StackRadar

CVE-2026-33636

High

Advisory

Published 26 Mar 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.6
base score, highest
EPSS
0.007
53rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
703
of 17,787 indexed, latest versions
Container images
642
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: libpng security update

Carried by container images the latest versions of 703 of 17,787 indexed charts deploy, on 642 images.

Affected packageAffected versionsFixed inImages
libpng1.6deb1.6.37-2, 1.6.37-3build5, 1.6.37-3ubuntu0.4, 1.6.39-2+10 more1.6.37-2ubuntu0.1~esm3, 1.6.37-3ubuntu0.5, 1.6.39-2+deb12u4, 1.6.43-5ubuntu0.6+2 more480
libpngapk1.6.43-r0, 1.6.44-r0, 1.6.45-r0, 1.6.47-r0+3 more1.6.56-r0144
libpngrpm2:1.6.37-12.el9, 2:1.6.37-12.el9_7.12:1.6.37-12.el9_7.318
OSV records
ALPINE-CVE-2026-33636DEBIAN-CVE-2026-33636RHSA-2026:14791UBUNTU-CVE-2026-33636
Also known as
RHSA-2026:17524, RHSA-2026:17603, RHSA-2026:17642, USN-8251-1, USN-8639-1

Charts affected

703 by stars
ChartLatestAffected imagesRadar Score
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-33636.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5

Open the chart page →

14,172
tabbyxdVerified publisher1.0.61 of 2See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-33636.

Container imageDigestPackageFixed in
library/nginx:1.25a484819eb602
libpng1.6@1.6.39-2
1.6.39-2+deb12u4

Open the chart page →

7,685
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-33636.

Container imageDigestPackageFixed in
hamzaarshad10/queryfrontend:1.1.5.14cd359d9a78c3
libpng@1.6.44-r0
1.6.56-r0

Open the chart page →

13,197

Container images carrying it

642 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
apache/nifi-registry:1.27.063b8e3e40742
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
apachepulsar/pulsar:3.1.016f9fdab3fa6
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
apachepulsar/pulsar:2.10.03b262ab7a7d9
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
apachepulsar/pulsar:3.0.79c9947de139d
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
apachepulsar/pulsar:2.9.0d056c89b7131
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
apachepulsar/pulsar:2.8.2d538416d5afe
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
apache/ranger:2.7.076c176e8a0e4
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
apache/rocketmq:5.3.0434d8398f996
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
apache/rocketmq-exporter:0.0.2c8fb51195444
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
apache/skywalking-oap-server:9.2.0133d35d2c263
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
apache/skywalking-oap-server:8.9.1b4ec8c18d079
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
apache/skywalking-ui:9.2.0295f1dc87d98
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
apache/skywalking-ui:8.9.180530f0308a5
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
apache/tika:2.9.0.092d055a84e9e
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
appwrite/appwrite:1.9.01aaa70127114
libpng@1.6.55-r0
1.6.56-r0
1
appwrite/console:8.7.383dcdc8492ac6
libpng@1.6.55-r0
1.6.56-r0
1
appwrite/console:7.5.7aaa11ceab999
libpng@1.6.44-r0
1.6.56-r0
1
aristidetm/basic-notebook:3.6.5469dbc951224
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
arthurjguerra18/revwallet:v0.7.12f540af20b307
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
assistiot/cybersecurity-monitoring_ir-cas:latest6a107f224c34
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
assistiot/location_processing:lateste9bae124095f
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
assistiot/open_api_backend:1.1.230812ba93555
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
assistiot/sdn_controller:2.4.0ea254b6d8a31
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
assistiot/smart-orchestrator_scheduler_mc:latestb1dbe4d62a03
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
assistiot/video_augmentation:runner-cpu-lateste5ae539ce2cb
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
atlassian/confluence-server:7.10.03b9222ab32ef
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
atlassian/jira-software:8.14.037bc46cbec1a
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
atlassian/jira-software:9.7.264a75aa4ec4e
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
avinash263/pyredis263:latestaa2b8727f1a6
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
avzini/web-app:latestf40b30210ed0
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
awesometechnologies/synapse-admin:0.11.4a1c1f4662875
libpng@1.6.54-r0
1.6.56-r0
1
bbernhard/signal-cli-rest-api:0.57549ad08d7e14
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
beyzkaya/blog-backend:v1.0.112a6a3d1c5f9
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
beyzkaya/blog-frontend:v1.0.0bf412d75c510
libpng@1.6.47-r0
1.6.56-r0
1
bitnamilegacy/elasticsearch:8.12.215d4647fd491
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
bitnamilegacy/elasticsearch:9.0.1-debian-12-r0e6f6ddcce2f1
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
bitnamilegacy/grafana:11.4.0-debian-12-r0cb8ab5515676
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
bitnamilegacy/matomo:5.3.2-debian-12-r13f02c000c54b1
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
blakeblackshear/frigate:0.10.0-amd64ae269270ad9e
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
bnjbvr/kresus:0.22.137e216b182c8
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
budibase/database:2.1.0d90f656261c9
libpng1.6@1.6.39-2+deb12u3
1.6.39-2+deb12u4
1
carlosmz87/test_helm_backend:latest8ffa63aa995d
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
carlosmz87/test_helm_frontend:latest79f4b528f42a
libpng@1.6.44-r0
1.6.56-r0
1
castlemock/castlemock:latestb7f3f1527ba9
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
castopod/castopod:1.12.101fd37280cbb2
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
castopod/castopod:1.15.54e4f0440520f
libpng1.6@1.6.48-1+deb13u3
1.6.48-1+deb13u4
1
cbioportal/cbioportal:6.4.1-web-shenandoah08debbd2dbf9
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
chandanteekinavar/findery-market-frontend:1.06de5bd44a325
libpng@1.6.44-r0
1.6.56-r0
1
chibisafe/chibisafe-server:latest3da4fcbc1a18
libpng@1.6.47-r0
1.6.56-r0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.