StackRadar

CVE-2026-33636

High

Advisory

Published 26 Mar 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.6
base score, highest
EPSS
0.007
53rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
703
of 17,787 indexed, latest versions
Container images
642
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: libpng security update

Carried by container images the latest versions of 703 of 17,787 indexed charts deploy, on 642 images.

Affected packageAffected versionsFixed inImages
libpng1.6deb1.6.37-2, 1.6.37-3build5, 1.6.37-3ubuntu0.4, 1.6.39-2+10 more1.6.37-2ubuntu0.1~esm3, 1.6.37-3ubuntu0.5, 1.6.39-2+deb12u4, 1.6.43-5ubuntu0.6+2 more480
libpngapk1.6.43-r0, 1.6.44-r0, 1.6.45-r0, 1.6.47-r0+3 more1.6.56-r0144
libpngrpm2:1.6.37-12.el9, 2:1.6.37-12.el9_7.12:1.6.37-12.el9_7.318
OSV records
ALPINE-CVE-2026-33636DEBIAN-CVE-2026-33636RHSA-2026:14791UBUNTU-CVE-2026-33636
Also known as
RHSA-2026:17524, RHSA-2026:17603, RHSA-2026:17642, USN-8251-1, USN-8639-1

Charts affected

703 by stars
ChartLatestAffected imagesRadar Score
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-33636.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5

Open the chart page →

14,172
tabbyxdVerified publisher1.0.61 of 2See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-33636.

Container imageDigestPackageFixed in
library/nginx:1.25a484819eb602
libpng1.6@1.6.39-2
1.6.39-2+deb12u4

Open the chart page →

7,685
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-33636.

Container imageDigestPackageFixed in
hamzaarshad10/queryfrontend:1.1.5.14cd359d9a78c3
libpng@1.6.44-r0
1.6.56-r0

Open the chart page →

13,197

Container images carrying it

642 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
rm3l/dev-feed-api:latest9a7f732245a3
libpng@2:1.6.37-12.el9
2:1.6.37-12.el9_7.3
1
rm3l/service-names-port-numbers:0.12.162d1cc4223e5
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
rocketchat/freeswitch:stablecfba5c20a5cc
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
rommapp/romm:5.2.03512f2ca4557
libpng@1.6.54-r0
1.6.56-r0
1
rommapp/romm:4.4.1b909e95d1aab
libpng@1.6.47-r0
1.6.56-r0
1
rraahul/test:latestbfe2c1183bc0
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
rrobetti/ojp:0.1.0-beta1141bd88232b
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
rtuszik/photon-docker:2.4.021549c60f9e6
libpng1.6@1.6.43-5ubuntu0.3
1.6.43-5ubuntu0.6
1
ryshe/terraria:latestb1c89f7f359a
libpng1.6@1.6.39-2+deb12u3
1.6.39-2+deb12u4
1
ryuunosukeds3/nadeko-bot-docker:latestc0398f13e8a9
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
saidsef/scapy-containerised:v2025.02f17f7c435891
libpng@1.6.45-r0
1.6.56-r0
1
santisbon/evwatcher:latestc4e994ca4540
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
santisbon/evworker:lateste807283f8d69
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
santisbon/speedtest:latest8ee3a1697227
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
sashafefler/spacecapybara_app:latestf96d7804c0ca
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
seafileltd/seafile-mc:9.0.106693911bcc40
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
seafileltd/seafile-mc:9.0.97ac833196f60
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
seafileltd/seafile-mc:11.0.12d0c66e4621bd
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
seyiogunniran/my-nginx:1.03a0ed39e5830
libpng@1.6.47-r0
1.6.56-r0
1
shamimkuet/nginx:1.0.2b82902a76a04
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
shaowenchen/ops-server:latest315444f703f4
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
sissbruecker/linkding:1.35.00c5dddf0b37c
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
sissbruecker/linkding:1.41.0-plusa222fb777e1f
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
snipe/snipe-it:v8.3.1141ebf2386fe
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
snipe/snipe-it:v6.0.1455fb7636a98c
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
socialmediamacroscope/autophrase:0.1.570fb11d4f531
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
socialmediamacroscope/histogram:0.1.26418f9bdb4d2
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
socialmediamacroscope/network_analysis:0.1.3b351c21422e6
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
socialmediamacroscope/preprocessing:0.1.3ca863306314b
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
socialmediamacroscope/topic_modeling:0.1.3fa490acac2f8
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
somnathmore/custom-nginx:v2bdfc06cad4ec
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
sonroyaalmerol/docker-sogo:5.12.43f60f3abe990
libpng1.6@1.6.48-1+deb13u1
1.6.48-1+deb13u4
1
speckle/speckle-preview-service:2.26.3092384dba45d
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
speckle/speckle-preview-service:2.23.14-branch.testing6.334655-b4e04ee6dee853ba74a
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
speckle/speckle-preview-service:2.25.10-branch.testing6.645-b125c1e787adcb20a3a
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1
stain/jena-fuseki:latestb1d0c96f19ad
libpng@1.6.43-r0
1.6.56-r0
1
stashapp/stash:latest24dbd7607174
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
stashapp/stash-box:latesta534c8afdf39
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
streamnative/private-cloud-console:v2.3.27-all91e54375e154
libpng@1.6.55-r0
1.6.56-r0
1
structurizr/onpremises:2025.11.094b5ffb5119c8
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
substratusai/verba:v0.4.0-baseURL261695be635eb
libpng1.6@1.6.39-2
1.6.39-2+deb12u4
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.