StackRadar

CVE-2026-40385

High

Advisory

Published 12 Apr 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.1
base score, highest
EPSS
0.001
1st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
91
of 17,781 indexed, latest versions
Container images
92
deployed by those charts
Fix available
1 of 1
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 91 of 17,781 indexed charts deploy, on 92 images.

Affected packageAffected versionsFixed inImages
libexifdeb0.6.21-2, 0.6.21-4ubuntu0.6, 0.6.21-6ubuntu0.4, 0.6.24-1+b1+4 more0.6.24-1+deb12u1, 0.6.24-1ubuntu0.22.04.1, 0.6.24-1ubuntu0.24.04.1, 0.6.25-1+deb13u1+1 more92
OSV records
DEBIAN-CVE-2026-40385UBUNTU-CVE-2026-40385
Also known as
USN-8531-1

Charts affected

91 by stars
ChartLatestAffected imagesRadar Score
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
libexif@0.6.24-1build1
0.6.24-1ubuntu0.22.04.1

Open the chart page →

12,791
smilencsaVerified publisher1.1.04 of 23See more

smile ncsa 1.1.0

4 of the 23 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
socialmediamacroscope/histogram:0.1.26418f9bdb4d2
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
socialmediamacroscope/network_analysis:0.1.3b351c21422e6
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
socialmediamacroscope/preprocessing:0.1.3ca863306314b
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
socialmediamacroscope/topic_modeling:0.1.3fa490acac2f8
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

109,294
node-appnode-app-lili1.0.01 of 1See more

node-app node-app-lili 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
laly9999/node-app:1dd0e503913e1
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

10,218
notes-admin-front-helm-chartnotesprojectchart0.1.01 of 1See more

notes-admin-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
vlebediantsev/notes-admin-front:latest007c6670ff48
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

15,132
notes-project-fromt-helm-chartnotesprojectchart0.1.01 of 1See more

notes-project-fromt-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
vlebediantsev/notes-project-front:latest945675fd2636
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

15,206
registration-ms-front-helm-chartnotesprojectchart0.1.01 of 1See more

registration-ms-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

15,187
cdn-remoteopencord0.2.41 of 3See more

cdn-remote opencord 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:1.0.0d59ccb138ffb
libexif@0.6.21-2
no fix listed

Open the chart page →

63,223
mcord-cdn-remoteopencord0.1.61 of 2See more

mcord-cdn-remote opencord 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:remote-v3d59ccb138ffb
libexif@0.6.21-2
no fix listed

Open the chart page →

42,614
mcord-cdn-remote-freeopencord0.1.31 of 1See more

mcord-cdn-remote-free opencord 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:remote-v3d59ccb138ffb
libexif@0.6.21-2
no fix listed

Open the chart page →

29,124
opencost-parquet-exporteropencostVerified publisher0.3.11 of 1See more

opencost-parquet-exporter opencost 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
ghcr.io/opencost/opencost-parquet-exporter:v0.2.1ce85ef0ce665
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

10,978
radiusp2p-avs0.1.01 of 1See more

radius p2p-avs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
theradius/loggia:0.463ba348546ec
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

12,350
ungatep2p-avs0.1.02 of 3See more

ungate p2p-avs 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
xom4ekp2p/infini-route-attestators-public-mainnet-avs-webapi:latest2745b5fd8785
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

27,373
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
knspar/phronetis-operator:0.1.60c4f0543ee58
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

16,196
subgraph-oraclepinaxVerified publisher0.0.11 of 1See more

subgraph-oracle pinax 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
ghcr.io/graphprotocol/availability-oracle:sha-28312fd472a25038957
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

11,347
pingdom-operatorpingdom-operator0.0.201 of 1See more

pingdom-operator pingdom-operator 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

11,923
planectlplanectlVerified publisher0.7.01 of 10See more

planectl planectl 0.7.0

1 of the 10 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
library/node:208f693eaa7e0a
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

25,934
pod-birdspod-birds0.1.01 of 1See more

pod-birds pod-birds 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
teknas09/bird-pod:latest12a1fa85c4aa
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

12,912
pyredispyredis-helm0.1.01 of 2See more

pyredis pyredis-helm 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
avinash263/pyredis263:latestaa2b8727f1a6
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

14,537
mychartpythonweb0.1.01 of 1See more

mychart pythonweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
qichenxu4pd/pythonexample:1.0f3a8502bc21b
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

12,566
mypythonpythonweb0.1.01 of 1See more

mypython pythonweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
qichenxu4pd/pythonexample:1.0f3a8502bc21b
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

12,566
cupsr2dlan-helm-chartsVerified publisher0.1.01 of 1See more

cups r2dlan-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
anujdatar/cups:25.07.01685df04a643b
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

7,685
javareact-java0.1.01 of 1See more

java react-java 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
project2team4/react:latest3ff031a08887
libexif@0.6.21-6ubuntu0.4
no fix listed

