CVE-2026-28494

High

Advisory

Published 10 Mar 2026In the index since 6 Sept 2026

The matching OSV records carry no description.

Carried by container images the latest versions of 102 of 17,781 indexed charts deploy, on 110 images.

Affected package	Affected versions	Fixed in	Images
imagemagickdeb	8:6.8.9.9-7ubuntu5.9, 8:6.9.10.23+dfsg-2.1ubuntu11.4, 8:6.9.11.60+dfsg-1.3build2, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+15 more	8:6.9.11.60+dfsg-1.6+deb12u8, 8:7.1.1.43+dfsg1-1+deb13u7	110

102 by stars

Chart

Latest

Affected images

Radar Score

1 of the 3 container images this version deploys carry CVE-2026-28494.

Container image	Digest	Package	Fixed in
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u8

10,795

1 of the 1 container images this version deploys carry CVE-2026-28494.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	imagemagick@8:6.9.12.98+dfsg1-5.2build2	no fix listed

7,628

110 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u8	1
ghcr.io/wgbh-mla/pbcore-util :pr-6	6e04659a3baa	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u5	8:6.9.11.60+dfsg-1.6+deb12u8	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u8	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u8	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u8	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u8	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u1	8:6.9.11.60+dfsg-1.6+deb12u8	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u8	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u8	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u8	1