StackRadar

CVE-2026-41988

High

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
603
of 17,787 indexed, latest versions
Container images
602
deployed by those charts
Fix available
1 of 2
affected packages

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Carried by container images the latest versions of 603 of 17,787 indexed charts deploy, on 602 images.

Affected packageAffected versionsFixed inImages
uuidnpm2.0.2, 2.0.3, 3.0.1, 3.1.0+15 more11.1.1, 13.0.1600
node-uuiddeb1.4.0-1, 1.4.7-5, 3.3.2-2, 8.3.2+~8.3.3-4+1 moreno fix listed7
OSV records
GHSA-w5hq-g745-h8pqDEBIAN-CVE-2026-41988UBUNTU-CVE-2026-41988
Also known as
CVE-2026-41907

Charts affected

603 by stars
ChartLatestAffected imagesRadar Score
ethereumjsethereum-helm-chartsVerified publisher0.1.21 of 2See more

ethereumjs ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
ethpandaops/ethereumjs:masterfb84b718500f
uuid@11.1.0
11.1.1

Open the chart page →

1,442
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
uuid@9.0.1
11.1.1

Open the chart page →

11,483
taigafermosit0.0.111 of 7See more

taiga fermosit 0.0.11

1 of the 7 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
taigaio/taiga-events:latest92fc0822564f
uuid@8.3.2
11.1.1

Open the chart page →

8,520
ranetogabisonfire0.1.21 of 1See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
uuid@3.4.0
11.1.1

Open the chart page →

2,519
foundryvttgeek-cookbookVerified publisher3.4.21 of 1See more

foundryvtt geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
felddy/foundryvtt:0.8.36c5d90b90349
uuid@3.4.0
11.1.1

Open the chart page →

2,042
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
uuid@8.3.2
11.1.1

Open the chart page →

4,260
homebridgegeek-cookbookVerified publisher5.3.21 of 1See more

homebridge geek-cookbook 5.3.2

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
uuid@8.3.2
11.1.1

Open the chart page →

15,717
magic-mirrorgeek-cookbookVerified publisher4.4.21 of 1See more

magic-mirror geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
bastilimbach/docker-magicmirror:v2.15.041b0835ab31e
uuid@8.3.2
11.1.1

Open the chart page →

4,405
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
uuid@2.0.2
11.1.1

Open the chart page →

3,444
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
uuid@3.4.0
11.1.1

Open the chart page →

7,801
sendgeek-cookbookVerified publisher1.2.21 of 1See more

send geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
registry.gitlab.com/timvisee/send:v3.4.2047986cf6ef69
uuid@3.3.2
11.1.1

Open the chart page →

1,148
tdarrgeek-cookbookVerified publisher4.6.21 of 2See more

tdarr geek-cookbook 4.6.2

1 of the 2 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
haveagitgat/tdarr_node:2.00.101e3f9328327d
uuid@3.3.3
11.1.1

Open the chart page →

31,178
uptime-kumageek-cookbookVerified publisher1.4.21 of 1See more

uptime-kuma geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.17.1a4eab252e5a2
uuid@3.4.0
11.1.1

Open the chart page →

5,079
uptimerobotgeek-cookbookVerified publisher3.0.41 of 1See more

uptimerobot geek-cookbook 3.0.4

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
billimek/node-influx-uptimerobot:latest5814f0bcf5ba
uuid@3.2.1
11.1.1

Open the chart page →

1,669
youtubedl-materialgeek-cookbookVerified publisher4.4.21 of 1See more

youtubedl-material geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.23720b856bd2f
uuid@3.4.0
11.1.1

Open the chart page →

4,410
zigbee2mqttgeek-cookbookVerified publisher9.4.21 of 1See more

zigbee2mqtt geek-cookbook 9.4.2

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
koenkk/zigbee2mqtt:1.19.15f9129b1ffbc
uuid@3.3.3
11.1.1

Open the chart page →

2,173
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
uuid@8.3.2
11.1.1

Open the chart page →

3,135
ghostgroundhog2k0.212.121 of 1See more

ghost groundhog2k 0.212.12

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
uuid@9.0.1
11.1.1

Open the chart page →

1,948
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
uuid@8.3.2
11.1.1

Open the chart page →

4,196
openprojecthomeenterpriseinc0.5.01 of 1See more

openproject homeenterpriseinc 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
openproject/community:12.0.2734743d11094
uuid@3.3.3
11.1.1

Open the chart page →

6,810
pdc-portali4trustVerified publisher2.3.21 of 1See more

pdc-portal i4trust 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
i4trust/pdc-portal:2.0.03e77858e1219
uuid@3.4.0
11.1.1

Open the chart page →

2,723
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
uuid@11.1.0
11.1.1

Open the chart page →

15,749
elasticinseefrlab2.2.01 of 2See more

elastic inseefrlab 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
library/kibana:7.17.3e2e2031c15be
uuid@3.4.0
11.1.1

