StackRadar

CVE-2026-44705

High

Advisory

Published 27 May 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.004
37th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
178
of 17,781 indexed, latest versions
Container images
174
deployed by those charts
Fix available
1 of 1
affected package

tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape

Carried by container images the latest versions of 178 of 17,781 indexed charts deploy, on 174 images.

Affected packageAffected versionsFixed inImages
tmpnpm0.0.23, 0.0.28, 0.0.29, 0.0.30+6 more0.2.6174
OSV records
GHSA-ph9p-34f9-6g65

Charts affected

178 by stars
ChartLatestAffected imagesRadar Score
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
tmp@0.2.3
0.2.6

Open the chart page →

11,384
outlineoutline0.0.91 of 4See more

outline outline 0.0.9

1 of the 4 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
tmp@0.0.33
0.2.6

Open the chart page →

4,431
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
tmp@0.0.33
0.2.6

Open the chart page →

5,352
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
tmp@0.0.33
0.2.6

Open the chart page →

5,639
lighthouse-cicowboysysopVerified publisher9.0.01 of 1See more

lighthouse-ci cowboysysop 9.0.0

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
patrickhulce/lhci-server:0.8.174b4b6a3954d
tmp@0.1.0
0.2.6

Open the chart page →

2,213
redisinsightheywood8-helm-chartsVerified publisher0.4.51 of 1See more

redisinsight heywood8-helm-charts 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
heywood8/redisinsight:2.28.00bc9ab313d37
tmp@0.0.33
0.2.6

Open the chart page →

2,828
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
tmp@0.2.1
0.2.6

Open the chart page →

6,168
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
tmp@0.2.1
0.2.6

Open the chart page →

5,251
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
tmp@0.2.1
0.2.6

Open the chart page →

8,213
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
kyleslugg/klusterview:latestba8c36dfdfbd
tmp@0.2.1
0.2.6

Open the chart page →

3,795
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
kubeflownotebookswg/centraldashboard:v1.6.137300551dea6
tmp@0.2.1
0.2.6

Open the chart page →

96,941
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
tmp@0.2.1
0.2.6

Open the chart page →

10,530
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
tmp@0.2.1
0.2.6

Open the chart page →

2,654
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
tmp@0.0.33
0.2.6

Open the chart page →

17,404
hubotdecayofmind1.0.21 of 3See more

hubot decayofmind 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
decayofmind/hubot:3.3.21e18e92fe694
tmp@0.0.33
0.2.6

Open the chart page →

2,513
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
tmp@0.0.33
0.2.6

Open the chart page →

7,579
zwavejs2mqttgeek-cookbookVerified publisher5.4.21 of 1See more

zwavejs2mqtt geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
tmp@0.0.33
0.2.6

Open the chart page →

3,476
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
tmp@0.2.1
0.2.6

Open the chart page →

10,311
kongakonga1.1.01 of 1See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
tmp@0.0.28
0.2.6

Open the chart page →

5,209
kubeviouskubevious1.2.22 of 7See more

kubevious kubevious 1.2.2

2 of the 7 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
kubevious/backend:1.2.22d9ba6eb46b6
tmp@0.2.1
0.2.6
kubevious/parser:1.2.299ae7a5168c2
tmp@0.2.1
0.2.6

Open the chart page →

14,204
bitwarden-crd-operatorlerentisVerified publisher0.18.01 of 1See more

bitwarden-crd-operator lerentis 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
ghcr.io/lerentis/bitwarden-crd-operator:0.17.00a608c6ead85
tmp@0.0.33
0.2.6

Open the chart page →

2,003
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
tmp@0.0.33
0.2.6

Open the chart page →

6,868
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
tmp@0.2.1
0.2.6

Open the chart page →

7,776
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
tmp@0.2.1
0.2.6

Open the chart page →

24,488
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
tmp@0.2.5
0.2.6

Open the chart page →

4,016
predatorzooz1.7.01 of 1See more

predator zooz 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
zooz/predator:1.6f491d1f7a865
tmp@0.0.28
0.2.6

Open the chart page →

2,851
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
tmp@0.2.1
0.2.6

Open the chart page →

77,706
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
tmp@0.2.1
0.2.6

Open the chart page →

77,687
opensearch-dashboardscaptnbpVerified publisher2.2.11 of 1See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
tmp@0.2.1
0.2.6

