StackRadar

CVE-2026-82562

Low

Advisory

Published 31 Aug 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
3.7
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
139
of 17,781 indexed, latest versions
Container images
127
deployed by those charts
Fix available
1 of 2
affected packages

qs array-limit bypass via bracket-key comma parsing

Carried by container images the latest versions of 139 of 17,781 indexed charts deploy, on 127 images.

Affected packageAffected versionsFixed inImages
qsnpm6.14.2, 6.15.0, 6.15.1, 6.15.2+1 more6.16.0122
node-qsdeb2.2.4-1, 2.2.4-1ubuntu1, 6.9.1+ds-1no fix listed5
OSV records
GHSA-x5fp-wj9c-mxmxUBUNTU-CVE-2026-82562

Charts affected

139 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.401 of 1See more

n8n community-charts 1.24.40

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
qs@6.15.2
6.16.0

Open the chart page →

772
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
qs@6.15.2
6.16.0

Open the chart page →

1,038
uptime-kumauptime-kumaVerified publisher4.2.01 of 1See more

uptime-kuma uptime-kuma 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
qs@6.15.3
6.16.0

Open the chart page →

30,159
backstagebackstageOfficialVerified publisher2.10.11 of 1See more

backstage backstage 2.10.1

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/backstage/backstage:latest792e262ea504
qs@6.15.3
6.16.0

Open the chart page →

1,195
rocketchatrocketchat-server7.0.24 of 12See more

rocketchat rocketchat-server 7.0.2

4 of the 12 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
rocketchat/account-service:8.6.144af8ac4e711
qs@6.15.2
6.16.0
rocketchat/authorization-service:8.6.16bc18fb5d0e5
qs@6.15.2
6.16.0
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
qs@6.15.2
6.16.0
rocketchat/presence-service:8.6.1c1170bdfe797
qs@6.15.2
6.16.0

Open the chart page →

12,279
penpotpenpotOfficialVerified publisher1.9.01 of 4See more

penpot penpot 1.9.0

1 of the 4 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
penpotapp/mcp:2.17.284f3f07ead11
qs@6.15.3
6.16.0

Open the chart page →

4,314
unleashunleash5.6.81 of 2See more

unleash unleash 5.6.8

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
unleashorg/unleash-server:7.5.09adb37e399ba
qs@6.14.2
6.16.0

Open the chart page →

2,059
verdaccioverdaccio4.35.11 of 1See more

verdaccio verdaccio 4.35.1

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
verdaccio/verdaccio:6.10.209b403888c8f
qs@6.15.3
6.16.0

Open the chart page →

215
actualbudgetcommunity-chartsVerified publisher1.9.41 of 1See more

actualbudget community-charts 1.9.4

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
actualbudget/actual-server:26.9.0552beab3dec8
qs@6.15.2
6.16.0

Open the chart page →

1,091
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
qs@6.14.2
6.16.0

Open the chart page →

5,660
velero-uiotwldVerified publisher0.15.01 of 1See more

velero-ui otwld 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
otwld/velero-ui:0.10.2d1954b759e47
qs@6.15.3
6.16.0

Open the chart page →

1,332
wekanwekanVerified publisher11.76.01 of 3See more

wekan wekan 11.76.0

1 of the 3 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/wekan/wekan:v11.764a9601847dfd
qs@6.15.3
6.16.0

Open the chart page →

1,576
budibasebudibase0.0.0-master2 of 7See more

budibase budibase 0.0.0-master

2 of the 7 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
budibase/apps:3.41.344fe6feab985
qs@6.15.1
6.16.0
budibase/worker:3.41.3de5e2e560ce8
qs@6.15.0
6.16.0

Open the chart page →

10,775
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
qs@6.15.3
6.16.0

Open the chart page →

2,938
n8nhelmforgeVerified publisher2.0.02 of 2See more

n8n helmforge 2.0.0

2 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
qs@6.15.2
6.16.0
n8nio/runners:2.38.4fedf098f3d40
qs@6.15.2
6.16.0

Open the chart page →

863
docmosthelmforgeVerified publisher1.2.111 of 4See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
docmost/docmost:0.95.041c8d777cf23
qs@6.14.2
6.16.0

Open the chart page →

5,564
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
qs@6.14.2
6.16.0

Open the chart page →

1,339
snyk-monitorsnyk2.23.261 of 2See more

snyk-monitor snyk 2.23.26

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
snyk/kubernetes-monitor:2.23.26fb5ad76ce84e
qs@6.15.3
6.16.0

Open the chart page →

578
kuttchristianhuthVerified publisher9.10.11 of 3See more

kutt christianhuth 9.10.1

1 of the 3 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
kutt/kutt:v3.2.6fa3d24a89b04
qs@6.15.2
6.16.0

Open the chart page →

454
ghostcloudpirates-ghostVerified publisher0.20.221 of 3See more

ghost cloudpirates-ghost 0.20.22

1 of the 3 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
qs@6.15.3
6.16.0