Open the chart page →

17,365
todo-appjunktext-direct1.1.41 of 1See more

todo-app junktext-direct 1.1.4

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
junktext/getting-started:1.0.5a70936c04aed
uuid@3.4.0
11.1.1

Open the chart page →

3,369
keycloak-reporterkeycloak-reporterVerified publisher1.4.151 of 1See more

keycloak-reporter keycloak-reporter 1.4.15

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
uuid@10.0.0
11.1.1

Open the chart page →

1,270
dashykrzwiatrzyk1.0.01 of 1See more

dashy krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
uuid@8.3.2
11.1.1

Open the chart page →

3,143
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
uuid@3.4.0
11.1.1

Open the chart page →

20,424
chibisafel4gVerified publisher0.1.11 of 3See more

chibisafe l4g 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
chibisafe/chibisafe-server:latest3da4fcbc1a18
uuid@9.0.1
11.1.1

Open the chart page →

5,657
actualbudgetm0nsterrr-actualbudgetVerified publisher2.10.01 of 1See more

actualbudget m0nsterrr-actualbudget 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
actualbudget/actual-server:26.9.0552beab3dec8
uuid@8.3.2
11.1.1

Open the chart page →

1,102
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
uuid@3.4.0
11.1.1

Open the chart page →

5,941
Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher1.0.12 of 6See more

Practica_4_Recuperacion_helm mca-03-02-practica4-recuperacion 1.0.1

2 of the 6 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
fjvela/urjc-fjvela-external-service:1.0.1a8ebe5ca13fc
uuid@3.3.3
11.1.1
fjvela/urjc-fjvela-server:1.0.53c840aebce22
uuid@3.3.3
11.1.1

Open the chart page →

19,192
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
uuid@8.3.2
11.1.1

Open the chart page →

13,763
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
uuid@10.0.0
11.1.1

Open the chart page →

2,576
kuttone-acre-fundVerified publisher0.2.51 of 1See more

kutt one-acre-fund 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
kutt/kutt:latestfa3d24a89b04
uuid@8.3.2
11.1.1

Open the chart page →

454
open5gs-webuiopen5gs-webuiVerified publisher2.3.11 of 2See more

open5gs-webui open5gs-webui 2.3.1

1 of the 2 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
uuid@3.1.0
11.1.1

Open the chart page →

5,300
open-api-discoveryopen-api-discoveryVerified publisher0.1.11 of 1See more

open-api-discovery open-api-discovery 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
lukasreining/open-api-schema-collector:0.1.050e021c42e33
uuid@8.3.2
11.1.1

Open the chart page →

2,473
openccuopenccuVerified publisher3.89.91 of 1See more

openccu openccu 3.89.9

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
ghcr.io/openccu/openccu:3.89.9.20260914eaeefd355dca
uuid@8.0.0
11.1.1

Open the chart page →

1,405
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
uuid@8.3.2
11.1.1

Open the chart page →

6,890
patchworkpatchworkVerified publisher0.8.61 of 2See more

patchwork patchwork 0.8.6

1 of the 2 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/patchwork:mainc01e018bced4
uuid@8.3.2
11.1.1

Open the chart page →

2,084
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
uuid@8.3.2
11.1.1

Open the chart page →

7,075
camophntom0.1.11 of 1See more

camo phntom 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
phntom/camo:2.3.1a9b1304d6c71
uuid@3.3.3
11.1.1

Open the chart page →

1,217
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
codercom/code-server:4.11.0-debian1e2cc688008e
uuid@8.3.2
11.1.1

Open the chart page →

31,949
psa-restricted-patcherpsa-restricted-patcherVerified publisher0.10.11 of 1See more

psa-restricted-patcher psa-restricted-patcher 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/psa-restricted-patcher:maina53ef16b024a
uuid@3.4.0
11.1.1

Open the chart page →

1,402
laravel-octanerenoki-co1.0.01 of 1See more

laravel-octane renoki-co 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:octane-0.6.0cad83090c58f
uuid@3.3.3
11.1.1

Open the chart page →

3,634
flamerlex0.3.01 of 1See more

flame rlex 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
pawelmalak/flame:2.1.193e7b0abb603
uuid@8.3.2
11.1.1

Open the chart page →

2,449
kibanaromanow-helm-chartsVerified publisher1.7.11 of 1See more

kibana romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
library/kibana:7.17.8c5781ba340ef
uuid@3.3.2
11.1.1

Open the chart page →

6,918
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
uuid@3.4.0
11.1.1

Open the chart page →

2,823
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
uuid@8.3.2
11.1.1

Open the chart page →

38,115
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
uuid@8.3.2
11.1.1

Open the chart page →

5,214
speckle-serverspeckleVerified publisher2.26.32 of 4See more

speckle-server speckle 2.26.3

2 of the 4 container images this version deploys carry CVE-2026-41988.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.26.3092384dba45d
uuid@8.3.2
11.1.1
speckle/speckle-server:2.26.379f14a2bf931
uuid@9.0.1
11.1.1