Open the chart page →

1,843
skoonerchristianhuthVerified publisher0.4.01 of 1See more

skooner christianhuth 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
tmp@0.2.1
0.2.6

Open the chart page →

1,341
data-fairdata354-helmVerified publisher1.1.26 of 12See more

data-fair data354-helm 1.1.2

6 of the 12 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
tmp@0.1.0
0.2.6
ghcr.io/data-fair/metrics:0a8d40779eeae
tmp@0.0.33
0.2.6
ghcr.io/data-fair/notify:3c739b74dabb0
tmp@0.0.33
0.2.6
ghcr.io/data-fair/portals:18b621866ceb2
tmp@0.0.33
0.2.6
ghcr.io/data-fair/processings:15a9216989707
tmp@0.0.33
0.2.6
ghcr.io/data-fair/simple-directory:438a4f32fad82
tmp@0.0.33
0.2.6

Open the chart page →

38,346
ethereumjsethereum-helm-chartsVerified publisher0.1.21 of 2See more

ethereumjs ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
ethpandaops/ethereumjs:masterfb84b718500f
tmp@0.0.33
0.2.6

Open the chart page →

1,442
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
tmp@0.0.33
0.2.6

Open the chart page →

4,260
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
tmp@0.0.33
0.2.6

Open the chart page →

7,801
globalpingglobalpingVerified publisher1.0.111 of 1See more

globalping globalping 1.0.11

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
globalping/globalping-probe:latest8acbd23009fd
tmp@0.0.33
0.2.6

Open the chart page →

518
dashykrzwiatrzyk1.0.01 of 1See more

dashy krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
tmp@0.0.33
0.2.6

Open the chart page →

3,143
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
tmp@0.2.4
0.2.6

Open the chart page →

2,575
open-api-discoveryopen-api-discoveryVerified publisher0.1.11 of 1See more

open-api-discovery open-api-discovery 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
lukasreining/open-api-schema-collector:0.1.050e021c42e33
tmp@0.2.1
0.2.6

Open the chart page →

2,473
flamerlex0.3.01 of 1See more

flame rlex 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
pawelmalak/flame:2.1.193e7b0abb603
tmp@0.2.1
0.2.6

Open the chart page →

2,449
testhubteshubVerified publisher0.1.41 of 3See more

testhub teshub 0.1.4

1 of the 3 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
testhubio/testhub-frontend:on-preme86c2db53be8
tmp@0.0.33
0.2.6

Open the chart page →

7,517
vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets0.0.0-main1 of 2See more

vaultwarden-kubernetes-secrets vaultwarden-kubernetes-secrets 0.0.0-main

1 of the 2 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
tmp@0.0.33
0.2.6

Open the chart page →

4,010
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
tmp@0.2.5
0.2.6

Open the chart page →

3,833
scrapoxywiremindVerified publisher0.3.41 of 1See more

scrapoxy wiremind 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
wiremind/scrapoxy:lateste7048929a676
tmp@0.0.33
0.2.6

Open the chart page →

2,154
adeptia-automate-mcpadeptia-automate-mcp1.0.01 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
tmp@0.2.5
0.2.6

Open the chart page →

3,600
lhciadnoctemVerified publisher0.1.01 of 1See more

lhci adnoctem 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
tmp@0.0.33
0.2.6

Open the chart page →

1,248
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
tmp@0.0.33
0.2.6

Open the chart page →

3,820
turborepo-remote-cacheadriantr1.1.11 of 1See more

turborepo-remote-cache adriantr 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
ducktors/turborepo-remote-cache:latest31ec9e83c844
tmp@0.2.5
0.2.6

Open the chart page →

523
akto-mini-testingakto1.45.71 of 5See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-puppeteer-replay:1.49.4_latestf1c5763d565e
tmp@0.2.5
0.2.6

Open the chart page →

6,486
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
tmp@0.2.3
0.2.6

Open the chart page →

4,880
angular-chartangular-application0.1.01 of 1See more

angular-chart angular-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-44705.

