1.1
1
plumdog/db-operator:latest0c2fa2db0357
uuid@3.4.0
11.1.1
1
polonel/trudesk:1.2.60cf6513f6fe3
uuid@3.3.2
11.1.1
1
project2team4/react:latest3ff031a08887
uuid@3.3.3
11.1.1
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
uuid@9.0.1
11.1.1
1
rakii8585/angular-node-webapp:latest026082a515ac
uuid@3.3.3
11.1.1
1
redis/redisinsight:2.68019fcf774631
uuid@8.3.2
11.1.1
1
redis/redisinsight:3.2.055542a762210
uuid@11.1.0
11.1.1
1
redis/redisinsight:2.46699d341bd329
uuid@9.0.0
11.1.1
1
redis/redisinsight:3.485562d67a912
uuid@11.1.0
11.1.1
1
refar/apm-portal:v5.7.1dcca8e4477a6
uuid@3.3.3
11.1.1
1
requarks/wiki:canary-2.5.2438b5865a7386c
uuid@7.0.3
11.1.1
1
rlex/jsonvisio:1.9.5cd50ff65118e
uuid@3.3.3
11.1.1
1
roadiehq/community-backstage-image:latestef355bf5b639
uuid@3.3.3
11.1.1
1
robotshop/rs-cart:latest388349d5cb3c
uuid@3.3.3
11.1.1
1
robotshop/rs-catalogue:latestd545747c1b97
uuid@3.4.0
11.1.1
1
robotshop/rs-user:latestea509182c180
uuid@3.3.3
11.1.1
1
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
uuid@8.3.2
11.1.1
1
saidsef/aws-kinesis-local:v2026.0667025e3a163e
uuid@7.0.3
11.1.1
1
samajh/alprfrontend:latest05ef4fddbb75
uuid@3.4.0
11.1.1
1
shahanafarooqui/rtl:0.11.0d0cd3d868aca
uuid@3.4.0
11.1.1
1
shinobisystems/shinobi:dev3ca746937856
uuid@3.4.0
11.1.1
1
shinobisystems/shinobi:latestc2f5ce2e1067
uuid@8.3.2
11.1.1
1
shyamkrishna21/cloudvault:latestaf2785f5bb71
uuid@8.3.2
11.1.1
1
shyamkrishna21/shopsync:latest3998b83def53
uuid@8.3.2
11.1.1
1
sigp/siren:v3.0.42c219b04758e
uuid@9.0.1
11.1.1
1
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
uuid@8.3.2
11.1.1
1
slagattollas/server-practica:latest6dd8ead8e2b1
uuid@3.3.3
11.1.1
1
slagattollas/weatherservice-practica:latest68e7f56393fc
uuid@3.3.3
11.1.1
1
snyk/kubernetes-monitor:2.23.26fb5ad76ce84e
uuid@3.4.0
11.1.1
1
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
uuid@9.0.1
11.1.1
1
socialmediamacroscope/smile_server:0.3.31a528c794270
uuid@3.4.0
11.1.1
1
solidproject/community-server:6.0.2ccc4acb7e9a1
uuid@8.3.2
11.1.1
1
someblackmagic/alertmanager-to-alerta-bot:latest78bf43744ea5
uuid@8.3.2
11.1.1
1
someblackmagic/alert-mapper:v0.1.088351d85c04c
uuid@8.3.2
11.1.1
1
soulteary/cronicle:0.9.80ac2512fa6e39
uuid@3.3.2
11.1.1
1
speckle/speckle-preview-service:2.26.3092384dba45d
uuid@8.3.2
11.1.1
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.