StackRadar

CVE-2026-9496

High

Advisory

Published 26 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.003
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
663
of 17,781 indexed, latest versions
Container images
677
deployed by those charts
Fix available
1 of 2
affected packages

pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

Carried by container images the latest versions of 663 of 17,781 indexed charts deploy, on 677 images.

Affected packageAffected versionsFixed inImages
npmdeb3.5.2-0ubuntu4, 6.14.4+ds-1ubuntu2, 9.2.0~ds1-2, 11.17.0-0no fix listed7
pacotenpm11.2.7, 11.3.1, 11.3.3, 11.3.4+30 more21.5.1671
OSV records
DEBIAN-CVE-2026-9496GHSA-w4pp-8pjf-rmxwUBUNTU-CVE-2026-9496

Charts affected

663 by stars
ChartLatestAffected imagesRadar Score
tenuretenureVerified publisher1.0.61 of 2See more

tenure tenure 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
tenureai/tenure:v1.0.285f5b222df9a5
npm@11.17.0-0
no fix listed

Open the chart page →

2,522
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
pacote@18.0.6
21.5.1

Open the chart page →

12,581
taigaunxwaresVerified publisher2026.3.81 of 6See more

taiga unxwares 2026.3.8

1 of the 6 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
taigaio/taiga-events:latest92fc0822564f
pacote@13.6.2
21.5.1

Open the chart page →

9,148
vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets0.0.0-main1 of 2See more

vaultwarden-kubernetes-secrets vaultwarden-kubernetes-secrets 0.0.0-main

1 of the 2 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
pacote@18.0.6
21.5.1

Open the chart page →

4,010
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
pacote@18.0.6
21.5.1

Open the chart page →

5,225
tdarrvhdirkVerified publisher5.0.51 of 2See more

tdarr vhdirk 5.0.5

1 of the 2 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
haveagitgat/tdarr_node:2.17.013ff0913202dd
pacote@15.1.3
21.5.1

Open the chart page →

26,657
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
pacote@19.0.2
21.5.1

Open the chart page →

1,269
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
pacote@21.5.0
21.5.1

Open the chart page →

3,833
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
pacote@19.0.1
21.5.1

Open the chart page →

10,090
youtubedl-materialyoutubedl-materialVerified publisher0.0.11 of 1See more

youtubedl-material youtubedl-material 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:latest2f943d584711
pacote@12.0.3
21.5.1

Open the chart page →

9,783
qleverzazukoVerified publisher0.7.01 of 2See more

qlever zazuko 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/zazukoians/qlever-ui:v0.10.034c7b540a095
pacote@20.0.0
21.5.1

Open the chart page →

2,900
crowdsec-web-uizekker6Verified publisher0.51.01 of 1See more

crowdsec-web-ui zekker6 0.51.0

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/theduffman85/crowdsec-web-ui:2026.8.3bfadbab9a72c
pacote@21.5.0
21.5.1

Open the chart page →

1,411
adeptia-automate-mcpadeptia-automate-mcp1.0.02 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
pacote@20.0.0
21.5.1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
pacote@19.0.1
21.5.1

Open the chart page →

3,600
admin-portaladmin-web-portal1.2.11 of 2See more

admin-portal admin-web-portal 1.2.1

1 of the 2 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
soulou2019/node-server:latest5e6ecfcc109e
pacote@12.0.3
21.5.1

Open the chart page →

3,419
activepiecesadnoctemVerified publisher0.5.01 of 1See more

activepieces adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
activepieces/activepieces:0.90.430c10a04fe3d
pacote@21.4.0
21.5.1

Open the chart page →

1,055
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
pacote@20.0.1
21.5.1

Open the chart page →

3,820
outlineadnoctemVerified publisher0.1.21 of 1See more

outline adnoctem 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
outlinewiki/outline:1.10.1832051f039b4
pacote@21.5.0
21.5.1

Open the chart page →

1,216
uptime-kumaadnoctemVerified publisher0.4.11 of 1See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
pacote@19.0.2
21.5.1

Open the chart page →

30,028
turborepo-remote-cacheadriantr1.1.11 of 1See more

turborepo-remote-cache adriantr 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ducktors/turborepo-remote-cache:latest31ec9e83c844
pacote@21.5.0
21.5.1

Open the chart page →

523
akto-mini-testingakto1.45.71 of 5See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-puppeteer-replay:1.49.4_latestf1c5763d565e
pacote@21.4.0
21.5.1

Open the chart page →

6,486
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
pacote@18.0.6
21.5.1

Open the chart page →

4,880
homepagealareira1.0.11 of 1See more

homepage alareira 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:latest753eeb0cc22a
pacote@20.0.1
21.5.1

Open the chart page →

352
cross-seedalekcVerified publisher7.19.01 of 1See more

cross-seed alekc 7.19.0

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/cross-seed/cross-seed:6.13.7a1fed512261f
pacote@18.0.6
21.5.1

Open the chart page →

1,384
excalidashalekcVerified publisher1.4.01 of 2See more

excalidash alekc 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.6.0cbdab75f31b2
pacote@18.0.6
21.5.1

