StackRadar

CVE-2026-33999

High

Advisory

Published 14 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
29
of 17,781 indexed, latest versions
Container images
26
deployed by those charts
Fix available
1 of 1
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 29 of 17,781 indexed charts deploy, on 26 images.

Affected packageAffected versionsFixed inImages
xorg-serverdeb2:1.18.4-0ubuntu0.7, 2:1.19.6-1ubuntu4.3, 2:1.19.6-1ubuntu4.9, 2:1.20.11-1ubuntu1~20.04.2+13 more2:21.1.7-3+deb12u12, 2:21.1.16-1.3+deb13u226
OSV records
DEBIAN-CVE-2026-33999UBUNTU-CVE-2026-33999

Charts affected

29 by stars
ChartLatestAffected imagesRadar Score
penpotpenpotOfficialVerified publisher1.9.01 of 4See more

penpot penpot 1.9.0

1 of the 4 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
penpotapp/exporter:2.17.272a8061e8806
xorg-server@2:21.1.22-1ubuntu1
no fix listed

Open the chart page →

4,314
openclawopenclawVerified publisher1.91.31 of 2See more

openclaw openclaw 1.91.3

1 of the 2 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed

Open the chart page →

2,977
selenium-gridselenium-grid0.59.12 of 4See more

selenium-grid selenium-grid 0.59.1

2 of the 4 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
selenium/node-chrome:4.48.0-202609055ac71fd8dd1e
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed
selenium/node-firefox:4.48.0-2026090574a5c1c90f95
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed

Open the chart page →

7,028
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.55.42ed0183564d7
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed

Open the chart page →

9,460
calibregeek-cookbookVerified publisher5.4.21 of 1See more

calibre geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
linuxserver/calibre:version-v5.21.0a847b5b2d860
xorg-server@2:1.19.6-1ubuntu4.9
no fix listed

Open the chart page →

22,773
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
xorg-server@2:1.20.11-1ubuntu1~20.04.2
no fix listed

Open the chart page →

24,488
flaresolverrlib42Verified publisher2.0.01 of 1See more

flaresolverr lib42 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
ghcr.io/flaresolverr/flaresolverr:v3.4.0ab535d1fef5d
xorg-server@2:21.1.7-3+deb12u10
2:21.1.7-3+deb12u12

Open the chart page →

35,050
napcatredish101Verified publisher0.1.31 of 1See more

napcat redish101 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
mlikiowa/napcat-docker:latest1336a777f9a4
xorg-server@2:21.1.4-2ubuntu1.7~22.04.12
no fix listed

Open the chart page →

7,405
browserlessalekcVerified publisher1.2.71 of 1See more

browserless alekc 1.2.7

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
ghcr.io/browserless/chrome:v2.56.7d600eac6283f
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed

Open the chart page →

2,078
webpagetest-agentcloudnativeapp0.2.01 of 1See more

webpagetest-agent cloudnativeapp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
xorg-server@2:1.18.4-0ubuntu0.7
no fix listed

Open the chart page →

77,758
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
xorg-server@2:21.1.7-3+deb12u8
2:21.1.7-3+deb12u12

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
xorg-server@2:21.1.7-3+deb12u8
2:21.1.7-3+deb12u12

Open the chart page →

9,607
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
xorg-server@2:1.20.13-1ubuntu1~20.04.20
no fix listed

Open the chart page →

64,489
openkmgeek-cookbookVerified publisher4.2.01 of 1See more

openkm geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
openkm/openkm-ce:6.3.113bc465a7461b
xorg-server@2:1.20.13-1ubuntu1~20.04.3
no fix listed

Open the chart page →

27,949
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-loadgenerator85c9935ff31b
xorg-server@2:21.1.7-3+deb12u8
2:21.1.7-3+deb12u12

Open the chart page →

49,025
openaevhelm-openbasVerified publisher2.0.51 of 7See more

openaev helm-openbas 2.0.5

1 of the 7 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
openaev/platform:3.260904.00a12ce8b3db9
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed

Open the chart page →

7,437
browserlessicoretechVerified publisher0.16.61 of 1See more

browserless icoretech 0.16.6

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed

Open the chart page →

1,948
flaresolverrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

flaresolverr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
ghcr.io/flaresolverr/flaresolverr:v3.4.67962759d99d7
xorg-server@2:21.1.7-3+deb12u11
2:21.1.7-3+deb12u12

Open the chart page →

33,583
kubernetes-kiosk-chromiumkubernetes-kiosk-chromium0.1.21 of 1See more

kubernetes-kiosk-chromium kubernetes-kiosk-chromium 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
ghcr.io/yurymkomarov/docker/kubernetes-kiosk-chromium:0.1.27bff29dcec72
xorg-server@2:21.1.7-3+deb12u11
2:21.1.7-3+deb12u12

Open the chart page →

28,843
core-keeper-dedicatednerkho-helm-charts0.1.11 of 1See more

core-keeper-dedicated nerkho-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
escaping/core-keeper-dedicated:latest87fa79255962
xorg-server@2:21.1.16-1.3+deb13u1
2:21.1.16-1.3+deb13u2

