StackRadar

CVE-2026-73650

High

Advisory

Published 21 Jul 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.002
15th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
75
of 17,781 indexed, latest versions
Container images
69
deployed by those charts
Fix available
1 of 1
affected package

SVGO removeScripts plugin leaves some executable scripts intact

Carried by container images the latest versions of 75 of 17,781 indexed charts deploy, on 69 images.

Affected packageAffected versionsFixed inImages
svgonpm1.3.2, 2.8.0, 2.8.2, 3.1.0+5 more2.8.3, 3.3.4, 4.0.269
OSV records
GHSA-2p49-hgcm-8545

Charts affected

75 by stars
ChartLatestAffected imagesRadar Score
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
svgo@1.3.2
2.8.3

Open the chart page →

9,203
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
svgo@3.3.3
3.3.4

Open the chart page →

3,004
servarrservarr1.0.21 of 10See more

servarr servarr 1.0.2

1 of the 10 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
svgo@2.8.0
2.8.3

Open the chart page →

14,238
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
svgo@1.3.2
2.8.3

Open the chart page →

5,251
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
svgo@3.1.0
3.3.4

Open the chart page →

17,404
hoppscotchdeliveryheroVerified publisher0.3.21 of 1See more

hoppscotch deliveryhero 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
svgo@3.3.2
3.3.4

Open the chart page →

3,451
duplistatusduplistatusVerified publisher1.2.01 of 2See more

duplistatus duplistatus 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.4.25e594f5f09f6
svgo@4.0.1
4.0.2

Open the chart page →

1,870
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
svgo@1.3.2
2.8.3

Open the chart page →

7,579
overseerrpree-helm-chartsVerified publisher1.2.01 of 1See more

overseerr pree-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.35.06197516c9d7b
svgo@2.8.0
2.8.3

Open the chart page →

2,702
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
svgo@3.3.3
3.3.4

Open the chart page →

1,991
data-fairdata354-helmVerified publisher1.1.21 of 12See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ghcr.io/data-fair/metrics:0a8d40779eeae
svgo@1.3.2
2.8.3

Open the chart page →

38,346
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
svgo@1.3.2
2.8.3

Open the chart page →

5,056
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
svgo@4.0.1
4.0.2

Open the chart page →

7,473
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
svgo@2.8.0
2.8.3

Open the chart page →

3,925
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
svgo@1.3.2
2.8.3

Open the chart page →

3,444
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
svgo@1.3.2
2.8.3

Open the chart page →

7,801
dashykrzwiatrzyk1.0.01 of 1See more

dashy krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
svgo@1.3.2
2.8.3

Open the chart page →

3,143
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
svgo@1.3.2
2.8.3

Open the chart page →

5,940
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
svgo@3.2.0
3.3.4

Open the chart page →

31,844
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
svgo@2.8.0
2.8.3

Open the chart page →

2,823
testhubteshubVerified publisher0.1.41 of 3See more

testhub teshub 0.1.4

1 of the 3 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
testhubio/testhub-frontend:on-preme86c2db53be8
svgo@1.3.2
2.8.3

Open the chart page →

7,517
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
svgo@1.3.2
2.8.3

Open the chart page →

12,581
apimap-developerapimapOfficialVerified publisher1.4.11 of 1See more

apimap-developer apimap 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
apimap/developer:v1.3.1406d3858e20c
svgo@2.8.0
2.8.3

Open the chart page →

2,353
apimap-portalapimapOfficialVerified publisher2.4.01 of 1See more

apimap-portal apimap 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
apimap/portal:v2.4.0041a4790c65c
svgo@2.8.0
2.8.3

Open the chart page →

2,396
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
assistiot/open_api_frontend:1.0.1f11d82defc70
svgo@1.3.2
2.8.3

Open the chart page →

18,277
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
svgo@3.2.0
3.3.4

Open the chart page →

32,501
overseerrbrandan-schmitz-helm-chartsVerified publisher1.4.01 of 1See more

overseerr brandan-schmitz-helm-charts 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
linuxserver/overseerr:1.35.06108ed066d4a
svgo@2.8.0
2.8.3

Open the chart page →

3,071
developer-dashboardcloud-native-toolkit1.4.11 of 1See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
svgo@1.3.2
2.8.3