Open the chart page →

15,520
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

15,591
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

68,240
transmissionryuunosukeds31.6.21 of 2See more

transmission ryuunosukeds3 1.6.2

1 of the 2 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
library/python:3.9da5aee29682d
libexif@0.6.25-1
0.6.25-1+deb13u1

Open the chart page →

9,534
vrisingryuunosukeds30.1.01 of 1See more

vrising ryuunosukeds3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
trueosiris/vrising:latest9356f98ad561
libexif@0.6.24-1build1
0.6.24-1ubuntu0.22.04.1

Open the chart page →

7,295
safe-stacksafe-global0.1.01 of 9See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
gjeanmart/safe-ganache-node:latest926264c8f2d1
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

19,560
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
gjeanmart/safe-ganache-node:latest926264c8f2d1
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

16,620
photoprismschoolguys-helmcharts0.3.81 of 1See more

photoprism schoolguys-helmcharts 0.3.8

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
photoprism/photoprism:260601650c6ad5a651
libexif@0.6.25-2
0.6.25-2ubuntu0.1

Open the chart page →

10,348
spacecapybara-chartspacecapy1.0.491 of 2See more

spacecapybara-chart spacecapy 1.0.49

1 of the 2 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
sashafefler/spacecapybara_app:latestf96d7804c0ca
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

11,888
stakefishstakefish0.1.01 of 8See more

stakefish stakefish 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
thongngo3301/stakefish:latesta341af5976e3
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

20,223
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

13,390
stash-boxswuuper-githubVerified publisher0.1.11 of 2See more

stash-box swuuper-github 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
stashapp/stash-box:latesta534c8afdf39
libexif@0.6.24-1build2
0.6.24-1ubuntu0.24.04.1

Open the chart page →

8,193
cronjobt3n0.1.01 of 1See more

cronjob t3n 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
library/python:3.8d41127070014
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

11,199
helm-testtest-helm-artifacthubVerified publisher1.0.01 of 2See more

helm-test test-helm-artifacthub 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
carlosmz87/test_helm_backend:latest8ffa63aa995d
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

11,648
codegentest-opea1.0.01 of 5See more

codegen test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
opea/codegen-ui:1.02bee4eb66f3e
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

28,814
codetranstest-opea1.0.01 of 5See more

codetrans test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
opea/codetrans-ui:1.03ef121f34610
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

28,385
docsumtest-opea1.0.01 of 5See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
opea/docsum-ui:1.07f854e9bffaf
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

28,858
tfy-distributortruefoundryVerified publisher0.0.11 of 4See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

17,323
demo-backendv2flyVerified publisher0.0.31 of 1See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

14,358
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-40385.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
libexif@0.6.24-1+b1
0.6.24-1+deb12u1

Open the chart page →

10,795

Container images carrying it

92 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
substratusai/verba:v0.4.0-baseURL261695be635eb
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
sysnet4admin/colosseum-cms:loge74b43c7f492
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
sysnet4admin/colosseum-prm:log5802bfcd7fed
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
teknas09/bird-pod:latest12a1fa85c4aa
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
theradius/loggia:0.463ba348546ec
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
thongngo3301/stakefish:latesta341af5976e3
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
libexif@0.6.21-2
no fix listed
1
tinymediamanager/tinymediamanager:5.3.22b34dc85099e
libexif@0.6.25-1
0.6.25-1+deb13u1
1
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
trueosiris/vrising:latest9356f98ad561
libexif@0.6.24-1build1
0.6.24-1ubuntu0.22.04.1
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
vinanrra/7dtd-server:v0.4.4f9534490bd2b
libexif@0.6.21-4ubuntu0.6
no fix listed
1
vlebediantsev/notes-admin-front:latest007c6670ff48
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
vlebediantsev/notes-project-front:latest945675fd2636
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
xom4ekp2p/infini-route-attestators-public-mainnet-avs-webapi:latest2745b5fd8785
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
gcr.io/ml-pipeline/metadata-writer:2.3.09bcfd2abc361
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/camptocamp/tetragon-policy-builder:master0e99f12bb040
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
libexif@0.6.25-1
0.6.25-1+deb13u1
1
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
libexif@0.6.25-1
0.6.25-1+deb13u1
1
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
libexif@0.6.25-1
0.6.25-1+deb13u1
1
ghcr.io/drewburr-labs/mum-discord-bot:3.1.26e82914e1051
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/graphprotocol/availability-oracle:sha-28312fd472a25038957
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
libexif@0.6.25-1
0.6.25-1+deb13u1
1
ghcr.io/k8s-at-home/sonarr:v3.0.8.15070eb230e2381a
libexif@0.6.24-1build1
0.6.24-1ubuntu0.22.04.1
1
ghcr.io/libreconnect/ferriscompany:0.1.0-rc6ed86db9f0efe
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/opencost/opencost-parquet-exporter:v0.2.1ce85ef0ce665
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/zoriya/kyoo_autosync:4.7.1fbba58ddb1a6
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
libexif@0.6.24-1+b1
0.6.24-1+deb12u1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.