Open the chart page →

3,891
splashntppoolVerified publisher1.0.41 of 1See more

splash ntppool 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
scrapinghub/splash:3.4.1a5f89bc84606
xorg-server@2:1.19.6-1ubuntu4.3
no fix listed

Open the chart page →

27,633
javareact-java0.1.01 of 1See more

java react-java 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
project2team4/react:latest3ff031a08887
xorg-server@2:1.20.13-1ubuntu1~20.04.2
no fix listed

Open the chart page →

15,520
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
xorg-server@2:21.1.7-3+deb12u8
2:21.1.7-3+deb12u12

Open the chart page →

9,607
stirling-pdfrubxkubeVerified publisher0.1.21 of 1See more

stirling-pdf rubxkube 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
xorg-server@2:21.1.12-1ubuntu1.5
no fix listed

Open the chart page →

6,207
suwayomirubxkubeVerified publisher0.1.21 of 1See more

suwayomi rubxkube 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
ghcr.io/suwayomi/suwayomi-server:v2.3.2320d2c3218c7f9f
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed

Open the chart page →

1,610
vrisingryuunosukeds30.1.01 of 1See more

vrising ryuunosukeds3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
trueosiris/vrising:latest9356f98ad561
xorg-server@2:21.1.4-2ubuntu1.7~22.04.16
no fix listed

Open the chart page →

7,295
flaresolverrsudo-kraken-flaresolverrVerified publisher2.1.41 of 1See more

flaresolverr sudo-kraken-flaresolverr 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
ghcr.io/flaresolverr/flaresolverr:v3.4.67962759d99d7
xorg-server@2:21.1.7-3+deb12u11
2:21.1.7-3+deb12u12

Open the chart page →

33,583
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
xorg-server@2:21.1.12-1ubuntu1.5
no fix listed

Open the chart page →

4,305
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-33999.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
xorg-server@2:21.1.4-2ubuntu1.7~22.04.10
no fix listed

Open the chart page →

14,100

Container images carrying it

26 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/ai-agent:0.0.16545dac92173
xorg-server@2:21.1.7-3+deb12u8
2:21.1.7-3+deb12u12
3
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed
2
ghcr.io/flaresolverr/flaresolverr:v3.4.67962759d99d7
xorg-server@2:21.1.7-3+deb12u11
2:21.1.7-3+deb12u12
2
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
xorg-server@2:1.20.11-1ubuntu1~20.04.2
no fix listed
1
escaping/core-keeper-dedicated:latest87fa79255962
xorg-server@2:21.1.16-1.3+deb13u1
2:21.1.16-1.3+deb13u2
1
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
xorg-server@2:1.20.13-1ubuntu1~20.04.20
no fix listed
1
linuxserver/calibre:version-v5.21.0a847b5b2d860
xorg-server@2:1.19.6-1ubuntu4.9
no fix listed
1
mlikiowa/napcat-docker:latest1336a777f9a4
xorg-server@2:21.1.4-2ubuntu1.7~22.04.12
no fix listed
1
openaev/platform:3.260904.00a12ce8b3db9
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed
1
openkm/openkm-ce:6.3.113bc465a7461b
xorg-server@2:1.20.13-1ubuntu1~20.04.3
no fix listed
1
penpotapp/exporter:2.17.272a8061e8806
xorg-server@2:21.1.22-1ubuntu1
no fix listed
1
project2team4/react:latest3ff031a08887
xorg-server@2:1.20.13-1ubuntu1~20.04.2
no fix listed
1
scrapinghub/splash:3.4.1a5f89bc84606
xorg-server@2:1.19.6-1ubuntu4.3
no fix listed
1
selenium/node-chrome:4.48.0-202609055ac71fd8dd1e
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed
1
selenium/node-firefox:4.48.0-2026090574a5c1c90f95
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
xorg-server@2:1.18.4-0ubuntu0.7
no fix listed
1
trueosiris/vrising:latest9356f98ad561
xorg-server@2:21.1.4-2ubuntu1.7~22.04.16
no fix listed
1
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
xorg-server@2:21.1.4-2ubuntu1.7~22.04.10
no fix listed
1
ghcr.io/browserless/chrome:v2.56.7d600eac6283f
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed
1
ghcr.io/browserless/chromium:v2.55.42ed0183564d7
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed
1
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
xorg-server@2:21.1.12-1ubuntu1.5
no fix listed
1
ghcr.io/flaresolverr/flaresolverr:v3.4.0ab535d1fef5d
xorg-server@2:21.1.7-3+deb12u10
2:21.1.7-3+deb12u12
1
ghcr.io/open-telemetry/demo:1.12.0-loadgenerator85c9935ff31b
xorg-server@2:21.1.7-3+deb12u8
2:21.1.7-3+deb12u12
1
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
xorg-server@2:21.1.12-1ubuntu1.5
no fix listed
1
ghcr.io/suwayomi/suwayomi-server:v2.3.2320d2c3218c7f9f
xorg-server@2:21.1.12-1ubuntu1.6
no fix listed
1
ghcr.io/yurymkomarov/docker/kubernetes-kiosk-chromium:0.1.27bff29dcec72
xorg-server@2:21.1.7-3+deb12u11
2:21.1.7-3+deb12u12
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.