StackRadar

CVE-2026-64649

High

Advisory

Published 22 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.3
base score, highest
EPSS
0.009
57th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
68
of 17,781 indexed, latest versions
Container images
66
deployed by those charts
Fix available
1 of 1
affected package

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Carried by container images the latest versions of 68 of 17,781 indexed charts deploy, on 66 images.

Affected packageAffected versionsFixed inImages
nextnpm14.1.1, 14.1.3, 14.1.4, 14.2.2+35 more15.5.21, 16.2.1166
OSV records
GHSA-89xv-2m56-2m9x

Charts affected

68 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
next@15.5.7
15.5.21

Open the chart page →

19,391
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
next@16.2.6
16.2.11

Open the chart page →

3,004
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
supabase/studio:20241021-9f9b08326d8070c55e9
next@14.2.13
15.5.21

Open the chart page →

23,123
umamichristianhuthVerified publisher7.13.01 of 2See more

umami christianhuth 7.13.0

1 of the 2 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
next@15.5.7
15.5.21

Open the chart page →

2,367
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
next@15.2.4
15.5.21

Open the chart page →

28,839
duplistatusduplistatusVerified publisher1.2.01 of 2See more

duplistatus duplistatus 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.4.25e594f5f09f6
next@16.2.9
16.2.11

Open the chart page →

1,870
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
instill/console:0.68.54cd70e2df5c6
next@15.4.7
15.5.21

Open the chart page →

30,816
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
next@15.5.13
15.5.21

Open the chart page →

4,016
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
next@16.2.6
16.2.11

Open the chart page →

1,991
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
next@15.5.14
15.5.21

Open the chart page →

2,770
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.2.11

Open the chart page →

1,505
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.2.11

Open the chart page →

800
chibisafel4gVerified publisher0.1.11 of 3See more

chibisafe l4g 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
chibisafe/chibisafe:latest836467a50792
next@14.3.0-canary.33
15.5.21

Open the chart page →

5,654
opentelemetry-demoopentelemetry-helmVerified publisher0.41.11 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

1 of the 34 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.0.0-frontend9505e349e140
next@16.2.10
16.2.11

Open the chart page →

22,420
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
next@14.1.3
15.5.21

Open the chart page →

31,844
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.2.11

Open the chart page →

8,158
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
next@14.2.25
15.5.21

Open the chart page →

2,823
kyoorubxkubeVerified publisher0.1.101 of 9See more

kyoo rubxkube 0.1.10

1 of the 9 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
next@14.2.5
15.5.21

Open the chart page →

30,234
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
next@15.3.3
15.5.21

Open the chart page →

5,213
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
next@15.2.3
15.5.21

Open the chart page →

11,532
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
next@14.2.26
15.5.21

Open the chart page →

5,225
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.2.11

Open the chart page →

1,269
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
next@14.2.32
15.5.21

Open the chart page →

10,090
katalogalpineworks0.1.21 of 5See more

katalog alpineworks 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/alpineworks/katalog-frontend:v1.0.734b76dcb1c10
next@14.1.4
15.5.21

Open the chart page →

4,497
chatgpt-next-webchatgpt-next-web0.1.11 of 1See more

chatgpt-next-web chatgpt-next-web 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
yidadaa/chatgpt-next-web:latesteaaa469ddeeb
next@14.1.1
15.5.21

Open the chart page →

1,977
kamaji-consoleclastixVerified publisher0.1.31 of 1See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
next@15.2.3
15.5.21

Open the chart page →

2,759
kuberay-dashboarddanchevVerified publisher0.0.51 of 1See more

kuberay-dashboard danchev 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
next@15.5.18
15.5.21

Open the chart page →

551
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
next@15.2.4
15.5.21

Open the chart page →

2,529
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
langgenius/dify-web:1.0.0d64914ff0d6d
next@14.2.15
15.5.21

Open the chart page →

19,224
documensodocumensoVerified publisher0.0.61 of 2See more

documenso documenso 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
documenso/documenso:v1.8.17f16a9449f18
next@14.2.6
15.5.21

Open the chart page →

2,862
dyff-frontenddyff-frontendVerified publisher0.20.11 of 1See more

dyff-frontend dyff-frontend 0.20.1

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/dyff-frontend:0.20.152549f52ae53
next@15.5.18
15.5.21

Open the chart page →

973
dashboardedu1.0.01 of 1See more

dashboard edu 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
sysnet4admin/dashboard:bluec5bd3bb1b5a6
next@14.2.3
15.5.21

Open the chart page →

1,344
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
next@14.2.2
15.5.21

Open the chart page →

4,650
flanksource-uiflanksourceVerified publisher1.4.3181 of 1See more

flanksource-ui flanksource 1.4.318

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.318891f21df54fb
next@15.5.20
15.5.21

Open the chart page →

2,558
mission-controlflanksourceVerified publisher0.1.3361 of 8See more

mission-control flanksource 0.1.336

1 of the 8 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
next@15.5.20
15.5.21

Open the chart page →

8,902
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.2.11

Open the chart page →

12,056
opentelemetry-demogpg-dev0.33.82 of 27See more

opentelemetry-demo gpg-dev 0.33.8

2 of the 27 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
next@14.2.5
15.5.21
ghcr.io/open-telemetry/demo:1.12.0-flagduif6bdafaa9075
next@14.2.5
15.5.21

Open the chart page →

49,025
lobe-chathelm-charts-darox0.1.561 of 1See more

lobe-chat helm-charts-darox 0.1.56

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
lobehub/lobe-chat:1.96.9da0c21fefcd3
next@15.3.4
15.5.21

Open the chart page →

666
opencuthelmforgeVerified publisher1.1.91 of 5See more

opencut helmforge 1.1.9

1 of the 5 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.2.11

Open the chart page →

3,726
self-learning-platformhelm-self-learning-platformVerified publisher1.1.01 of 1See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
devopsiaci/self-learning-platform:1.1.3d9441c931f75
next@16.1.6
16.2.11

Open the chart page →

1,468
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
next@15.5.7
15.5.21

Open the chart page →

3,441
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
next@15.4.8
15.5.21

Open the chart page →

8,405
homepagekubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

homepage kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
next@16.2.4
16.2.11

Open the chart page →

1,378
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
next@16.2.7
16.2.11

Open the chart page →

1,498
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
next@14.2.35
15.5.21

Open the chart page →

2,548
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.2.11

Open the chart page →

2,596
helm-pilotlbenicio-communityVerified publisher0.2.41 of 1See more

helm-pilot lbenicio-community 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.2.11

Open the chart page →

710
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
next@14.2.25
15.5.21

Open the chart page →

3,555
dashboardleechistest1.0.01 of 1See more

dashboard leechistest 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
sysnet4admin/dashboard:bluec5bd3bb1b5a6
next@14.2.3
15.5.21

Open the chart page →

1,344
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-64649.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
next@16.2.6
16.2.11

Open the chart page →

1,852

Container images carrying it

66 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.2.11
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
next@14.2.35
15.5.21
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
next@15.2.4
15.5.21
1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
next@15.2.4
15.5.21
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
next@15.2.4
15.5.21
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
next@15.5.9
15.5.21
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
next@15.5.7
15.5.21
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.2.11
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.2.11
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.2.11
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
next@15.2.4
15.5.21
1
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
next@14.2.5
15.5.21
1
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
next@15.5.20
15.5.21
1
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
next@15.5.18
15.5.21
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
next@14.2.32
15.5.21
1
registry.gitlab.com/dyff/dyff-frontend:0.20.152549f52ae53
next@15.5.18
15.5.21
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.