Container imageDigestPackageFixed in
ibarreche/cloud-front-ci:latestc8970ac1c8dc
tmp@0.0.30
0.2.6

Open the chart page →

3,237

Container images carrying it

174 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
mojaloop/event-sidecar:v11.0.189b8ab71b74b
tmp@0.2.1
0.2.6
5
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
tmp@0.2.1
0.2.6
4
assistiot/dlt_api:2.0.0e36a8922fa0c
tmp@0.2.1
0.2.6
3
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
tmp@0.2.1
0.2.6
3
pantsel/konga:latestc8172b75607d
tmp@0.0.28
0.2.6
3
rcdelacruz/my-strapi-app:js-amd6438007f358355
tmp@0.0.33
0.2.6
3
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
tmp@0.2.1
0.2.6
3
ethersphere/bee-localchain:latest0558799ca992
tmp@0.0.33
0.2.6
2
gjeanmart/safe-ganache-node:latest926264c8f2d1
tmp@0.0.33
0.2.6
2
governify/assets-manager:v1.4.12987672448c7
tmp@0.0.33
0.2.6
2
governify/registry:v3.4.0d3f37f4f8168
tmp@0.2.1
0.2.6
2
governify/render:v2.2.0daeca1ce28e6
tmp@0.0.33
0.2.6
2
governify/reporter:v2.2.038595913458f
tmp@0.0.33
0.2.6
2
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
tmp@0.0.28
0.2.6
2
library/arangodb:3.11.81e75d74954a4
tmp@0.0.33
0.2.6
2
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
tmp@0.2.1
0.2.6
2
mesosphere/kommander:6.100.13917e82333a9
tmp@0.2.1
0.2.6
2
migmartri/prerender:latest486aacfd5aa9
tmp@0.0.28
0.2.6
2
mojaloop/central-ledger:v13.14.01abc8a7aa71c
tmp@0.2.1
0.2.6
2
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
tmp@0.2.1
0.2.6
2
mojaloop/reporting:v12.1.0d480a62103d6
tmp@0.2.3
0.2.6
2
mojaloop/reporting-hub-bop-api-svc:v4.1.2b45a2d6f0f2a
tmp@0.0.33
0.2.6
2
outlinewiki/outline:0.69.1d060dcd8f9aa
tmp@0.0.33
0.2.6
2
requarks/wiki:2:latest68f0d1848261
tmp@0.2.5
0.2.6
2
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
tmp@0.0.33
0.2.6
2
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
tmp@0.0.33
0.2.6
2
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
tmp@0.2.5
0.2.6
1
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
tmp@0.2.3
0.2.6
1
amundsendev/amundsen-frontend:2.1.169e7915e61c1
tmp@0.0.33
0.2.6
1
arturisimo/server-urjc:v1.0d8dc4430531e
tmp@0.2.1
0.2.6
1
assistiot/dlt_api:2.1.0c8a170683be7
tmp@0.2.1
0.2.6
1
assistiot/fl_orchestrator:api-latest7473d77448e1
tmp@0.0.33
0.2.6
1
assistiot/open_api_frontend:1.0.1f11d82defc70
tmp@0.0.33
0.2.6
1
assistiot/smart-orchestrator_cluster:latest4f41e1defe99
tmp@0.2.1
0.2.6
1
assistiot/smart-orchestrator_enabler:latest89f37e88c871
tmp@0.2.1
0.2.6
1
assistiot/smart-orchestrator_repository:latesta8b8dbed04a4
tmp@0.2.1
0.2.6
1
baserow/baserow:1.30.1df0c42eb67e8
tmp@0.0.33
0.2.6
1
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
tmp@0.0.33
0.2.6
1
blockscout/blockscout:5.1.5c365a8f2dc12
tmp@0.0.33
0.2.6
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
tmp@0.2.1
0.2.6
1
catalysm/csmm:latestf003b35f54d9
tmp@0.2.1
0.2.6
1
chainsafe/lodestar:latest5593f6e97912
tmp@0.0.33
0.2.6
1
chainsafe/lodestar:v1.27.07b9fe4aa8073
tmp@0.2.1
0.2.6
1
coldatom/containers-security-api:latesteae9e82da080
tmp@0.2.1
0.2.6
1
daskdev/dask-notebook:1.1.0052630f5ca04
tmp@0.0.33
0.2.6
1
decayofmind/hubot:3.3.21e18e92fe694
tmp@0.0.33
0.2.6
1
directus/directus:11.1.0e3c8bb975350
tmp@0.0.33
0.2.6
1
documenso/documenso:v1.8.17f16a9449f18
tmp@0.2.1
0.2.6
1
ducktors/turborepo-remote-cache:latest31ec9e83c844
tmp@0.2.5
0.2.6
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
tmp@0.0.33
0.2.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.