CVE-2026-21413

Critical

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.009; 59th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 51; of 17,781 indexed, latest versions
Container images: 46; deployed by those charts
Fix available: 1 of 3; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 51 of 17,781 indexed charts deploy, on 46 images.

Affected package	Affected versions	Fixed in	Images
librawdeb	0.19.5-1ubuntu1, 0.21.2-2.1build1, 0.21.2-2.1ubuntu0.24.04.1, 0.21.4-2+1 more	0.21.2-2.1ubuntu0.24.04.2, 0.21.4-2+deb13u1, 0.21.5b-1ubuntu1.1	44
darktabledeb	3.8.1-2, 4.6.1-2ubuntu1, 5.0.1-2, 5.4.1-1	no fix listed	5
rawtherapeedeb	5.8-3, 5.10-1build4, 5.11-2build2, 5.12-2	no fix listed	5

OSV records: DEBIAN-CVE-2026-21413 UBUNTU-CVE-2026-21413
Also known as: USN-8522-1

Charts affected

51 by stars

Chart

Latest

Affected images

Radar Score

Wordpresswordpress-mariadb

1.0.2

1 of 2 See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-21413.

Container image	Digest	Package	Fixed in
library/wordpress :latest	5a93c470ae82	libraw@0.21.4-2	0.21.4-2+deb13u1

