StackRadar

CVE-2026-94486

Medium

Advisory

Published 7 Oct 2026In the index since 8 Oct 2026
Severity
Medium
worst across findings
CVSS
5.4
base score, highest
EPSS
0.001
1st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
54
of 18,053 indexed, latest versions
Container images
51
deployed by those charts
Fix available
1 of 1
affected package

Next.js has information disclosure in development server's Model Context Protocol endpoint

Carried by container images the latest versions of 54 of 18,053 indexed charts deploy, on 51 images.

Affected packageAffected versionsFixed inImages
nextnpm16.0.3, 16.0.10, 16.1.3, 16.1.6+13 more16.3.851
OSV records
GHSA-39w2-rjm5-chcv

Charts affected

54 by stars
ChartLatestAffected imagesRadar Score
nstuning-apptumogroup0.1.231 of 1See more

nstuning-app tumogroup 0.1.23

1 of the 1 container images this version deploys carry CVE-2026-94486.

Container imageDigestPackageFixed in
sondresjo/nstuning-app:v1.6.1620805ad01071
next@16.3.6
16.3.8

Open the chart page →

931
pyttogpanne-apptumogroup0.1.61 of 1See more

pyttogpanne-app tumogroup 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-94486.

Container imageDigestPackageFixed in
sondresjo/pyttogpanne-app:v1.0.5e9a8d7e36e71
next@16.3.6
16.3.8

Open the chart page →

931
sjolystinnovation-apptumogroup0.1.61 of 1See more

sjolystinnovation-app tumogroup 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-94486.

Container imageDigestPackageFixed in
sondresjo/sjolystinnovation-app:v1.3.11a315219c9c2
next@16.3.6
16.3.8

Open the chart page →

931
homepageunknowniq1.8.81 of 2See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry CVE-2026-94486.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.2.0753eeb0cc22a
next@16.3.3
16.3.8

Open the chart page →

662

Container images carrying it

51 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
next@16.2.6
16.3.8
3
ghcr.io/gethomepage/homepage:latest:v2.4.0643bd0be730d
next@16.3.3
16.3.8
2
ghcr.io/seerr-team/seerr:latest:v3.5.027602401178d
next@16.2.6
16.3.8
2
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
next@16.2.12
16.3.8
2
agentarea/agentarea-frontend:latest56360a626a00
next@16.3.6
16.3.8
1
devopsiaci/self-learning-platform:1.1.3d9441c931f75
next@16.1.6
16.3.8
1
drumsergio/lynxprompt:2.0.75c6afb6679301
next@16.2.6
16.3.8
1
drumsergio/pumperly:1.17.0f7efe5fc03f3
next@16.3.6
16.3.8
1
fosrl/pangolin:latest00cfb631097a
next@16.3.5
16.3.8
1
growthbook/growthbook:latest67b7cd7d12a1
next@16.3.5
16.3.8
1
growthbook/growthbook:5.1.0c8a124f55dca
next@16.3.5
16.3.8
1
helmforge/opencut:v0.3.0bf11156e0ab5
next@16.1.3
16.3.8
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
next@16.2.6
16.3.8
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
next@16.2.6
16.3.8
1
langgenius/dify-web:1.16.187dd47e4e28f
next@16.2.12
16.3.8
1
lbenicio/helm-pilot:0.2.54594a2632510
next@16.2.9
16.3.8
1
prowlercloud/prowler-ui:5.31.179ee83c8e702
next@16.2.9
16.3.8
1
sondresjo/altinnendata-app:v1.9.81c850e7bb963
next@16.3.6
16.3.8
1
sondresjo/nstuning-app:v1.6.1620805ad01071
next@16.3.6
16.3.8
1
sondresjo/pyttogpanne-app:v1.0.5e9a8d7e36e71
next@16.3.6
16.3.8
1
sondresjo/sjolystinnovation-app:v1.3.11a315219c9c2
next@16.3.6
16.3.8
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
next@16.2.11
16.3.8
1
supabase/studio:latestfdb56cfa1705
next@16.3.5
16.3.8
1
wsjbr/duplistatus:1.5.0bede86cf183f
next@16.3.6
16.3.8
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
next@16.3.0
16.3.8
1
ghcr.io/bulwarkmail/webmail:1.11.2-always0d48c66f993f
next@16.3.3
16.3.8
1
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
next@16.2.4
16.3.8
1
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
next@16.3.1
16.3.8
1
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
next@16.3.3
16.3.8
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
next@16.3.3
16.3.8
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
next@16.2.4
16.3.8
1
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
next@16.0.10
16.3.8
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
next@16.2.7
16.3.8
1
ghcr.io/homarr-labs/homarr:v2.2.01b4ea544e267
next@16.3.6
16.3.8
1
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
next@16.3.0-preview.9
16.3.8
1
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
next@16.3.0-preview.9
16.3.8
1
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
next@16.0.3
16.3.8
1
ghcr.io/kagent-dev/kagent/ui:0.10.313f62914b66e
next@16.3.5
16.3.8
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
next@16.2.12
16.3.8
1
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
next@16.3.0
16.3.8
1
ghcr.io/microboxlabs/miot-docs:latest84877c693d8a
next@16.3.5
16.3.8
1
ghcr.io/microboxlabs/miot-docs:latestb528e6a1d9d5
next@16.3.5
16.3.8
1
ghcr.io/multica-ai/multica-web:v0.6.1cc8260b03716
next@16.3.4
16.3.8
1
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
next@16.3.5
16.3.8
1
ghcr.io/quenchworks/images/homepageb63a85533463
next@16.3.6
16.3.8
1
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
next@16.2.6
16.3.8
1
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
next@16.2.6
16.3.8
1
ghcr.io/umami-software/umami:3.4.085909afc45bd
next@16.3.4
16.3.8
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
next@16.2.4
16.3.8
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
next@16.2.4
16.3.8
1

syft 1.42.1 · advisories as of 8 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.