StackRadar

CVE-2026-34990

High

Advisory

Published 3 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
206
of 17,781 indexed, latest versions
Container images
177
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 206 of 17,781 indexed charts deploy, on 177 images.

Affected packageAffected versionsFixed inImages
cupsdeb2.1.3-4ubuntu0.3, 2.1.3-4ubuntu0.4, 2.1.3-4ubuntu0.7, 2.1.3-4ubuntu0.10+29 more2.4.1op1-1ubuntu4.20, 2.4.7-1.2ubuntu7.13, 2.4.12-0ubuntu3.9, 2.4.16-1ubuntu1.2167
cupsapk2.4.11-r02.4.18-r010
OSV records
UBUNTU-CVE-2026-34990ALPINE-CVE-2026-34990DEBIAN-CVE-2026-34990
Also known as
USN-8405-1

Charts affected

206 by stars
ChartLatestAffected imagesRadar Score
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-34990.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
cups@2.4.7-1.2ubuntu7.9
2.4.7-1.2ubuntu7.13

Open the chart page →

4,305
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-34990.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
cups@2.4.7-1.2ubuntu7.3
2.4.7-1.2ubuntu7.13

Open the chart page →

7,628
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-34990.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
cups@2.3.1-9ubuntu1.1
no fix listed

Open the chart page →

14,364
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-34990.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
cups@2.3.1-9ubuntu1.1
no fix listed

Open the chart page →

28,605
Wordpresswordpress-mariadb1.0.21 of 2See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-34990.

Container imageDigestPackageFixed in
library/wordpress:latest5a93c470ae82
cups@2.4.10-3+deb13u2
no fix listed

Open the chart page →

5,560
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-34990.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
cups@2.4.1op1-1ubuntu4.10
2.4.1op1-1ubuntu4.20