Open the chart page →

10,405

Container images carrying it

602 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
openwhisk/alarmprovider:2.2.0b695a6ceb406
uuid@3.4.0
11.1.1
1
openwhisk/ow-utils:1.0.0c80dba0de3aa
node-uuid@1.4.7-5
no fix listed
1
oryd/hive-selfservice-ui-node:v0.0.426347ef0a2de
uuid@3.3.2
11.1.1
1
oryd/kratos-selfservice-ui-node:v0.13.0-20d454c21c11bc
uuid@3.4.0
11.1.1
1
otwld/velero-ui:0.10.2d1954b759e47
uuid@13.0.0
13.0.1
1
outlinewiki/outline:0.82.0494dfb9249a6
uuid@9.0.1
11.1.1
1
pachyderm/grpc-proxy:0.4.92b27f41d4d02
uuid@3.3.2
11.1.1
1
parithoshj/testnet-faucet:9859e0dcdca426fea6d
uuid@3.3.3
11.1.1
1
patdada/bella-docker:v1.0.075127147a624
uuid@3.4.0
11.1.1
1
patrickhulce/lhci-server:0.8.174b4b6a3954d
uuid@3.3.2
11.1.1
1
pawelmalak/flame:2.1.193e7b0abb603
uuid@8.3.2
11.1.1
1
pawelmalak/flame:multiarch2.3.19f88b17692a0
uuid@8.3.2
11.1.1
1
phntom/camo:2.3.1a9b1304d6c71
uuid@3.3.3
11.1.1
1
phntom/codimd:2.4.31b9aafbb62e6
uuid@3.4.0
11.1.1
1
plumdog/db-operator:latest0c2fa2db0357
uuid@3.4.0
11.1.1
1
polonel/trudesk:1.2.60cf6513f6fe3
uuid@3.3.2
11.1.1
1
project2team4/react:latest3ff031a08887
uuid@3.3.3
11.1.1
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
uuid@9.0.1
11.1.1
1
rakii8585/angular-node-webapp:latest026082a515ac
uuid@3.3.3
11.1.1
1
redis/redisinsight:2.68019fcf774631
uuid@8.3.2
11.1.1
1
redis/redisinsight:3.2.055542a762210
uuid@11.1.0
11.1.1
1
redis/redisinsight:2.46699d341bd329
uuid@9.0.0
11.1.1
1
redis/redisinsight:3.485562d67a912
uuid@11.1.0
11.1.1
1
refar/apm-portal:v5.7.1dcca8e4477a6
uuid@3.3.3
11.1.1
1
requarks/wiki:canary-2.5.2438b5865a7386c
uuid@7.0.3
11.1.1
1
rlex/jsonvisio:1.9.5cd50ff65118e
uuid@3.3.3
11.1.1
1
roadiehq/community-backstage-image:latestef355bf5b639
uuid@3.3.3
11.1.1
1
robotshop/rs-cart:latest388349d5cb3c
uuid@3.3.3
11.1.1
1
robotshop/rs-catalogue:latestd545747c1b97
uuid@3.4.0
11.1.1
1
robotshop/rs-user:latestea509182c180
uuid@3.3.3
11.1.1
1
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
uuid@8.3.2
11.1.1
1
saidsef/aws-kinesis-local:v2026.0667025e3a163e
uuid@7.0.3
11.1.1
1
samajh/alprfrontend:latest05ef4fddbb75
uuid@3.4.0
11.1.1
1
shahanafarooqui/rtl:0.11.0d0cd3d868aca
uuid@3.4.0
11.1.1
1
shinobisystems/shinobi:dev3ca746937856
uuid@3.4.0
11.1.1
1
shinobisystems/shinobi:latestc2f5ce2e1067
uuid@8.3.2
11.1.1
1
shyamkrishna21/cloudvault:latestaf2785f5bb71
uuid@8.3.2
11.1.1
1
shyamkrishna21/shopsync:latest3998b83def53
uuid@8.3.2
11.1.1
1
sigp/siren:v3.0.42c219b04758e
uuid@9.0.1
11.1.1
1
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
uuid@8.3.2
11.1.1
1
slagattollas/server-practica:latest6dd8ead8e2b1
uuid@3.3.3
11.1.1
1
slagattollas/weatherservice-practica:latest68e7f56393fc
uuid@3.3.3
11.1.1
1
snyk/kubernetes-monitor:2.23.26fb5ad76ce84e
uuid@3.4.0
11.1.1
1
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
uuid@9.0.1
11.1.1
1
socialmediamacroscope/smile_server:0.3.31a528c794270
uuid@3.4.0
11.1.1
1
solidproject/community-server:6.0.2ccc4acb7e9a1
uuid@8.3.2
11.1.1
1
someblackmagic/alertmanager-to-alerta-bot:latest78bf43744ea5
uuid@8.3.2
11.1.1
1
someblackmagic/alert-mapper:v0.1.088351d85c04c
uuid@8.3.2
11.1.1
1
soulteary/cronicle:0.9.80ac2512fa6e39
uuid@3.3.2
11.1.1
1
speckle/speckle-preview-service:2.26.3092384dba45d
uuid@8.3.2
11.1.1
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.