Open the chart page →

904
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
pacote@18.0.6
21.5.1

Open the chart page →

5,558
lametric-nightscout-proxyaolde0.1.01 of 1See more

lametric-nightscout-proxy aolde 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/aolde/lametric-nightscout-proxy:latest7d1951b6baf5
pacote@13.6.2
21.5.1

Open the chart page →

1,186
apimap-developerapimapOfficialVerified publisher1.4.11 of 1See more

apimap-developer apimap 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
apimap/developer:v1.3.1406d3858e20c
pacote@13.6.2
21.5.1

Open the chart page →

2,353
apimap-portalapimapOfficialVerified publisher2.4.01 of 1See more

apimap-portal apimap 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
apimap/portal:v2.4.0041a4790c65c
pacote@13.6.2
21.5.1

Open the chart page →

2,396
mongo-uiappscodeVerified publisher2026.3.301 of 1See more

mongo-ui appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/kubedb/mongo-gui:latestee0354b7a57a
pacote@13.5.0
21.5.1

Open the chart page →

912
platform-uiappscodeVerified publisher2026.9.111 of 1See more

platform-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/appscode/platform-ui:2.4.0668ee2682eaf
pacote@20.0.1
21.5.1

Open the chart page →

690
argonix-apiargonix0.2.01 of 4See more

argonix-api argonix 0.2.0

1 of the 4 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api-frontend:1.0.0b6a67099e4c5
pacote@18.0.6
21.5.1

Open the chart page →

4,923
arma-reforgerarma-reforger0.5.31 of 8See more

arma-reforger arma-reforger 0.5.3

1 of the 8 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/brittonhayes/arma-reforger:latest6fde1edc0983
pacote@13.6.2
21.5.1

Open the chart page →

23,353
assemblylineassemblylineVerified publisher7.4.171 of 12See more

assemblyline assemblyline 7.4.17

1 of the 12 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
cccs/assemblyline-ui-frontend:4.7.4.stable174c8e4b6c0483
pacote@20.0.1
21.5.1

Open the chart page →

12,898
agenthttpmqttassist-iot-composite-services1.0.01 of 1See more

agenthttpmqtt assist-iot-composite-services 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
assistiot/composite-services-manager_agent-http-mqtt:latest16d21bc5e42e
pacote@13.6.2
21.5.1

Open the chart page →

1,158
agentmqtthttpassist-iot-composite-services1.0.01 of 1See more

agentmqtthttp assist-iot-composite-services 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
assistiot/composite-services-manager_agent-mqtt-http:latest27d58b8911cd
pacote@13.6.2
21.5.1

Open the chart page →

1,158
dltkvassist-iot-data-integrity-verification0.2.01 of 9See more

dltkv assist-iot-data-integrity-verification 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
pacote@13.6.2
21.5.1

Open the chart page →

77,706
dltflassist-iot-dlt-based-fl0.2.01 of 9See more

dltfl assist-iot-dlt-based-fl 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.1.0c8a170683be7
pacote@13.6.2
21.5.1

Open the chart page →

77,706
multilink-clientassist-iot-multi-link-client-app1.0.01 of 2See more

multilink-client assist-iot-multi-link-client-app 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
assistiot/multi-link_client:latestcf048365d042
pacote@17.0.4
21.5.1

Open the chart page →

1,446
multilink-serverassist-iot-multi-link-server-app1.0.01 of 2See more

multilink-server assist-iot-multi-link-server-app 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
assistiot/multi-link_server:latestf38c76a4c960
pacote@17.0.4
21.5.1

Open the chart page →

973
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
pacote@17.0.6
21.5.1

Open the chart page →

32,501
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
pacote@17.0.4
21.5.1

Open the chart page →

9,412
shynetatrox0.1.11 of 1See more

shynet atrox 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.12.0e821e31140f7
pacote@11.3.4
21.5.1

Open the chart page →

5,507
nas-appsawesomeVerified publisher2.0.01 of 8See more

nas-apps awesome 2.0.0

1 of the 8 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
wettyoss/wetty:latest7423b3d40ba2
pacote@20.0.1
21.5.1

Open the chart page →

7,152
awesomeblessingappawesomeblessingapp1.1.01 of 1See more

awesomeblessingapp awesomeblessingapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
bnwokoye/nodejswebapp:latest74de7dc7ebfb
pacote@15.1.1
21.5.1

Open the chart page →

1,267
audiobookshelfbdclark-helm-chartsVerified publisher0.1.41 of 1See more

audiobookshelf bdclark-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
pacote@18.0.6
21.5.1

Open the chart page →

1,722
pangolinbdcode0.14.11 of 1See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
fosrl/pangolin:latest83a55f933b4d
pacote@21.5.0
21.5.1

Open the chart page →

1,901
bluesky-pdsbear0.4.2081 of 1See more

bluesky-pds bear 0.4.208

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
pacote@18.0.6
21.5.1

Open the chart page →

2,136
myhelmappbelihelmapp1.1.01 of 1See more

myhelmapp belihelmapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
belirta/beli-docker:v1.0.0f65ad0e23b4d
pacote@15.1.3
21.5.1

