StackRadar

CVE-2026-94485

Medium

Advisory

Published 7 Oct 2026In the index since 8 Oct 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
54
of 18,053 indexed, latest versions
Container images
51
deployed by those charts
Fix available
1 of 1
affected package

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

Carried by container images the latest versions of 54 of 18,053 indexed charts deploy, on 51 images.

Affected packageAffected versionsFixed inImages
nextnpm16.0.3, 16.0.10, 16.1.3, 16.1.6+13 more16.3.851
OSV records
GHSA-f87g-xv8r-7p7x

Charts affected

54 by stars
ChartLatestAffected imagesRadar Score
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
langgenius/dify-web:1.16.187dd47e4e28f
next@16.2.12
16.3.8

Open the chart page →

72,701
homarrhomarr-labsOfficialVerified publisher8.32.01 of 1See more

homarr homarr-labs 8.32.0

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v2.2.01b4ea544e267
next@16.3.6
16.3.8

Open the chart page →

420
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latest27602401178d
next@16.2.6
16.3.8

Open the chart page →

3,557
homepagem0nsterrr-homepageVerified publisher5.4.01 of 1See more

homepage m0nsterrr-homepage 5.4.0

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.4.0643bd0be730d
next@16.3.3
16.3.8

Open the chart page →

648
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
next@16.2.12
16.3.8

Open the chart page →

11,804
umamihelmforgeVerified publisher2.3.41 of 3See more

umami helmforge 2.3.4

1 of the 3 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.3.8

Open the chart page →

1,997
duplistatusduplistatusVerified publisher1.3.01 of 2See more

duplistatus duplistatus 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.5.0bede86cf183f
next@16.3.6
16.3.8

Open the chart page →

1,080
flyte-binaryflyte2.0.511 of 4See more

flyte-binary flyte 2.0.51

1 of the 4 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
next@16.2.12
16.3.8

Open the chart page →

4,982
flyte-coreflyte2.0.511 of 3See more

flyte-core flyte 2.0.51

1 of the 3 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
next@16.2.12
16.3.8

Open the chart page →

790
agentareaagentareaVerified publisher0.0.261 of 17See more

agentarea agentarea 0.0.26

1 of the 17 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
agentarea/agentarea-frontend:latest56360a626a00
next@16.3.6
16.3.8

Open the chart page →

16,661
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
next@16.2.6
16.3.8

Open the chart page →

2,508
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
next@16.3.3
16.3.8

Open the chart page →

2,113
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.3.8

Open the chart page →

1,257
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.3.8

Open the chart page →

1,637
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.3.8

Open the chart page →

841
lakilakiOfficialVerified publisher1.11.01 of 2See more

laki laki 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.3.8

Open the chart page →

543
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
growthbook/growthbook:latest67b7cd7d12a1
next@16.3.5
16.3.8

Open the chart page →

1,589
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.31 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.3

1 of the 34 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
next@16.3.5
16.3.8

Open the chart page →

24,860
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.3.8

Open the chart page →

9,862
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
next@16.2.11
16.3.8

Open the chart page →

21,601
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.3.8

Open the chart page →

1,477
homepagealareira1.0.11 of 1See more

homepage alareira 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:latest643bd0be730d
next@16.3.3
16.3.8

Open the chart page →

648
pangolinbdcode0.14.11 of 1See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
fosrl/pangolin:latest00cfb631097a
next@16.3.5
16.3.8

Open the chart page →

2,240
fauxgpufauxgpuVerified publisher0.2.41 of 4See more

fauxgpu fauxgpu 0.2.4

1 of the 4 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
next@16.3.1
16.3.8

Open the chart page →

3,775
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.3.8

Open the chart page →

15,493
bulwark-mailhelmforgeVerified publisher1.0.01 of 1See more

bulwark-mail helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.11.2-always0d48c66f993f
next@16.3.3
16.3.8

Open the chart page →

87
homarrhelmforgeVerified publisher1.2.111 of 1See more

homarr helmforge 1.2.11

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
next@16.3.0-preview.9
16.3.8

