StackRadarChart IndexLive demo

CVE-2026-44494

High

Advisory

Published 29 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.010; 61st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 159; of 17,781 indexed, latest versions
Container images: 159; deployed by those charts
Fix available: 1 of 1; affected package

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Carried by container images the latest versions of 159 of 17,781 indexed charts deploy, on 159 images.

Affected package	Affected versions	Fixed in	Images
axiosnpm	1.1.3, 1.2.1, 1.2.2, 1.2.5+38 more	1.16.0	159

OSV records: GHSA-35jp-ww65-95wh

Charts affected

159 by stars

Chart

Latest

Affected images

Radar Score

unleash-enterpriseunleash

1 of 1 See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-44494.

Container image	Digest	Package	Fixed in
unleashorg/unleash-enterprise :7.5.0	245aeba40053	axios@1.13.6	1.16.0

Open the chart page →

2,028

kenerunxwares

1 of 1 See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-44494.

Container image	Digest	Package	Fixed in
rajnandan1/kener :3.2.19	30407afca731	axios@1.8.3	1.16.0

Open the chart page →

5,228

evolution-apivcnngr

1 of 5 See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-44494.

Container image	Digest	Package	Fixed in
evoapicloud/evolution-api :latest	966625532d90	axios@1.13.2	1.16.0

Open the chart page →

3,746

homarrvhdirk

1 of 1 See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-44494.

Container image	Digest	Package	Fixed in
ghcr.io/ajnart/homarr :latest	e103abadfb52	axios@1.7.4	1.16.0

Open the chart page →

2,789

sirenwateim

1 of 1 See more

5,984

wazuhwazuh-helm-eks

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-44494.

Container image	Digest	Package	Fixed in
wazuh/wazuh-dashboard :4.14.4	91c8d793746f	axios@1.12.2	1.16.0

Open the chart page →

5,484

wikiwikijs

1 of 2 See more

5,459

kibanawiremind

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-44494.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	axios@1.8.3	1.16.0

Open the chart page →

6,285

workadventureworkadventure

4 of 9 See more

workadventure workadventure 1.1.0

4 of the 9 container images this version deploys carry CVE-2026-44494.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-back :v1.17.7	64001369dad5	axios@1.3.5	1.16.0
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	axios@1.3.5	1.16.0
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	axios@1.3.5	1.16.0
thecodingmachine/workadventure-uploader :v1.17.7	3ccd467543b3	axios@1.3.5	1.16.0

Open the chart page →

16,083

Container images carrying it

159 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/wundergraph/cosmo/controlplane :0.133.1	49800ff775f3	axios@1.8.4	1.16.0	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	axios@1.6.1	1.16.0	1
quay.io/hedgedoc/hedgedoc :1.10.8	abdb6b08815d	axios@1.15.0	1.16.0	1
quay.io/mittwald/kube-mail :latest	04f1099241fc	axios@1.10.0	1.16.0	1
quay.io/soketi/k8soketi :0.1-18-debian	4cd9ea9434c4	axios@1.1.3	1.16.0	1
quay.io/wraft/wraft-frontend :latest	f1bbbd5e9bb9	axios@1.11.0	1.16.0	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend :1.0.31	c7afac3446d6	axios@1.13.6	1.16.0	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	axios@1.9.0	1.16.0	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user :1.0.31	d8a9cd4e1ae3	axios@1.13.6	1.16.0	1