Open the chart page →

1,187
http-debugbicarus-labs0.1.01 of 1See more

http-debug bicarus-labs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
bicarus/http-https-echo:2785dd6a7e805e
pacote@13.6.2
21.5.1

Open the chart page →

867
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-9496.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
pacote@13.0.5
21.5.1

Open the chart page →

4,455

Container images carrying it

677 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
redis/redis-stack:7.2.0-v91c5f43fddcdd
pacote@15.2.0
21.5.1
2
requarks/wiki:2:latest68f0d1848261
pacote@21.5.0
21.5.1
2
shahanafarooqui/rtl:0.13.3e2195188a451
pacote@13.6.2
21.5.1
2
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
pacote@21.5.0
21.5.1
2
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d469:2.18.12-branch.testing3.88744-f55b3414bd113093583
pacote@17.0.4
21.5.1
2
sysnet4admin/dashboard:bluec5bd3bb1b5a6
pacote@18.0.6
21.5.1
2
taigaio/taiga-events:latest92fc0822564f
pacote@13.6.2
21.5.1
2
tzahi12345/youtubedl-material:4.3.2:latest2f943d584711
pacote@12.0.3
21.5.1
2
verdaccio/verdaccio:6.10.209b403888c8f
pacote@21.5.0
21.5.1
2
ghcr.io/api7/adc:0.27.1f65f53dd9668
pacote@21.5.0
21.5.1
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
pacote@19.0.1
21.5.1
2
ghcr.io/codingducksrl/laravel:8.15be52524664c
pacote@13.6.2
21.5.1
2
ghcr.io/cross-seed/cross-seed:6.13.381afafdd96a5
pacote@18.0.6
21.5.1
2
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
pacote@20.0.1
21.5.1
2
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
pacote@12.0.2
21.5.1
2
ghcr.io/lissy93/web-check:latesta4e021c0f6a9
pacote@20.0.1
21.5.1
2
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
pacote@20.0.0
21.5.1
2
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
pacote@17.0.4
21.5.1
2
ghcr.io/wg-easy/wg-easy:145f26407fd2ed
pacote@20.0.0
21.5.1
2
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
pacote@13.6.2
21.5.1
2
0hlov3/semaphore:v1.0.050f874ec096b
pacote@13.6.2
21.5.1
1
aaronshaf/dynamodb-admin:latestac41724cd997
pacote@21.5.0
21.5.1
1
activepieces/activepieces:0.90.430c10a04fe3d
pacote@21.4.0
21.5.1
1
activepieces/activepieces:0.23.0c26188b44e62
pacote@15.0.7
21.5.1
1
actualbudget/actual-server:25.3.158fecd9088b7
pacote@18.0.6
21.5.1
1
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
pacote@20.0.0
21.5.1
1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
pacote@19.0.1
21.5.1
1
agentarea/agentarea-frontend:latest2098a9d7b1fe
pacote@20.0.1
21.5.1
1
agentarea/agentarea-mcp-runner:latestd3c209a5d531
pacote@19.0.2
21.5.1
1
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
pacote@18.0.6
21.5.1
1
alazidis/stornx:1.1.1602d4f7f090c
pacote@21.4.0
21.5.1
1
alquimiaai/studio:certification38a1f0341982
pacote@18.0.6
21.5.1
1
anamskenneth/recipe_backend:2025-06-079b7d2cd389b7
pacote@18.0.6
21.5.1
1
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
pacote@18.0.6
21.5.1
1
anoopnair/lifecycle-jira-integration:latestd80c73a6089d
pacote@13.3.0
21.5.1
1
aolde/bredbandskollen-prometheus-exporter:1.0.2dc61ee713720
pacote@11.3.3
21.5.1
1
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
pacote@18.0.6
21.5.1
1
apimap/developer:v1.3.1406d3858e20c
pacote@13.6.2
21.5.1
1
apimap/portal:v2.4.0041a4790c65c
pacote@13.6.2
21.5.1
1
archivebox/archivebox:0.7.41a5a37331091
pacote@21.5.0
21.5.1
1
arturisimo/server-urjc:v1.0d8dc4430531e
pacote@12.0.3
21.5.1
1
assistiot/composite-services-manager_agent-http-mqtt:latest16d21bc5e42e
pacote@13.6.2
21.5.1
1
assistiot/composite-services-manager_agent-mqtt-http:latest27d58b8911cd
pacote@13.6.2
21.5.1
1
assistiot/dlt_api:2.1.0c8a170683be7
pacote@13.6.2
21.5.1
1
assistiot/multi-link_client:latestcf048365d042
pacote@17.0.4
21.5.1
1
assistiot/multi-link_server:latestf38c76a4c960
pacote@17.0.4
21.5.1
1
automatischio/automatisch:0.15.03bace7a12d5f
pacote@20.0.0
21.5.1
1
baserow/baserow:1.30.1df0c42eb67e8
pacote@17.0.6
21.5.1
1
belirta/beli-docker:v1.0.0f65ad0e23b4d
pacote@15.1.3
21.5.1
1
beyzkaya/blog-backend:v1.0.112a6a3d1c5f9
pacote@18.0.6
21.5.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.