StackRadar

CVE-2026-36849

Medium

Advisory

Published 17 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
563
of 17,787 indexed, latest versions
Container images
450
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 563 of 17,787 indexed charts deploy, on 450 images.

Affected packageAffected versionsFixed inImages
tiffdeb4.0.3-7ubuntu0.9, 4.0.6-1ubuntu0.2, 4.0.6-1ubuntu0.4, 4.0.6-1ubuntu0.5+46 moreno fix listed450
OSV records
UBUNTU-CVE-2026-36849DEBIAN-CVE-2026-36849

Charts affected

563 by stars
ChartLatestAffected imagesRadar Score
ferriscompanyferriscompany0.1.01 of 1See more

ferriscompany ferriscompany 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
ghcr.io/libreconnect/ferriscompany:0.1.0-rc6ed86db9f0efe
tiff@4.5.0-6+deb12u1
no fix listed

Open the chart page →

10,741
fineractfineract-openshift0.1.11 of 4See more

fineract fineract-openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
tiff@4.7.0-3+deb13u3
no fix listed

Open the chart page →

7,792
business-api-ecosystemfiware1.1.02 of 4See more

business-api-ecosystem fiware 1.1.0

2 of the 4 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
tiff@4.1.0+git191117-2ubuntu0.20.04.14
no fix listed
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
tiff@4.5.0-6+deb12u2
no fix listed

Open the chart page →

64,489
dump1090fnzv0.2.81 of 1See more

dump1090 fnzv 0.2.8

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
fnzv/dump1090:latestb3079b95c336
tiff@4.3.0-6ubuntu0.7
no fix listed

Open the chart page →

4,077
changedetection-iogabe565Verified publisher0.12.01 of 2See more

changedetection-io gabe565 0.12.0

1 of the 2 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:latestecacd9fd0c66
tiff@4.5.0-6+deb12u4
no fix listed

Open the chart page →

2,595
scanservjsgabe565Verified publisher0.9.21 of 1See more

scanservjs gabe565 0.9.2

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
tiff@4.5.0-6
no fix listed

Open the chart page →

13,241
airsonicgeek-cookbookVerified publisher6.4.21 of 1See more

airsonic geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
tiff@4.1.0+git191117-2ubuntu0.20.04.1
no fix listed

Open the chart page →

18,230
booksonic-airgeek-cookbookVerified publisher6.4.21 of 1See more

booksonic-air geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/booksonic-air:version-v2009.1.0baa4fa9549dc
tiff@4.0.9-5ubuntu0.4
no fix listed

Open the chart page →

19,215
calibre-webgeek-cookbookVerified publisher8.4.21 of 1See more

calibre-web geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
linuxserver/calibre-web:version-0.6.12938810eca3d3
tiff@4.1.0+git191117-2ubuntu0.20.04.1
no fix listed

Open the chart page →

16,123
delugegeek-cookbookVerified publisher5.4.21 of 1See more

deluge geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
linuxserver/deluge:version-2.0.3-2201906121747ubuntu18.04.12ce561a95e7b
tiff@4.0.9-5ubuntu0.4
no fix listed

Open the chart page →

13,551
icinga2geek-cookbookVerified publisher4.2.01 of 1See more

icinga2 geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
jordan/icinga2:latestf75025fe8ea8
tiff@4.5.0-6+deb12u4
no fix listed

Open the chart page →

9,077
lidarrgeek-cookbookVerified publisher14.2.21 of 1See more

lidarr geek-cookbook 14.2.2

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/lidarr:v1.0.0.225554ebc1f90963
tiff@4.1.0+git191117-2ubuntu0.20.04.1
no fix listed

Open the chart page →

14,283
mopidygeek-cookbookVerified publisher0.1.21 of 1See more

mopidy geek-cookbook 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
jaedb/iris:latest048cfbf58d57
tiff@4.5.0-6+deb12u2
no fix listed

Open the chart page →

12,958
openkmgeek-cookbookVerified publisher4.2.01 of 1See more

openkm geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
openkm/openkm-ce:6.3.113bc465a7461b
tiff@4.1.0+git191117-2ubuntu0.20.04.3
no fix listed

