StackRadarChart IndexLive demo

CVE-2026-44581

Medium

Advisory

Published 11 May 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.7; base score, highest
EPSS: 0.002; 13th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 58; of 17,781 indexed, latest versions
Container images: 59; deployed by those charts
Fix available: 1 of 1; affected package

Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces

Carried by container images the latest versions of 58 of 17,781 indexed charts deploy, on 59 images.

Affected package	Affected versions	Fixed in	Images
nextnpm	13.4.12, 13.5.2, 13.5.3, 13.5.6+35 more	15.5.16, 16.2.5	59

OSV records: GHSA-ffhc-5mcf-pf4q

Charts affected

58 by stars

Chart

Latest

Affected images

Radar Score

podscopepodscope

1 of 1 See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-44581.

Container image	Digest	Package	Fixed in
ghcr.io/kadajett/podscope :0.2.3	eeedf17112d7	next@16.0.3	16.2.5

Open the chart page →

1,484

pumperlypumperly

1 of 3 See more

pumperly pumperly 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-44581.

Container image	Digest	Package	Fixed in
drumsergio/pumperly :1.4.8	85bbc3915e9e	next@16.2.2	16.2.5

Open the chart page →

2,854

kratos-selfservice-ui-noderadar-base

1 of 1 See more

kratos-selfservice-ui-node radar-base 0.43.1

1 of the 1 container images this version deploys carry CVE-2026-44581.

Container image	Digest	Package	Fixed in
oryd/kratos-selfservice-ui-node :v0.13.0-20	d454c21c11bc	next@13.5.3	15.5.16

Open the chart page →

2,969

radar-self-enrolment-uiradar-base

1 of 1 See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-44581.

Container image	Digest	Package	Fixed in
ghcr.io/radar-base/radar-self-enrolment-ui :0.1.0	b9a7cd3cc099	next@15.5.4	15.5.16

Open the chart page →

1,506

karakeeprtomik-helm-charts

1 of 3 See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-44581.

Container image	Digest	Package	Fixed in
ghcr.io/karakeep-app/karakeep :0.26.0	f575a34ed3f8	next@14.2.25	15.5.16

Open the chart page →

5,338

saleor-appstrieb-work

3 of 5 See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-44581.

Container image	Digest	Package	Fixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed :1.23.1	1d435b4ab372	next@15.2.4	15.5.16
ghcr.io/trieb-work/saleor-apps/saleor-app-search :1.24.3	28edefb6c92d	next@15.2.4	15.5.16
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp :1.4.3	57a06bfba327	next@15.2.4	15.5.16

Open the chart page →

6,994

homarrvhdirk

1 of 1 See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-44581.

Container image	Digest	Package	Fixed in
ghcr.io/ajnart/homarr :latest	e103abadfb52	next@13.5.11	15.5.16

Open the chart page →

2,789

sirenwateim

1 of 1 See more

5,984

Container images carrying it

59 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp :1.4.3	57a06bfba327	next@15.2.4	15.5.16	1
ghcr.io/umami-software/umami :3.0.3	28f263fe06f7	next@15.5.9	15.5.16	1
ghcr.io/umami-software/umami :postgresql-v2.20.1	73ca19b41745	next@15.5.7	15.5.16	1
ghcr.io/umami-software/umami :3.1.0	e3f80c0625aa	next@16.2.4	16.2.5	1
ghcr.io/wachd/wachd :0.4.18	05b05c56da94	next@16.2.4	16.2.5	1
ghcr.io/wasilak/kube-ingress-dash :0.3.1	ff55992f905c	next@16.0.3	16.2.5	1
ghcr.io/wundergraph/cosmo/studio :0.111.0	454f4384713a	next@15.2.4	15.5.16	1
ghcr.io/zoriya/kyoo_front :4.7.1	d7f76c9c65d9	next@14.2.5	15.5.16	1
quay.io/wraft/wraft-frontend :latest	f1bbbd5e9bb9	next@14.2.32	15.5.16	1