CVE-2026-39316

Medium

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.2; base score, highest
EPSS: 0.002; 7th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 206; of 17,781 indexed, latest versions
Container images: 177; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 206 of 17,781 indexed charts deploy, on 177 images.

Affected package	Affected versions	Fixed in	Images
cupsdeb	2.1.3-4ubuntu0.3, 2.1.3-4ubuntu0.4, 2.1.3-4ubuntu0.7, 2.1.3-4ubuntu0.10+29 more	2.4.1op1-1ubuntu4.20, 2.4.7-1.2ubuntu7.13, 2.4.12-0ubuntu3.9, 2.4.16-1ubuntu1.2	167
cupsapk	2.4.11-r0	2.4.18-r0	10

OSV records: ALPINE-CVE-2026-39316 DEBIAN-CVE-2026-39316 UBUNTU-CVE-2026-39316
Also known as: USN-8405-1

Charts affected

206 by stars

Chart

Latest

Affected images

Radar Score

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39316.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	cups@2.4.7-1.2ubuntu7.9	2.4.7-1.2ubuntu7.13

Open the chart page →

4,305

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-39316.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	cups@2.4.7-1.2ubuntu7.3	2.4.7-1.2ubuntu7.13

Open the chart page →

7,628

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39316.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	cups@2.3.1-9ubuntu1.1	no fix listed

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-39316.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	cups@2.3.1-9ubuntu1.1	no fix listed

Open the chart page →

28,605

Wordpresswordpress-mariadb

1.0.2

1 of 2 See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-39316.

Container image	Digest	Package	Fixed in
library/wordpress :latest	5a93c470ae82	cups@2.4.10-3+deb13u2	no fix listed

Open the chart page →

5,560

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39316.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	cups@2.4.1op1-1ubuntu4.10	2.4.1op1-1ubuntu4.20

