StackRadar

CVE-2026-85062

Medium

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
40
of 17,781 indexed, latest versions
Container images
39
deployed by those charts
Fix available
1 of 1
affected package

Colord: Slow rejection of oversized malformed color strings

Carried by container images the latest versions of 40 of 17,781 indexed charts deploy, on 39 images.

Affected packageAffected versionsFixed inImages
colordnpm2.9.1, 2.9.2, 2.9.32.9.439
OSV records
GHSA-2wm5-q62r-hmrv

Charts affected

40 by stars
ChartLatestAffected imagesRadar Score
wekanwekanVerified publisher11.76.01 of 3See more

wekan wekan 11.76.0

1 of the 3 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
ghcr.io/wekan/wekan:v11.764a9601847dfd
colord@2.9.3
2.9.4

Open the chart page →

1,576
umamiwaldo-visionVerified publisher0.0.11 of 1See more

umami waldo-vision 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
colord@2.9.3
2.9.4

Open the chart page →

1,255
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
colord@2.9.1
2.9.4

Open the chart page →

5,251
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
colord@2.9.3
2.9.4

Open the chart page →

17,404
hoppscotchdeliveryheroVerified publisher0.3.21 of 1See more

hoppscotch deliveryhero 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
colord@2.9.3
2.9.4

Open the chart page →

3,451
duplistatusduplistatusVerified publisher1.2.01 of 2See more

duplistatus duplistatus 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.4.25e594f5f09f6
colord@2.9.3
2.9.4

Open the chart page →

1,870
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
colord@2.9.3
2.9.4

Open the chart page →

5,880
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
colord@2.9.3
2.9.4

Open the chart page →

7,473
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
colord@2.9.3
2.9.4

Open the chart page →

3,925
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
colord@2.9.3
2.9.4

Open the chart page →

31,844
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
colord@2.9.3
2.9.4

Open the chart page →

12,581
apimap-developerapimapOfficialVerified publisher1.4.11 of 1See more

apimap-developer apimap 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
apimap/developer:v1.3.1406d3858e20c
colord@2.9.3
2.9.4

Open the chart page →

2,353
apimap-portalapimapOfficialVerified publisher2.4.01 of 1See more

apimap-portal apimap 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
apimap/portal:v2.4.0041a4790c65c
colord@2.9.2
2.9.4

Open the chart page →

2,396
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
assistiot/open_api_frontend:1.0.1f11d82defc70
colord@2.9.3
2.9.4

Open the chart page →

18,277
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
colord@2.9.3
2.9.4

Open the chart page →

32,501
containers-security-chartscontainers-security0.1.01 of 7See more

containers-security-charts containers-security 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
coldatom/containers-security-front:latest7c2fbbb41bcf
colord@2.9.3
2.9.4

Open the chart page →

9,146
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
colord@2.9.3
2.9.4

Open the chart page →

4,551
hoppscotchhelm-charts-nr0.3.11 of 1See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
colord@2.9.3
2.9.4

Open the chart page →

3,451
hoppscotchhelmforgeVerified publisher1.1.111 of 2See more

hoppscotch helmforge 1.1.11

1 of the 2 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2026.8.0d50725df661f
colord@2.9.3
2.9.4

Open the chart page →

2,046
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
colord@2.9.2
2.9.4

Open the chart page →

25,017
hoppscotchhoppscotch0.1.11 of 1See more

hoppscotch hoppscotch 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
colord@2.9.3
2.9.4

Open the chart page →

3,614
townsquarehuscker-chartsVerified publisher1.0.41 of 2See more

townsquare huscker-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
colord@2.9.3
2.9.4

Open the chart page →

3,407
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
colord@2.9.3
2.9.4

Open the chart page →

11,812
cdashkitwareVerified publisher0.19.01 of 3See more

cdash kitware 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
kitware/cdash:v5.3.0d7767d9b9da4
colord@2.9.3
2.9.4

Open the chart page →

12,062
kyso-frontkyso1.0.01 of 1See more

kyso-front kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
kyso/kyso-front:lateste52595c5c16f
colord@2.9.3
2.9.4

Open the chart page →

2,685
mauticmautic-chartVerified publisher1.0.21 of 3See more

mautic mautic-chart 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
mautic/mautic:7-apacheeb8cc73d97e1
colord@2.9.3
2.9.4

Open the chart page →

8,303
cloudcmdmy0nVerified publisher0.0.31 of 1See more

cloudcmd my0n 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
coderaiser/cloudcmd:16.6.1b34a9775c7ce
colord@2.9.3
2.9.4

Open the chart page →

3,128
myawesomeappmyawesomapp-mitchxxx0.1.11 of 1See more

myawesomeapp myawesomapp-mitchxxx 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
mitchxxx/amazon:214e72480ec63a
colord@2.9.3
2.9.4

Open the chart page →

2,116
myawesomeapp14myawesomeapp140.1.11 of 1See more

myawesomeapp14 myawesomeapp14 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
ccjacobs14/amazon:59a9b14a6f09e
colord@2.9.3
2.9.4

Open the chart page →

2,116
myawesomeapp-janmyawesomeapp-jan0.1.11 of 1See more

myawesomeapp-jan myawesomeapp-jan 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
ooghenekaro/amazon:latest03394ba1d6d8
colord@2.9.3
2.9.4