Open the chart page →

5,560

Container images carrying it

46 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/paperless-ngx/paperless-ngx :3.1.3	aa810a36942c	libraw@0.21.4-2	0.21.4-2+deb13u1	7
library/wordpress :7.1.0-apache :latest	5a93c470ae82	libraw@0.21.4-2	0.21.4-2+deb13u1	6
library/nextcloud :34.0.3 :34.0.3-apache	b97df9e0e1ee	libraw@0.21.4-2	0.21.4-2+deb13u1	2
library/redmine :6.1.3-trixie	f474a901faec	libraw@0.21.4-2	0.21.4-2+deb13u1	2
library/wordpress :6.8.3-apache :6.8-apache	30bff39330d1	libraw@0.21.4-2	0.21.4-2+deb13u1	2
aapjeisbaas/wp-frankenphp :v0.2.2	6b261abc7fb0	libraw@0.21.4-2	0.21.4-2+deb13u1	1
chiefonboarding/chiefonboarding :v2.4.1	59bc7aa60fe7	libraw@0.21.4-2	0.21.4-2+deb13u1	1
dokuwiki/dokuwiki :2025-05-14a	f08ecfdda239	libraw@0.21.4-2	0.21.4-2+deb13u1	1
eclipseaerios/iota-messages-api :latest	e7f5ba0bc64d	libraw@0.21.4-2	0.21.4-2+deb13u1	1
library/nextcloud :31.0.10-apache	b7faa1653c39	libraw@0.21.4-2	0.21.4-2+deb13u1	1
library/node :latest	f5d1cc40abc1	libraw@0.21.4-2	0.21.4-2+deb13u1	1
library/python :3.10	70c9cc675605	libraw@0.21.4-2	0.21.4-2+deb13u1	1
library/python :3.9	da5aee29682d	libraw@0.21.4-2	0.21.4-2+deb13u1	1
library/redmine :6.1.2	04ac44a2595b	libraw@0.21.4-2	0.21.4-2+deb13u1	1
library/wordpress :6.9.4-fpm	ad4a8bae2eb4	libraw@0.21.4-2	0.21.4-2+deb13u1	1
library/wordpress :php8.1-apache	f73396626d2f	libraw@0.21.4-2	0.21.4-2+deb13u1	1
linuxserver/calibre-web :0.6.24	241009026e6f	libraw@0.21.2-2.1ubuntu0.24.04.1	0.21.2-2.1ubuntu0.24.04.2	1
mindsdb/mindsdb :latest	163011c09299	libraw@0.21.4-2	0.21.4-2+deb13u1	1
openproject/openproject :17.8.0-slim	48952034215d	libraw@0.21.4-2	0.21.4-2+deb13u1	1
photoprism/photoprism :220629-jammy	2954334adbda	darktable@3.8.1-2 rawtherapee@5.8-3	no fix listed no fix listed	1
photoprism/photoprism :260601	650c6ad5a651	darktable@5.4.1-1 libraw@0.21.5b-1ubuntu1 rawtherapee@5.12-2	no fix listed 0.21.5b-1ubuntu1.1 no fix listed	1
photoprism/photoprism :260728	958642220223	darktable@5.4.1-1 rawtherapee@5.12-2	no fix listed no fix listed	1
photoprism/photoprism :251130	db16ee6b1ba3	darktable@5.0.1-2 libraw@0.21.4-2 rawtherapee@5.11-2build2	no fix listed no fix listed no fix listed	1
photoprism/photoprism :240711-ce	fc6fd632ca74	darktable@4.6.1-2ubuntu1 libraw@0.21.2-2.1build1 rawtherapee@5.10-1build4	no fix listed 0.21.2-2.1ubuntu0.24.04.2 no fix listed	1
pretix/standalone :2026.7.0	5df3b7aa852e	libraw@0.21.4-2	0.21.4-2+deb13u1	1
roundcube/roundcubemail :1.6.16-apache-nonroot	17d9d9580962	libraw@0.21.4-2	0.21.4-2+deb13u1	1
someblackmagic/k8s-testing-multitool :v0.1.0	6eca64b6b440	libraw@0.19.5-1ubuntu1	no fix listed	1
sslhep/servicex_app :v1.8.5	1d12f943cec5	libraw@0.21.4-2	0.21.4-2+deb13u1	1
sslhep/servicex_code_gen_atlas_xaod :v1.8.5	e7aff7f97b89	libraw@0.21.4-2	0.21.4-2+deb13u1	1
sslhep/servicex_code_gen_func_adl_uproot :v1.8.5	b01b8ee966ed	libraw@0.21.4-2	0.21.4-2+deb13u1	1
sslhep/servicex_code_gen_python :v1.8.5	0e4175a4e1eb	libraw@0.21.4-2	0.21.4-2+deb13u1	1
sslhep/servicex_code_gen_raw_uproot :v1.8.5	671980005c57	libraw@0.21.4-2	0.21.4-2+deb13u1	1
sslhep/servicex_code_gen_topcp :v1.8.5	596db2abdd09	libraw@0.21.4-2	0.21.4-2+deb13u1	1
sslhep/servicex-did-finder-atlasopenmagic :v1.8.5	54aaf1721d03	libraw@0.21.4-2	0.21.4-2+deb13u1	1
sslhep/servicex-did-finder-cernopendata :v1.8.5	2cb88ceab5bb	libraw@0.21.4-2	0.21.4-2+deb13u1	1
sslhep/servicex-did-finder-xrootd :v1.8.5	c284442b44e3	libraw@0.21.4-2	0.21.4-2+deb13u1	1
stashapp/stash-box :latest	a534c8afdf39	libraw@0.21.2-2.1ubuntu0.24.04.1	0.21.2-2.1ubuntu0.24.04.2	1
ghcr.io/cosmo-tech/cosmotech-copilot-api :latest	a2be95de450c	libraw@0.21.4-2	0.21.4-2+deb13u1	1
ghcr.io/dask/dask-kubernetes-operator :2026.3.0	3225d2bc6b3c	libraw@0.21.4-2	0.21.4-2+deb13u1	1
ghcr.io/deltabadger/deltabadger :2.23.3	bffe3c22fabc	libraw@0.21.4-2	0.21.4-2+deb13u1	1
ghcr.io/dfir-iris/iriswebapp_app :v2.4.26	e59ebde55709	libraw@0.21.4-2	0.21.4-2+deb13u1	1
ghcr.io/nathanvaughn/webtrees :2.2.6	034151b61a80	libraw@0.21.4-2	0.21.4-2+deb13u1	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	libraw@0.21.4-2	0.21.4-2+deb13u1	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.3	57ad9565bff3	libraw@0.21.4-2	0.21.4-2+deb13u1	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	libraw@0.21.4-2	0.21.4-2+deb13u1	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	libraw@0.21.4-2	0.21.4-2+deb13u1	1