Open the chart page →

14,100

Container images carrying it

177 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
fiware/biz-ecosystem-charging-backend :11.7.0	29456835bb2c	cups@2.3.1-9ubuntu1.9	no fix listed	1
fluent/fluent-bit :4.0-debug	e76397ef3983	cups@2.4.2-3+deb12u9	no fix listed	1
gchq/accumulo :2.0.1	c460bb587d6d	cups@2.4.7-1.2ubuntu7.3	2.4.7-1.2ubuntu7.13	1
gotenberg/gotenberg :8.30	206a6c708fc6	cups@2.4.10-3+deb13u2	no fix listed	1
gotenberg/gotenberg :8.34	67097317623a	cups@2.4.10-3+deb13u2	no fix listed	1
gotenberg/gotenberg :8-chromium	a40f92d7419a	cups@2.4.10-3+deb13u2	no fix listed	1
hyperledger/fabric-couchdb :0.4.10	c65891b6c237	cups@2.1.3-4ubuntu0.4	no fix listed	1
ispras/svacer :11-2-0	42aa9fa9f189	cups@2.4.1op1-1ubuntu4.11	2.4.1op1-1ubuntu4.20	1
jacobalberty/unifi :v7.1.66	4a3616625dda	cups@2.2.7-1ubuntu2.8	no fix listed	1
jacobalberty/unifi :v7.4.162	b3edc809a3ff	cups@2.2.7-1ubuntu2.10	no fix listed	1
jacobalberty/unifi :5.10.19	c409924e2463	cups@2.1.3-4ubuntu0.7	no fix listed	1
jaedb/iris :latest	048cfbf58d57	cups@2.4.2-3+deb12u8	no fix listed	1
jlesage/firefox :v25.03.1	055c28defe31	cups@2.4.11-r0	2.4.18-r0	1
jordan/icinga2 :latest	f75025fe8ea8	cups@2.4.2-3+deb12u9	no fix listed	1
kinseii/wazuh-agent :4.14.1	7160eb143728	cups@2.4.2-3+deb12u9	no fix listed	1
langgenius/dify-plugin-daemon :0.5.1-local	8269050f192e	cups@2.4.7-1.2ubuntu7.9	2.4.7-1.2ubuntu7.13	1
library/redmine :6.1.2	04ac44a2595b	cups@2.4.10-3+deb13u2	no fix listed	1
library/wordpress :6.4.3-apache	8ae66efb09a2	cups@2.4.2-3+deb12u5	no fix listed	1
library/wordpress :6.9.4-fpm	ad4a8bae2eb4	cups@2.4.10-3+deb13u2	no fix listed	1
library/wordpress :php8.1-apache	f73396626d2f	cups@2.4.10-3+deb13u2	no fix listed	1
linuxserver/calibre :version-v5.21.0	a847b5b2d860	cups@2.2.7-1ubuntu2.8	no fix listed	1
linuxserver/calibre-web :0.6.24	241009026e6f	cups@2.4.7-1.2ubuntu7.3	2.4.7-1.2ubuntu7.13	1
linuxserver/calibre-web :version-0.6.12	938810eca3d3	cups@2.3.1-9ubuntu1.1	no fix listed	1
linuxserver/lazylibrarian :version-1152df82	f93d2560e233	cups@2.2.7-1ubuntu2.8	no fix listed	1
linuxserver/unifi-controller :8.0.24	0ae315a3a456	cups@2.3.1-9ubuntu1.6	no fix listed	1
linuxserver/unifi-controller :7.3.83	ab105cc50322	cups@2.3.1-9ubuntu1.2	no fix listed	1
louislam/uptime-kuma :2.5.3	3e24e96c89ef	cups@2.4.2-3+deb12u9	no fix listed	1
louislam/uptime-kuma :2.0.2	4c364ef96aad	cups@2.4.2-3+deb12u9	no fix listed	1
louislam/uptime-kuma :2.4.0	91e963bfda56	cups@2.4.2-3+deb12u9	no fix listed	1
merlos/zookeeper :3.9.3	a38fc7e09ed7	cups@2.4.2-3+deb12u8	no fix listed	1
mlikiowa/napcat-docker :latest	1336a777f9a4	cups@2.4.1op1-1ubuntu4.11	2.4.1op1-1ubuntu4.20	1
moodlehq/moodle-php-apache :8.4-bookworm	922af5166835	cups@2.4.2-3+deb12u9	no fix listed	1
nousresearch/hermes-agent :v2026.8.27	e0df6adebddf	cups@2.4.10-3+deb13u2	no fix listed	1
omecproject/cdn-antmedia :1.0.0	b4ae7d0d6b74	cups@2.2.7-1ubuntu2.5	no fix listed	1
oneuptime/probe :release	6b2d98713711	cups@2.4.2-3+deb12u9	no fix listed	1
onyxdotapp/onyx-backend :latest	473fdffe4e67	cups@2.4.10-3+deb13u2	no fix listed	1
openhab/openhab :5.2.1	bfd4a60e90da	cups@2.4.10-3+deb13u2	no fix listed	1
openkm/openkm-ce :6.3.11	3bc465a7461b	cups@2.3.1-9ubuntu1.2	no fix listed	1
owncloud/server :10.15.0	51d9b74fc2a8	cups@2.3.1-9ubuntu1.8	no fix listed	1
owncloud/server :10.16.2	74c53d341076	cups@2.4.1op1-1ubuntu4.16	2.4.1op1-1ubuntu4.20	1
penpotapp/backend :2.2.1	47853d9bb9dd	cups@2.4.1op1-1ubuntu4.11	2.4.1op1-1ubuntu4.20	1
penpotapp/exporter :2.2.1	5c835ffd87ab	cups@2.4.1op1-1ubuntu4.11	2.4.1op1-1ubuntu4.20	1
photoprism/photoprism :220629-jammy	2954334adbda	cups@2.4.1op1-1ubuntu4.1	2.4.1op1-1ubuntu4.20	1
photoprism/photoprism :260601	650c6ad5a651	cups@2.4.16-1ubuntu1	2.4.16-1ubuntu1.2	1
photoprism/photoprism :251130	db16ee6b1ba3	cups@2.4.12-0ubuntu3.3	2.4.12-0ubuntu3.9	1
photoprism/photoprism :240711-ce	fc6fd632ca74	cups@2.4.7-1.2ubuntu7.2	2.4.7-1.2ubuntu7.13	1
project2team4/react :latest	3ff031a08887	cups@2.3.1-9ubuntu1.1	no fix listed	1
rundeck/rundeck :3.2.7	4d64fe56f767	cups@2.1.3-4ubuntu0.11	no fix listed	1
rundeck/rundeck :3.0.16	b13e8059ad72	cups@2.1.3-4ubuntu0.7	no fix listed	1
saidsef/scapy-containerised :v2025.02	f17f7c435891	cups@2.4.11-r0	2.4.18-r0	1