Open the chart page →

2,144
myawesomeapp-marmyawesomeapp-mar0.1.11 of 1See more

myawesomeapp-mar myawesomeapp-mar 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
winfred008/amazon:910a68de5b398
colord@2.9.3
2.9.4

Open the chart page →

2,116
myweatherhelmmyweather1.3.111 of 7See more

myweatherhelm myweather 1.3.11

1 of the 7 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
colord@2.9.3
2.9.4

Open the chart page →

17,929
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
colord@2.9.3
2.9.4

Open the chart page →

3,798
notes-admin-front-helm-chartnotesprojectchart0.1.01 of 1See more

notes-admin-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
vlebediantsev/notes-admin-front:latest007c6670ff48
colord@2.9.3
2.9.4

Open the chart page →

15,132
notes-project-fromt-helm-chartnotesprojectchart0.1.01 of 1See more

notes-project-fromt-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
vlebediantsev/notes-project-front:latest945675fd2636
colord@2.9.3
2.9.4

Open the chart page →

15,206
registration-ms-front-helm-chartnotesprojectchart0.1.01 of 1See more

registration-ms-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
colord@2.9.3
2.9.4

Open the chart page →

15,187
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
colord@2.9.3
2.9.4

Open the chart page →

7,413
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
colord@2.9.3
2.9.4

Open the chart page →

5,497
sneakerssneakers1.0.01 of 4See more

sneakers sneakers 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
helga09/shoes_ukr:v1.1.17999bc8b77c0
colord@2.9.3
2.9.4

Open the chart page →

7,574
codegentest-opea1.0.01 of 5See more

codegen test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-85062.

Container imageDigestPackageFixed in
opea/codegen-ui:1.02bee4eb66f3e
colord@2.9.3
2.9.4

Open the chart page →

28,814

Container images carrying it

39 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
hoppscotch/hoppscotch:2024.8.2f1da831950b7
colord@2.9.3
2.9.4
2
apimap/developer:v1.3.1406d3858e20c
colord@2.9.3
2.9.4
1
apimap/portal:v2.4.0041a4790c65c
colord@2.9.2
2.9.4
1
assistiot/open_api_frontend:1.0.1f11d82defc70
colord@2.9.3
2.9.4
1
baserow/baserow:1.30.1df0c42eb67e8
colord@2.9.3
2.9.4
1
ccjacobs14/amazon:59a9b14a6f09e
colord@2.9.3
2.9.4
1
coderaiser/cloudcmd:16.6.1b34a9775c7ce
colord@2.9.3
2.9.4
1
coldatom/containers-security-front:latest7c2fbbb41bcf
colord@2.9.3
2.9.4
1
directus/directus:12.0.29c8470ea465c
colord@2.9.3
2.9.4
1
directus/directus:11.1.0e3c8bb975350
colord@2.9.3
2.9.4
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
colord@2.9.3
2.9.4
1
helga09/shoes_ukr:v1.1.17999bc8b77c0
colord@2.9.3
2.9.4
1
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
colord@2.9.3
2.9.4
1
hoppscotch/hoppscotch:2026.8.0d50725df661f
colord@2.9.3
2.9.4
1
joplin/server:3.0-beta52af57880c0e
colord@2.9.3
2.9.4
1
joplin/server:2.14.2-betab87564ef34e9
colord@2.9.3
2.9.4
1
kitware/cdash:v5.3.0d7767d9b9da4
colord@2.9.3
2.9.4
1
kyso/kyso-front:lateste52595c5c16f
colord@2.9.3
2.9.4
1
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
colord@2.9.3
2.9.4
1
mautic/mautic:7-apacheeb8cc73d97e1
colord@2.9.3
2.9.4
1
misskey/misskey:12.110.1e08b7c478093
colord@2.9.1
2.9.4
1
mitchxxx/amazon:214e72480ec63a
colord@2.9.3
2.9.4
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
colord@2.9.3
2.9.4
1
ooghenekaro/amazon:latest03394ba1d6d8
colord@2.9.3
2.9.4
1
opea/codegen-ui:1.02bee4eb66f3e
colord@2.9.3
2.9.4
1
openbas/caldera-server:5.1.0a277796d9724
colord@2.9.2
2.9.4
1
treskon/portrait-ui:DEV-lateste7970783bc8d
colord@2.9.3
2.9.4
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
colord@2.9.3
2.9.4
1
vlebediantsev/notes-admin-front:latest007c6670ff48
colord@2.9.3
2.9.4
1
vlebediantsev/notes-project-front:latest945675fd2636
colord@2.9.3
2.9.4
1
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
colord@2.9.3
2.9.4
1
winfred008/amazon:910a68de5b398
colord@2.9.3
2.9.4
1
wsjbr/duplistatus:1.4.25e594f5f09f6
colord@2.9.3
2.9.4
1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
colord@2.9.3
2.9.4
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
colord@2.9.3
2.9.4
1
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
colord@2.9.3
2.9.4
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
colord@2.9.3
2.9.4
1
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
colord@2.9.3
2.9.4
1
ghcr.io/wekan/wekan:v11.764a9601847dfd
colord@2.9.3
2.9.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.