Open the chart page →

27,949
photoprismgeek-cookbookVerified publisher7.2.01 of 1See more

photoprism geek-cookbook 7.2.0

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
photoprism/photoprism:220629-jammy2954334adbda
tiff@4.3.0-6
no fix listed

Open the chart page →

19,503
puppeteergeek-cookbookVerified publisher1.2.21 of 1See more

puppeteer geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
ghcr.io/jr0dd/puppeteer:v13.3.26047599cd78e
tiff@4.1.0+git191117-2ubuntu0.20.04.2
no fix listed

Open the chart page →

15,730
seafilegeek-cookbookVerified publisher3.2.01 of 1See more

seafile geek-cookbook 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
tiff@4.1.0+git191117-2ubuntu0.20.04.1
no fix listed

Open the chart page →

24,293
teedygeek-cookbookVerified publisher6.2.01 of 1See more

teedy geek-cookbook 6.2.0

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
sismics/docs:v1.10f4b0ef019cf1
tiff@4.0.9-5ubuntu0.4
no fix listed

Open the chart page →

26,944
xtevegeek-cookbookVerified publisher8.4.21 of 1See more

xteve geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/xteve:v2.2.0.200292b3614670f
tiff@4.1.0+git191117-2ubuntu0.20.04.3
no fix listed

Open the chart page →

17,929
goofy-chartgoofy-chart0.1.01 of 1See more

goofy-chart goofy-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
tiff@4.7.0-3+deb13u3
no fix listed

Open the chart page →

1,827
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-imageprovider4e322858fe56
tiff@4.5.0-6+deb12u1
no fix listed

Open the chart page →

49,025
video-analytics-demogpu-operator0.1.91 of 3See more

video-analytics-demo gpu-operator 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
tiff@4.7.0-3+deb13u3
no fix listed

Open the chart page →

15,722
video-analytics-demo-l4tgpu-operator0.1.31 of 3See more

video-analytics-demo-l4t gpu-operator 0.1.3

1 of the 3 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
tiff@4.7.0-3+deb13u3
no fix listed

Open the chart page →

1,827
web-checkhajowielandVerified publisher1.0.11 of 1See more

web-check hajowieland 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
ghcr.io/lissy93/web-check:latesta4e021c0f6a9
tiff@4.5.0-6+deb12u4
no fix listed

Open the chart page →

9,047
hawk-envoy-pluginhawk0.1.01 of 4See more

hawk-envoy-plugin hawk 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
kong/httpbin:latesta6ac46531193
tiff@4.3.0-6ubuntu0.10
no fix listed

Open the chart page →

9,096
web-charthcpark-ktcloudlab0.1.01 of 1See more

web-chart hcpark-ktcloudlab 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
tiff@4.7.0-3+deb13u3
no fix listed

Open the chart page →

1,827
heliconehelicone0.1.421 of 14See more

helicone helicone 0.1.42

1 of the 14 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
helicone/supabase-migration-runner:v2025.03.05-14a913936c97b
tiff@4.5.0-6
no fix listed

Open the chart page →

24,995
test-apphellnet0.1.11 of 1See more

test-app hellnet 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
tiff@4.7.0-3+deb13u3
no fix listed

Open the chart page →

1,827
hello-worldhello-world-pponyVerified publisher0.3.01 of 1See more

hello-world hello-world-ppony 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
library/nginx:1.25.49ff236ed47fe
tiff@4.5.0-6+deb12u1
no fix listed

Open the chart page →

5,839
7dtdhelm-7dtd0.1.01 of 1See more

7dtd helm-7dtd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
vinanrra/7dtd-server:v0.4.4f9534490bd2b
tiff@4.0.9-5ubuntu0.9
no fix listed

Open the chart page →

10,627
hello-world-charthelm-chart-test-hello-world0.1.01 of 1See more

hello-world-chart helm-chart-test-hello-world 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
tiff@4.7.0-3+deb13u3
no fix listed

Open the chart page →

1,827
my-apphelm-demo85640.2.71 of 2See more

my-app helm-demo8564 0.2.7

1 of the 2 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
tiff@4.7.0-3+deb13u3
no fix listed

Open the chart page →

1,827
chart-bookhelm-deploy-book0.1.01 of 3See more

chart-book helm-deploy-book 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
dannielkil/book-frontend:latest937993927694
tiff@4.5.0-6+deb12u1
no fix listed