Open the chart page →

25,456
conduction-uiconduction-ui0.1.01 of 6See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
conduction/conduction-ui-app:devd591f5e6f2a9
svgo@1.3.2
2.8.3

Open the chart page →

12,907
containers-security-chartscontainers-security0.1.01 of 7See more

containers-security-charts containers-security 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
coldatom/containers-security-front:latest7c2fbbb41bcf
svgo@1.3.2
2.8.3

Open the chart page →

9,146
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
svgo@3.3.2
3.3.4

Open the chart page →

2,529
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
svgo@2.8.0
2.8.3

Open the chart page →

4,551
frontend-charteks-3-tier-app-chart0.1.01 of 1See more

frontend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
arfath29/3-tier-app-frontend:latest384b3e377f47
svgo@1.3.2
2.8.3

Open the chart page →

3,744
genieacsgenieacsVerified publisher0.5.11 of 2See more

genieacs genieacs 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
drumsergio/genieacs:1.2.16.028244054e1bf
svgo@3.3.3
3.3.4

Open the chart page →

4,259
hoppscotchhelm-charts-nr0.3.11 of 1See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
svgo@3.3.2
3.3.4

Open the chart page →

3,451
hoppscotchhoppscotch0.1.11 of 1See more

hoppscotch hoppscotch 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
svgo@3.3.2
3.3.4

Open the chart page →

3,614
townsquarehuscker-chartsVerified publisher1.0.41 of 2See more

townsquare huscker-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
svgo@2.8.0
2.8.3

Open the chart page →

3,407
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
svgo@1.3.2
2.8.3

Open the chart page →

11,812
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
svgo@3.3.3
3.3.4

Open the chart page →

2,548
kyso-frontkyso1.0.01 of 1See more

kyso-front kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
kyso/kyso-front:lateste52595c5c16f
svgo@2.8.0
2.8.3

Open the chart page →

2,685
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
svgo@2.8.0
2.8.3

Open the chart page →

3,555
frontendluiscajl0.1.71 of 1See more

frontend luiscajl 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
lavandadelpatio/frontend:latest501c3f31e0bc
svgo@1.3.2
2.8.3

Open the chart page →

3,651
mauticmautic-chartVerified publisher1.0.21 of 3See more

mautic mautic-chart 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
mautic/mautic:7-apacheeb8cc73d97e1
svgo@4.0.0
4.0.2

Open the chart page →

8,303
maxcrm-chartsmaxcrm-chartsVerified publisher1.1.2011 of 4See more

maxcrm-charts maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
svgo@1.3.2
2.8.3

Open the chart page →

5,940
sample-appmongodb-helm-charts0.1.01 of 2See more

sample-app mongodb-helm-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
svgo@1.3.2
2.8.3

Open the chart page →

6,438
sentence-collectormozilla0.1.21 of 2See more

sentence-collector mozilla 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
mozilla/sentencecollector:2.0.91da6ff5c4895
svgo@1.3.2
2.8.3

Open the chart page →

6,684
cloudcmdmy0nVerified publisher0.0.31 of 1See more

cloudcmd my0n 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
coderaiser/cloudcmd:16.6.1b34a9775c7ce
svgo@1.3.2
2.8.3

Open the chart page →

3,128
myawesomeappmyawesomapp-mitchxxx0.1.11 of 1See more

myawesomeapp myawesomapp-mitchxxx 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
mitchxxx/amazon:214e72480ec63a
svgo@2.8.0
2.8.3

Open the chart page →

2,116
myawesomeapp14myawesomeapp140.1.11 of 1See more

myawesomeapp14 myawesomeapp14 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ccjacobs14/amazon:59a9b14a6f09e
svgo@1.3.2
2.8.3

Open the chart page →

2,116
myawesomeapp-janmyawesomeapp-jan0.1.11 of 1See more

myawesomeapp-jan myawesomeapp-jan 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-73650.

