StackRadar

CVE-2026-82562

Low

Advisory

Published 31 Aug 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
3.7
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
139
of 17,781 indexed, latest versions
Container images
127
deployed by those charts
Fix available
1 of 2
affected packages

qs array-limit bypass via bracket-key comma parsing

Carried by container images the latest versions of 139 of 17,781 indexed charts deploy, on 127 images.

Affected packageAffected versionsFixed inImages
qsnpm6.14.2, 6.15.0, 6.15.1, 6.15.2+1 more6.16.0122
node-qsdeb2.2.4-1, 2.2.4-1ubuntu1, 6.9.1+ds-1no fix listed5
OSV records
GHSA-x5fp-wj9c-mxmxUBUNTU-CVE-2026-82562

Charts affected

139 by stars
ChartLatestAffected imagesRadar Score
keycloak-multi-client-notifierkeycloak-multi-client-notifier2.1.21 of 2See more

keycloak-multi-client-notifier keycloak-multi-client-notifier 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
qs@6.14.2
6.16.0

Open the chart page →

1,473
cdashkitwareVerified publisher0.19.01 of 3See more

cdash kitware 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
kitware/cdash:v5.3.0d7767d9b9da4
qs@6.14.2
6.16.0

Open the chart page →

12,062
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
qs@6.14.2
6.16.0

Open the chart page →

2,756
uptime-kumakubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

uptime-kuma kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.2.1-slim059b49d64739
qs@6.14.2
6.16.0

Open the chart page →

6,356
stremiolbenicio-communityVerified publisher0.1.11 of 2See more

stremio lbenicio-community 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
lbenicio/stremio-web:latest732f9003de33
qs@6.15.1
6.16.0

Open the chart page →

2,600
uptime-kumalbenicio-communityVerified publisher0.1.11 of 1See more

uptime-kuma lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
qs@6.15.1
6.16.0

Open the chart page →

33,242
node-redlmatfyVerified publisher0.1.61 of 1See more

node-red lmatfy 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
nodered/node-red:4.1.10-minimald73ae167cb9b
qs@6.14.2
6.16.0

Open the chart page →

1,809
uptime-kumaloeken-at-homeVerified publisher2.3.21 of 1See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
qs@6.15.1
6.16.0

Open the chart page →

33,242
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
node-qs@6.9.1+ds-1
no fix listed

Open the chart page →

17,779
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
qs@6.15.0
6.16.0

Open the chart page →

4,960
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
qs@6.15.2
6.16.0

Open the chart page →

1,038
uptime-kumancsaVerified publisher1.7.21 of 1See more

uptime-kuma ncsa 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
qs@6.14.2
6.16.0

Open the chart page →

30,028
nostreamnostream0.1.01 of 1See more

nostream nostream 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/cameri/nostream:main8726533b9e69
qs@6.14.2
6.16.0

Open the chart page →

595
cloakbrowser-mcpobeoneVerified publisher0.3.11 of 1See more

cloakbrowser-mcp obeone 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
swimmwatch/cloakbrowser-mcp:1.13.0d48c705a58c8
qs@6.15.3
6.16.0

Open the chart page →

2,278
firecrawlobeoneVerified publisher3.0.11 of 5See more

firecrawl obeone 3.0.1

1 of the 5 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/firecrawl/playwright-service:latest1f6eba640320
qs@6.15.2
6.16.0

Open the chart page →

9,995
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
qs@6.15.2
6.16.0

Open the chart page →

1,038
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
openwhisk/ow-utils:1.0.0c80dba0de3aa
node-qs@2.2.4-1ubuntu1
no fix listed

Open the chart page →

36,215
portalplatform-mesh-portal0.19.41 of 1See more

portal platform-mesh-portal 0.19.4

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/platform-mesh/portal:v0.26.123c937255cac2
qs@6.15.3
6.16.0

Open the chart page →

301
code-serverquench-code-serverVerified publisher0.0.71 of 1See more

code-server quench-code-server 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/code-serverdigest-pinned1749ff57eeef
qs@6.15.2
6.16.0

Open the chart page →

31
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
etherpad/etherpad:latest6020e7b57f4b
qs@6.15.3
6.16.0

Open the chart page →

895
web-checkrm3lVerified publisher0.1.01 of 1See more

web-check rm3l 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/lissy93/web-check:latesta4e021c0f6a9
qs@6.15.3
6.16.0