Open the chart page →

7,146
rsshubgabe565Verified publisher0.8.01 of 3See more

rsshub gabe565 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
diygod/rsshub:latest1d4b508b6357
qs@6.14.2
6.16.0

Open the chart page →

1,717
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
qs@6.15.3
6.16.0

Open the chart page →

1,447
dynamodbkeyporttech0.1.271 of 2See more

dynamodb keyporttech 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
aaronshaf/dynamodb-admin:latestac41724cd997
qs@6.15.2
6.16.0

Open the chart page →

1,304
bitwarden-crd-operatorlerentisVerified publisher0.18.01 of 1See more

bitwarden-crd-operator lerentis 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/lerentis/bitwarden-crd-operator:0.17.00a608c6ead85
qs@6.15.0
6.16.0

Open the chart page →

2,003
openclaw-with-brainopenclaw-with-brainVerified publisher0.1.671 of 3See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
qs@6.15.2
6.16.0

Open the chart page →

5,218
kratos-selfservice-ui-nodeory0.64.01 of 1See more

kratos-selfservice-ui-node ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
oryd/kratos-selfservice-ui-node:v26.2.046a7bac1ad0c
qs@6.14.2
6.16.0

Open the chart page →

1,966
pacmanpacmanVerified publisher2.0.21 of 2See more

pacman pacman 2.0.2

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/shuguet/pacman:latesta0ec71732c3c
qs@6.14.2
6.16.0

Open the chart page →

638
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
qs@6.15.3
6.16.0

Open the chart page →

977
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
qs@6.15.0
6.16.0

Open the chart page →

4,016
home-assistant-matter-servercharts-derwitt-devVerified publisher4.2.11 of 2See more

home-assistant-matter-server charts-derwitt-dev 4.2.1

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/matter-js/matterjs-server:1.4.054232d0d3e7d
qs@6.15.3
6.16.0

Open the chart page →

2,360
node-redcharts-derwitt-devVerified publisher2.1.21 of 1See more

node-red charts-derwitt-dev 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
nodered/node-red:5.0.7a649dd711d55
qs@6.15.3
6.16.0

Open the chart page →

101
data-fairdata354-helmVerified publisher1.1.21 of 12See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/data-fair/portals:18b621866ceb2
qs@6.15.3
6.16.0

Open the chart page →

38,346
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
qs@6.15.2
6.16.0

Open the chart page →

7,473
jellystatdjjudas21Verified publisher0.1.121 of 1See more

jellystat djjudas21 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
cyfershepard/jellystat:1.1.11c4e2dfa8bddf
qs@6.15.2
6.16.0

Open the chart page →

1,722
enbuildenbuildVerified publisher0.0.502 of 6See more

enbuild enbuild 0.0.50

2 of the 6 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
qs@6.15.0
6.16.0
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
qs@6.15.0
6.16.0

Open the chart page →

31,510
ethereumjsethereum-helm-chartsVerified publisher0.1.21 of 2See more

ethereumjs ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ethpandaops/ethereumjs:masterfb84b718500f
qs@6.14.2
6.16.0

Open the chart page →

1,442
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
qs@6.15.1
6.16.0

Open the chart page →

3,123
ghostgroundhog2k0.212.121 of 1See more

ghost groundhog2k 0.212.12

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
qs@6.15.3
6.16.0

Open the chart page →

2,000
growthbookgrowthbook5.0.11 of 2See more

growthbook growthbook 5.0.1

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
growthbook/growthbook:5.0.1f53ead646b5f
qs@6.15.2
6.16.0

Open the chart page →

709
actualbudgetm0nsterrr-actualbudgetVerified publisher2.10.01 of 1See more

actualbudget m0nsterrr-actualbudget 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
actualbudget/actual-server:26.9.0552beab3dec8
qs@6.15.2
6.16.0

Open the chart page →

1,091
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
qs@6.14.2
6.16.0

Open the chart page →

2,575
kuttone-acre-fundVerified publisher0.2.51 of 1See more

kutt one-acre-fund 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
kutt/kutt:latestfa3d24a89b04
qs@6.15.2
6.16.0

Open the chart page →

454
openccuopenccuVerified publisher3.89.81 of 1See more

openccu openccu 3.89.8

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/openccu/openccu:3.89.8.20260719b2de2ff6e8e0
qs@6.15.3
6.16.0

Open the chart page →

1,916
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
qs@6.15.0
6.16.0

Open the chart page →

7,035
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
qs@6.15.3
6.16.0

Open the chart page →

31,844
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
qs@6.15.1
6.16.0

Open the chart page →

5,482
immichsecustorVerified publisher2.0.41 of 1See more

immich secustor 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
qs@6.15.3
6.16.0