Open the chart page →

738
opencuthelmforgeVerified publisher1.1.111 of 5See more

opencut helmforge 1.1.11

1 of the 5 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.3.8

Open the chart page →

3,586
reactive-resumehelmforgeVerified publisher1.0.01 of 4See more

reactive-resume helmforge 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
next@16.3.0
16.3.8

Open the chart page →

3,630
self-learning-platformhelm-self-learning-platformVerified publisher1.1.01 of 1See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
devopsiaci/self-learning-platform:1.1.3d9441c931f75
next@16.1.6
16.3.8

Open the chart page →

1,642
multicaicoretechVerified publisher0.6.21 of 4See more

multica icoretech 0.6.2

1 of the 4 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/multica-ai/multica-web:v0.6.1cc8260b03716
next@16.3.4
16.3.8

Open the chart page →

2,436
kagentkagent0.10.31 of 6See more

kagent kagent 0.10.3

1 of the 6 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/ui:0.10.313f62914b66e
next@16.3.5
16.3.8

Open the chart page →

3,219
homepagekubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

homepage kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
next@16.2.4
16.3.8

Open the chart page →

1,554
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
next@16.2.7
16.3.8

Open the chart page →

1,844
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.3.8

Open the chart page →

2,802
helm-pilotlbenicio-communityVerified publisher0.2.41 of 1See more

helm-pilot lbenicio-community 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.3.8

Open the chart page →

867
lynxpromptlynxpromptVerified publisher0.1.31 of 3See more

lynxprompt lynxprompt 0.1.3

1 of the 3 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
next@16.2.6
16.3.8

Open the chart page →

2,226
homarrmedia-servarrVerified publisher0.56.01 of 1See more

homarr media-servarr 0.56.0

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
next@16.3.0-preview.9
16.3.8

Open the chart page →

738
miot-appmicroboxlabs0.3.31 of 1See more

miot-app microboxlabs 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.8

Open the chart page →

666
miot-docsmicroboxlabs0.1.11 of 1See more

miot-docs microboxlabs 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-docs:latestb528e6a1d9d5
next@16.3.5
16.3.8

Open the chart page →

284
miot-stackmicroboxlabs0.2.21 of 2See more

miot-stack microboxlabs 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.8

Open the chart page →

666
modulariotmicroboxlabs0.11.02 of 4See more

modulariot microboxlabs 0.11.0

2 of the 4 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.8
ghcr.io/microboxlabs/miot-docs:latest84877c693d8a
next@16.3.5
16.3.8

Open the chart page →

2,626
dify-enterpriseopenshift3.9.82 of 13See more

dify-enterprise openshift 3.9.8

2 of the 13 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.3.8
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.3.8

Open the chart page →

7,412
podscopepodscope0.2.31 of 1See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.3.8

Open the chart page →

1,623
pumperlypumperlyVerified publisher0.2.01 of 3See more

pumperly pumperly 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
drumsergio/pumperly:1.17.0f7efe5fc03f3
next@16.3.6
16.3.8

Open the chart page →

2,800
homepagequench-homepageVerified publisher0.0.71 of 1See more

homepage quench-homepage 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/homepagedigest-pinnedb63a85533463
next@16.3.6
16.3.8

Open the chart page →

90
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.3.8

Open the chart page →

8,377
seerr-chartseerr-chartVerified publisher3.10.01 of 1See more

seerr-chart seerr-chart 3.10.0

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.5.027602401178d
next@16.2.6
16.3.8

Open the chart page →

2,299
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
supabase/studio:latestfdb56cfa1705
next@16.3.5
16.3.8

Open the chart page →

10,744
altinnendata-apptumogroup0.1.241 of 1See more

altinnendata-app tumogroup 0.1.24

1 of the 1 container images this version deploys carry CVE-2026-94485.

Container imageDigestPackageFixed in
sondresjo/altinnendata-app:v1.9.81c850e7bb963
next@16.3.6
16.3.8

Open the chart page →

931

Container images carrying it

51 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
next@16.0.3
16.3.8
1

syft 1.42.1 · advisories as of 8 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.