Open the chart page →

9,122
archiveboxhelmforgeVerified publisher1.1.121 of 1See more

archivebox helmforge 1.1.12

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
archivebox/archivebox:0.7.41a5a37331091
tiff@4.5.0-6+deb12u4
no fix listed

Open the chart page →

7,633
castopodhelmforgeVerified publisher1.2.71 of 3See more

castopod helmforge 1.2.7

1 of the 3 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
castopod/castopod:1.15.54e4f0440520f
tiff@4.7.0-3+deb13u1
no fix listed

Open the chart page →

9,342
changedetectionhelmforgeVerified publisher1.1.151 of 1See more

changedetection helmforge 1.1.15

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.3ecacd9fd0c66
tiff@4.5.0-6+deb12u4
no fix listed

Open the chart page →

2,595
chiefonboardinghelmforgeVerified publisher1.1.141 of 3See more

chiefonboarding helmforge 1.1.14

1 of the 3 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
tiff@4.7.0-3+deb13u1
no fix listed

Open the chart page →

10,849
countlyhelmforgeVerified publisher1.2.61 of 3See more

countly helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
tiff@4.1.0+git191117-2ubuntu0.20.04.13
no fix listed

Open the chart page →

18,813
dawarichhelmforgeVerified publisher1.0.01 of 4See more

dawarich helmforge 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
postgis/postgis:18-3.67e00e8c3539f
tiff@4.7.0-3+deb13u3
no fix listed

Open the chart page →

4,742
discount-bandithelmforgeVerified publisher2.0.81 of 3See more

discount-bandit helmforge 2.0.8

1 of the 3 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
cybrarist/discount-bandit:v4.0.4e9e2447ac666
tiff@4.7.0-3+deb13u2
no fix listed

Open the chart page →

29,817
entehelmforgeVerified publisher1.0.21 of 4See more

ente helmforge 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
ghcr.io/ente/web:5ab0c5b4c7a89c4e470ef6f793600da33cebf35d3f4864eb7f11
tiff@4.7.0-3+deb13u3
no fix listed

Open the chart page →

4,201
generichelmforgeVerified publisher3.1.51 of 1See more

generic helmforge 3.1.5

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
library/nginx:1.31.505b8cb60c354
tiff@4.7.0-3+deb13u3
no fix listed

Open the chart page →

1,827
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
tiff@4.7.0-3+deb13u2
no fix listed

Open the chart page →

11,042
medikeephelmforgeVerified publisher2.0.01 of 3See more

medikeep helmforge 2.0.0

1 of the 3 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
ghcr.io/afairgiant/medikeep:v0.69.0766699daa9ac
tiff@4.5.0-6+deb12u4
no fix listed

Open the chart page →

6,022
minecrafthelmforgeVerified publisher1.5.31 of 1See more

minecraft helmforge 1.5.3

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
itzg/minecraft-server:2026.9.04e29d14082d9
tiff@4.5.1+git230720-4ubuntu2.5
no fix listed

Open the chart page →

4,639
moodlehelmforgeVerified publisher1.1.01 of 2See more

moodle helmforge 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
moodlehq/moodle-php-apache:8.4-bookworm922af5166835
tiff@4.5.0-6+deb12u4
no fix listed

Open the chart page →

6,103
uptime-kumahelmforgeVerified publisher1.5.121 of 1See more

uptime-kuma helmforge 1.5.12

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.33e24e96c89ef
tiff@4.5.0-6+deb12u4
no fix listed

Open the chart page →

30,099
myapphelmingapp0.1.01 of 1See more

myapp helmingapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
muhammedgamal/fp23:latest74b4cd69b6fa
tiff@4.5.0-6+deb12u1
no fix listed

Open the chart page →

12,607
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
tiff@4.5.0-6+deb12u2
no fix listed

Open the chart page →

25,017
svacerhelm-svacer0.6.01 of 1See more

svacer helm-svacer 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-36849.

Container imageDigestPackageFixed in
ispras/svacer:11-2-042aa9fa9f189
tiff@4.3.0-6ubuntu0.10
no fix listed

Open the chart page →

6,015

Container images carrying it

450 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

No deployed image carries CVE-2026-36849.

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.