Open the chart page →

3,059
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
qs@6.15.2
6.16.0

Open the chart page →

18,075
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
qs@6.15.1
6.16.0

Open the chart page →

3,833
adeptia-automate-mcpadeptia-automate-mcp1.0.02 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
qs@6.14.2
6.16.0
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
qs@6.14.2
6.16.0

Open the chart page →

3,600

Container images carrying it

127 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
decisionrules/server:latestf38d8571fa06
qs@6.15.2
6.16.0
4
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
qs@6.15.0
6.16.0
3
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
qs@6.15.3
6.16.0
3
actualbudget/actual-server:26.9.0552beab3dec8
qs@6.15.2
6.16.0
2
epamedp/krci-portal:0.8.0687acf641097
qs@6.15.2
6.16.0
2
kutt/kutt:latest:v3.2.6fa3d24a89b04
qs@6.15.2
6.16.0
2
library/ghost:6.63.0e05bc1169fb2
qs@6.15.3
6.16.0
2
louislam/uptime-kuma:2.5.4917318f9d7be
qs@6.14.2
6.16.0
2
louislam/uptime-kuma:2.3.29aeb4e51d038
qs@6.15.1
6.16.0
2
louislam/uptime-kuma:2.5.0a8610b3b4c38
qs@6.15.3
6.16.0
2
n8nio/n8n:2.36.714c4285bc303
qs@6.15.2
6.16.0
2
n8nio/n8n:2.38.45d9f0cc5672b
qs@6.15.2
6.16.0
2
requarks/wiki:2:latest68f0d1848261
qs@6.15.1
6.16.0
2
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
qs@6.14.2
6.16.0
2
verdaccio/verdaccio:6.10.209b403888c8f
qs@6.15.3
6.16.0
2
ghcr.io/lissy93/web-check:latesta4e021c0f6a9
qs@6.15.3
6.16.0
2
aaronshaf/dynamodb-admin:latestac41724cd997
qs@6.15.2
6.16.0
1
activepieces/activepieces:0.90.430c10a04fe3d
qs@6.15.2
6.16.0
1
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
qs@6.14.2
6.16.0
1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
qs@6.14.2
6.16.0
1
budibase/apps:3.41.344fe6feab985
qs@6.15.1
6.16.0
1
budibase/worker:3.41.3de5e2e560ce8
qs@6.15.0
6.16.0
1
chainsafe/lodestar:latest5593f6e97912
qs@6.15.2
6.16.0
1
chocobozzz/peertube:v8.1.5052712130691
qs@6.15.0
6.16.0
1
cyfershepard/jellystat:1.1.11c4e2dfa8bddf
qs@6.15.2
6.16.0
1
decisionrules/business-intelligence:latest1135a6d4f09b
qs@6.15.2
6.16.0
1
devkrishan001/backend:latestf1c3acadeabe
qs@6.15.1
6.16.0
1
directus/directus:12.0.29c8470ea465c
qs@6.15.2
6.16.0
1
diygod/rsshub:latest1d4b508b6357
qs@6.14.2
6.16.0
1
docmost/docmost:0.95.041c8d777cf23
qs@6.14.2
6.16.0
1
drumsergio/genieacs:1.2.16.028244054e1bf
qs@6.15.0
6.16.0
1
epam/ai-dial-admin-frontend:0.20.021d91ad74755
qs@6.15.2
6.16.0
1
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
node-qs@2.2.4-1
no fix listed
1
etherpad/etherpad:latest6020e7b57f4b
qs@6.15.3
6.16.0
1
etherpad/etherpad:2.7.2b723fe5f2594
qs@6.15.1
6.16.0
1
ethpandaops/ethereumjs:masterfb84b718500f
qs@6.14.2
6.16.0
1
felipecs8/conversor-temperatura:v1f945423be36d
qs@6.14.2
6.16.0
1
flanksource/incident-manager-ui:v1.4.318891f21df54fb
qs@6.15.3
6.16.0
1
foggbh/stocky:latest8b7a2e5ecf4e
qs@6.14.2
6.16.0
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
qs@6.15.1
6.16.0
1
growthbook/growthbook:5.0.1f53ead646b5f
qs@6.15.2
6.16.0
1
helmforge/strapi-base:5.52.270e9143d6d92
qs@6.15.3
6.16.0
1
hoppscotch/hoppscotch:2026.8.0d50725df661f
qs@6.15.3
6.16.0
1
kitware/cdash:v5.3.0d7767d9b9da4
qs@6.14.2
6.16.0
1
lbenicio/stremio-web:latest732f9003de33
qs@6.15.1
6.16.0
1
library/ghost:6.37.01ef2e532ca4d
qs@6.14.2
6.16.0
1
library/ghost:6.25.12654b1e90413
qs@6.15.0
6.16.0
1
library/ghost:6.41.129773d6be407
qs@6.15.2
6.16.0
1
library/ghost:6.39.0-alpine77196da4b0df
qs@6.14.2
6.16.0
1
library/ghost:6.62.0a7a268bbfb7f
qs@6.15.3
6.16.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.