Container imageDigestPackageFixed in
ooghenekaro/amazon:latest03394ba1d6d8
svgo@1.3.2
2.8.3

Open the chart page →

2,144

Container images carrying it

69 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
svgo@3.3.3
3.3.4
3
chatwoot/chatwoot:v3.1.0d530ab8c1753
svgo@1.3.2
2.8.3
2
hoppscotch/hoppscotch:2024.8.2f1da831950b7
svgo@3.3.2
3.3.4
2
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
svgo@1.3.2
2.8.3
2
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
svgo@1.3.2
2.8.3
2
0hlov3/semaphore:v1.0.050f874ec096b
svgo@2.8.0
2.8.3
1
apimap/developer:v1.3.1406d3858e20c
svgo@2.8.0
2.8.3
1
apimap/portal:v2.4.0041a4790c65c
svgo@2.8.0
2.8.3
1
arfath29/3-tier-app-frontend:latest384b3e377f47
svgo@1.3.2
2.8.3
1
assistiot/open_api_frontend:1.0.1f11d82defc70
svgo@1.3.2
2.8.3
1
baserow/baserow:1.30.1df0c42eb67e8
svgo@3.1.0
3.3.4
1
ccjacobs14/amazon:59a9b14a6f09e
svgo@1.3.2
2.8.3
1
chatwoot/chatwoot:v4.15.167ebc751c171
svgo@1.3.2
2.8.3
1
coderaiser/cloudcmd:16.6.1b34a9775c7ce
svgo@1.3.2
2.8.3
1
coldatom/containers-security-front:latest7c2fbbb41bcf
svgo@1.3.2
2.8.3
1
conduction/conduction-ui-app:devd591f5e6f2a9
svgo@1.3.2
2.8.3
1
directus/directus:12.0.29c8470ea465c
svgo@4.0.1
4.0.2
1
directus/directus:11.1.0e3c8bb975350
svgo@2.8.0
2.8.3
1
drumsergio/genieacs:1.2.16.028244054e1bf
svgo@3.3.3
3.3.4
1
fallenbagel/jellyseerr:latest4538137bc5af
svgo@2.8.0
2.8.3
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
svgo@2.8.0
2.8.3
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
svgo@1.3.2
2.8.3
1
helga09/shoes_ukr:v1.1.17999bc8b77c0
svgo@1.3.2
2.8.3
1
henrywhitaker3/speedtest-tracker:latest47159a940229
svgo@1.3.2
2.8.3
1
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
svgo@1.3.2
2.8.3
1
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
svgo@3.3.2
3.3.4
1
joplin/server:3.0-beta52af57880c0e
svgo@2.8.0
2.8.3
1
joplin/server:2.14.2-betab87564ef34e9
svgo@2.8.0
2.8.3
1
kyso/kyso-front:lateste52595c5c16f
svgo@2.8.0
2.8.3
1
lavandadelpatio/frontend:latest501c3f31e0bc
svgo@1.3.2
2.8.3
1
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
svgo@2.8.0
2.8.3
1
linuxserver/codimd:latestb801bbcf6386
svgo@1.3.2
2.8.3
1
linuxserver/overseerr:1.35.06108ed066d4a
svgo@2.8.0
2.8.3
1
lissy93/dashy:2.0.51991f7be5ed0
svgo@1.3.2
2.8.3
1
mautic/mautic:7-apacheeb8cc73d97e1
svgo@4.0.0
4.0.2
1
misskey/misskey:12.110.1e08b7c478093
svgo@1.3.2
2.8.3
1
mitchxxx/amazon:214e72480ec63a
svgo@2.8.0
2.8.3
1
mozilla/sentencecollector:2.0.91da6ff5c4895
svgo@1.3.2
2.8.3
1
ooghenekaro/amazon:latest03394ba1d6d8
svgo@1.3.2
2.8.3
1
phntom/codimd:2.4.31b9aafbb62e6
svgo@1.3.2
2.8.3
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
svgo@3.3.2
3.3.4
1
samajh/alprfrontend:latest05ef4fddbb75
svgo@1.3.2
2.8.3
1
sigp/siren:v3.0.42c219b04758e
svgo@3.3.2
3.3.4
1
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
svgo@1.3.2
2.8.3
1
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
svgo@3.3.2
3.3.4
1
testhubio/testhub-frontend:on-preme86c2db53be8
svgo@1.3.2
2.8.3
1
treskon/portrait-ui:DEV-lateste7970783bc8d
svgo@3.2.0
3.3.4
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
svgo@1.3.2
2.8.3
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
svgo@1.3.2
2.8.3
1
vlebediantsev/notes-admin-front:latest007c6670ff48
svgo@2.8.0
2.8.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.