Open the chart page →

14,100

Container images carrying it

177 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
cups@2.4.10-3+deb13u2
no fix listed
7
library/wordpress:7.1.0-apache:latest5a93c470ae82
cups@2.4.10-3+deb13u2
no fix listed
6
flaresolverr/flaresolverr:latest:v3.5.0139dfee1c6f8
cups@2.4.2-3+deb12u9
no fix listed
5
hyperledger/fabric-ca-tools:latest4ce6f43ded2e
cups@2.1.3-4ubuntu0.4
no fix listed
4
hyperledger/fabric-couchdb:0.4.15f6c724592abf
cups@2.1.3-4ubuntu0.7
no fix listed
4
gchq/hdfs:3.3.35ec58edbb2db
cups@2.4.7-1.2ubuntu7.3
2.4.7-1.2ubuntu7.13
3
jacobalberty/unifi:v10.0.162896c0ab82d33
cups@2.3.1-9ubuntu1.9
no fix listed
3
omecproject/cdn-video-repo:1.0.0:remote-v3d59ccb138ffb
cups@2.1.3-4ubuntu0.7
no fix listed
3
selenium/hub:3.141.5902f251d48d5f
cups@2.3.1-9ubuntu1.1
no fix listed
3
quay.io/devtron/ai-agent:0.0.16545dac92173
cups@2.4.2-3+deb12u8
no fix listed
3
gotenberg/gotenberg:8.36.087c16b9f3642
cups@2.4.10-3+deb13u2
no fix listed
2
gotenberg/gotenberg:8:8.37.0f29984bd1e22
cups@2.4.10-3+deb13u2
no fix listed
2
hookiesolutions/webhookie:latest0629694246ba
cups@2.3.1-9ubuntu1.1
no fix listed
2
hyperledger/besu:22.4-openjdk-latesta674d35eec9a
cups@2.3.1-9ubuntu1.2
no fix listed
2
kurento/kurento-media-server:latest03c0d34d0828
cups@2.4.7-1.2ubuntu7.4
2.4.7-1.2ubuntu7.13
2
library/redmine:6.1.3-trixief474a901faec
cups@2.4.10-3+deb13u2
no fix listed
2
library/wordpress:6.8.3-apache:6.8-apache30bff39330d1
cups@2.4.10-3+deb13u2
no fix listed
2
louislam/uptime-kuma:2.5.4917318f9d7be
cups@2.4.2-3+deb12u9
no fix listed
2
louislam/uptime-kuma:2.3.29aeb4e51d038
cups@2.4.2-3+deb12u9
no fix listed
2
louislam/uptime-kuma:2.5.0a8610b3b4c38
cups@2.4.2-3+deb12u9
no fix listed
2
mbentley/omada-controller:4.3f4e682274bed
cups@2.2.7-1ubuntu2.10
no fix listed
2
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d469:2.18.12-branch.testing3.88744-f55b3414bd113093583
cups@2.4.2-3+deb12u5
no fix listed
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
cups@2.4.7-1.2ubuntu7.3
2.4.7-1.2ubuntu7.13
2
ghcr.io/flaresolverr/flaresolverr:v3.4.67962759d99d7
cups@2.4.2-3+deb12u9
no fix listed
2
ghcr.io/flaresolverr/flaresolverr:v3.5.2c80ae007ce2c
cups@2.4.2-3+deb12u9
no fix listed
2
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
cups@2.3.1-9ubuntu1.1
no fix listed
2
ghcr.io/games-on-whales/steam:1.0.09b6105be7ad0
cups@2.3.1-9ubuntu1.1
no fix listed
2
ghcr.io/lissy93/web-check:latesta4e021c0f6a9
cups@2.4.2-3+deb12u9
no fix listed
2
ghcr.io/openunison/openunison-kubernetes-operator:1.0.11f4feb3323a29
cups@2.4.7-1.2ubuntu7.9
2.4.7-1.2ubuntu7.13
2
ghcr.io/smarter-project/hydra/isolated-vm:main4457b79b24cd
cups@2.4.2-3+deb12u9
no fix listed
2
1dev/server:11.9.0cd5b12fe5471
cups@2.4.7-1.2ubuntu7.3
2.4.7-1.2ubuntu7.13
1
5200710/hadoop:3.2.3-java8092d3088a5fb
cups@2.3.1-9ubuntu1.6
no fix listed
1
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
cups@2.4.10-3+deb13u2
no fix listed
1
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
cups@2.4.11-r0
2.4.18-r0
1
andrewmackrodt/firefox-x11:142.0.1-r133f9080470c9
cups@2.4.1op1-1ubuntu4.11
2.4.1op1-1ubuntu4.20
1
anguda/ant-media:2.5c435285fc241
cups@2.3.1-9ubuntu1.2
no fix listed
1
anujdatar/cups:25.07.01685df04a643b
cups@2.4.2-3+deb12u8
no fix listed
1
apachepulsar/pulsar:2.10.03b262ab7a7d9
cups@2.3.1-9ubuntu1.1
no fix listed
1
apachepulsar/pulsar:2.9.0d056c89b7131
cups@2.3.1-9ubuntu1.1
no fix listed
1
apachepulsar/pulsar:2.8.2d538416d5afe
cups@2.3.1-9ubuntu1.1
no fix listed
1
apache/tika:2.9.0.092d055a84e9e
cups@2.4.1op1-1ubuntu4.4
2.4.1op1-1ubuntu4.20
1
archivebox/archivebox:0.7.41a5a37331091
cups@2.4.2-3+deb12u9
no fix listed
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
cups@2.3.1-9ubuntu1.1
no fix listed
1
castopod/castopod:1.15.54e4f0440520f
cups@2.4.10-3+deb13u2
no fix listed
1
cheyang/distributed-tf:1.6.046cc34755493
cups@2.1.3-4ubuntu0.4
no fix listed
1
codedesignplus/ms-emails-grpc:lateste336012bc781
cups@2.4.2-3+deb12u9
no fix listed
1
codedesignplus/ms-emails-rest:latestac84661c605e
cups@2.4.2-3+deb12u9
no fix listed
1
countly/countly-server:25.05.4e3c238248f99
cups@2.3.1-9ubuntu1.8
no fix listed
1
cybrarist/discount-bandit:v4.0.4e9e2447ac666
cups@2.4.10-3+deb13u2
no fix listed
1
deconzcommunity/deconz:2.29.2062de2362641
cups@2.4.2-3+deb12u8
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.