Open the chart page →

9,047
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
qs@6.15.0
6.16.0

Open the chart page →

68,240
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
qs@6.14.2
6.16.0

Open the chart page →

30,219
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
qs@6.15.3
6.16.0

Open the chart page →

5,819
etherpadschoenwald0.3.01 of 1See more

etherpad schoenwald 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
etherpad/etherpad:2.7.2b723fe5f2594
qs@6.15.1
6.16.0

Open the chart page →

2,133
shopsyncshopsyncVerified publisher1.0.01 of 1See more

shopsync shopsync 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
shyamkrishna21/shopsync:latest3998b83def53
qs@6.14.2
6.16.0

Open the chart page →

1,088
hedgedocsi-gitops0.12.31 of 2See more

hedgedoc si-gitops 0.12.3

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
qs@6.15.3
6.16.0

Open the chart page →

2,638
fdi-dotstatsuite-sfs-solrstatcan1.0.21 of 4See more

fdi-dotstatsuite-sfs-solr statcan 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
qs@6.14.2
6.16.0

Open the chart page →

6,065
fdi-dotstatsuite-sfs-solr-statefulstatcan1.0.21 of 2See more

fdi-dotstatsuite-sfs-solr-stateful statcan 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
qs@6.14.2
6.16.0

Open the chart page →

919
strapistrapi-xmv0.1.11 of 1See more

strapi strapi-xmv 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
qs@6.15.2
6.16.0

Open the chart page →

676
grafanasvtech-public-helm-charts1.0.01 of 2See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
node-qs@6.9.1+ds-1
no fix listed

Open the chart page →

10,902
tensorzerotensorzero2026.6.01 of 2See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
tensorzero/ui:2026.6.0f2563d54724e
qs@6.15.0
6.16.0

Open the chart page →

3,972
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
supabase/studio:latest94a2a9d2906e
qs@6.15.2
6.16.0

Open the chart page →

9,556
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
qs@6.15.2
6.16.0

Open the chart page →

5,550
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
qs@6.14.2
6.16.0

Open the chart page →

2,028
fossflowunxwaresVerified publisher2026.2.11 of 1See more

fossflow unxwares 2026.2.1

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
stnsmith/fossflow:lateste448ab346cb3
qs@6.15.3
6.16.0

Open the chart page →

161
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
qs@6.14.2
6.16.0

Open the chart page →

1,787
verdacciowenerme4.35.11 of 1See more

verdaccio wenerme 4.35.1

1 of the 1 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
verdaccio/verdaccio:6.10.209b403888c8f
qs@6.15.3
6.16.0

Open the chart page →

215
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-82562.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
qs@6.15.1
6.16.0

Open the chart page →

5,459

Container images carrying it

127 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/fpsacha/zomboid-panel:v1.0.6605e16dd56cfb
qs@6.15.3
6.16.0
1
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
qs@6.15.3
6.16.0
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
qs@6.15.3
6.16.0
1
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
qs@6.15.2
6.16.0
1
ghcr.io/lerentis/bitwarden-crd-operator:0.17.00a608c6ead85
qs@6.15.0
6.16.0
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
qs@6.15.3
6.16.0
1
ghcr.io/matter-js/matterjs-server:1.4.054232d0d3e7d
qs@6.15.3
6.16.0
1
ghcr.io/openccu/openccu:3.89.8.20260719b2de2ff6e8e0
qs@6.15.3
6.16.0
1
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
qs@6.15.2
6.16.0
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
qs@6.14.2
6.16.0
1
ghcr.io/platform-mesh/portal:v0.26.123c937255cac2
qs@6.15.3
6.16.0
1
ghcr.io/quenchworks/images/code-server1749ff57eeef
qs@6.15.2
6.16.0
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
qs@6.15.3
6.16.0
1
ghcr.io/shuguet/pacman:latesta0ec71732c3c
qs@6.14.2
6.16.0
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
qs@6.15.3
6.16.0
1
ghcr.io/teq-cloud/iteq-api:0.3.3-beta0d9587179ed5
qs@6.15.3
6.16.0
1
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
qs@6.15.3
6.16.0
1
ghcr.io/wekan/wekan:v11.764a9601847dfd
qs@6.15.3
6.16.0
1
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
qs@6.15.2
6.16.0
1
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
qs@6.15.3
6.16.0
1
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
qs@6.15.3
6.16.0
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
qs@6.15.1
6.16.0
1
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
qs@6.14.2
6.16.0
1
quay.io/seamware/fdsc-dashboard:0.6.0f7706c316c5a
qs@6.15.2
6.16.0
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
qs@6.15.3
6.16.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
qs@6.15.0
6.16.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
qs@6.15.0
6.16.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.