StackRadar

CVE-2026-34757

Medium

Advisory

Published 9 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.1
base score, highest
EPSS
0.002
9th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
759
of 17,787 indexed, latest versions
Container images
697
deployed by those charts
Fix available
4 of 4
affected packages

Security update for libpng16

Carried by container images the latest versions of 759 of 17,787 indexed charts deploy, on 697 images.

Affected packageAffected versionsFixed inImages
libpng1.6deb1.6.34-1ubuntu0.18.04.1, 1.6.34-1ubuntu0.18.04.2, 1.6.37-2, 1.6.37-3build5+14 more1.6.34-1ubuntu0.18.04.2+esm3, 1.6.37-2ubuntu0.1~esm3, 1.6.37-3ubuntu0.5, 1.6.39-2+deb12u5+3 more530
libpngdeb1.2.50-1ubuntu2, 1.2.50-1ubuntu2.14.04.2, 1.2.50-1ubuntu2.14.04.3, 1.2.54-1ubuntu1+1 more1.2.50-1ubuntu2.14.04.3+esm2, 1.2.54-1ubuntu1.1+esm320
libpngapk1.6.43-r0, 1.6.44-r0, 1.6.45-r0, 1.6.47-r0+4 more1.6.57-r0146
libpng16rpm1.6.40-150600.1.31.6.40-150600.3.20.11
OSV records
ALPINE-CVE-2026-34757DEBIAN-CVE-2026-34757UBUNTU-CVE-2026-34757SUSE-SU-2026:1602-1
Also known as
USN-8251-1, USN-8639-1

Charts affected

759 by stars
ChartLatestAffected imagesRadar Score
pageswalter1.0.02 of 3See more

pages walter 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-34757.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
flyway/flyway:6.4.422d97ceb0c47
libpng1.6@1.6.34-1ubuntu0.18.04.2
1.6.34-1ubuntu0.18.04.2+esm3

Open the chart page →

20,190
web-dvwaweb-dvwa1.16.01 of 2See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-34757.

Container imageDigestPackageFixed in
gulacedia/web-dvwa-new:v367b467d961ca
libpng1.6@1.6.39-2
1.6.39-2+deb12u5

Open the chart page →

10,001
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-34757.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

14,364
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-34757.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

28,605
jaegerwikimedia3.1.21 of 4See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-34757.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5

Open the chart page →

9,248
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-34757.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

6,285
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-34757.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5

Open the chart page →

14,100
tabbyxdVerified publisher1.0.61 of 2See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-34757.

Container imageDigestPackageFixed in
library/nginx:1.25a484819eb602
libpng1.6@1.6.39-2
1.6.39-2+deb12u5

Open the chart page →

7,673
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-34757.

Container imageDigestPackageFixed in
hamzaarshad10/queryfrontend:1.1.5.14cd359d9a78c3
libpng@1.6.44-r0
1.6.57-r0

Open the chart page →

13,677

Container images carrying it

697 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
louislam/uptime-kuma:2.3.29aeb4e51d038
libpng1.6@1.6.39-2+deb12u4
1.6.39-2+deb12u5
2
mbentley/omada-controller:4.3f4e682274bed
libpng1.6@1.6.34-1ubuntu0.18.04.2
1.6.34-1ubuntu0.18.04.2+esm3
2
moreillon/group-manager-front:v3.3.1c9f85db3baa5
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
moreillon/user-manager:v5.0.2e1c9bfab5c16
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
moreillon/user-manager-front:v5.0.3b067dbbbb6af
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
nginxinc/nginx-unprivileged:1.27-alpine65e3e85dbaed
libpng@1.6.47-r0
1.6.57-r0
2
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
2
opea/chatqna-conversation-ui:1.002d5674ca863
libpng@1.6.43-r0
1.6.57-r0
2
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
libpng@1.6.44-r0
1.6.57-r0
2
opencloudeu/web-extensions:unzip-1.0.01691ad6612a3
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
opencloudeu/web-extensions:draw-io-1.0.027cb9b952f0d
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
opencloudeu/web-extensions:external-sites-1.0.05b176baa3694
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
opencloudeu/web-extensions:importer-1.0.06e8b2df6c5a4
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
opencloudeu/web-extensions:progress-bars-1.0.082f888a34440
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
opencloudeu/web-extensions:json-viewer-1.0.0e0ac35a9576e
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
opendatacube/ows:latest668cbb41473c
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
2
piomin/sample-spring-kotlin-microservice:1.1871f784dd6bc
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
2
qichenxu4pd/pythonexample:1.0f3a8502bc21b
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d469:2.18.12-branch.testing3.88744-f55b3414bd113093583
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
vdiogov/glpi-conteiner:latest6945f84f0058
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
wurstmeister/zookeeper:latest7a7fd44a7210
libpng@1.2.50-1ubuntu2
1.2.50-1ubuntu2.14.04.3+esm2
2
ghcr.io/appscode/inbox-server:latest:postgres-latest536358d7b17e
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
2
ghcr.io/codingducksrl/laravel:8.15be52524664c
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
2
ghcr.io/flaresolverr/flaresolverr:v3.4.67962759d99d7
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
2
ghcr.io/games-on-whales/steam:1.0.09b6105be7ad0
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
2
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway:unprivileged-oss:unprivileged-oss-202503313db8145349a3
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
2
ghcr.io/salaboy/fmtok8s-frontend:v0.1.103fd01b4f56e
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
2
ghcr.io/smarter-project/hydra/isolated-vm:main4457b79b24cd
libpng1.6@1.6.39-2+deb12u3
1.6.39-2+deb12u5
2
registry.gitlab.com/shortlink-org/shortlink/ui:main9bdb1062d960
libpng@1.6.55-r0
1.6.57-r0
2
1dev/server:11.9.0cd5b12fe5471
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
5200710/hadoop:3.2.3-java8092d3088a5fb
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
adorsys/keycloak-config-cli:6.3.0-26.1.085be7a45a94c
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
adorsys/keycloak-config-cli:6.1.6-25.0.1eb49a2dcbbb8
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
ahmetfurkandemir/iceberg-rest-fixture-postgresql:1.10.0142231a0b8b7
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
akaunting/akaunting:3.0.1552811b36ec3a
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
1
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
libpng@1.6.47-r0
1.6.57-r0
1
aktosecurity/data-ingestion-service213aded7adc5
libpng1.6@1.6.43-5ubuntu0.3
1.6.43-5ubuntu0.6
1
allegroai/clearml:2.0.0-613713ae38f7daf
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
1
andrewgaul/s3proxy:sha-85b0f987dc1d34174a5
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
andrewgolikov55/intel-gpu-exporter:latestfcc001b61c0e
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
andrewmackrodt/firefox-x11:142.0.1-r133f9080470c9
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.5
1
anguda/ant-media:2.5c435285fc241
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
anujdatar/cups:25.07.01685df04a643b
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
1
apache/activemq-artemis:2.44.00305c26f19ed
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
apache/activemq-artemis:2.37.0bae523439ee3
libpng1.6@1.6.43-5build1
1.6.43-5ubuntu0.6
1
apache/druid:29.0.10cef139b6bf1
libpng1.6@1.6.39-2
1.6.39-2+deb12u5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.