StackRadar

CVE-2026-40930

Medium

Advisory

Published 4 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.4
base score, highest
EPSS
0.002
10th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
332
of 17,781 indexed, latest versions
Container images
261
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 332 of 17,781 indexed charts deploy, on 261 images.

Affected packageAffected versionsFixed inImages
libpng1.6deb1.6.37-2, 1.6.37-3build5, 1.6.37-3ubuntu0.4, 1.6.37-3ubuntu0.51.6.37-2ubuntu0.1~esm3, 1.6.37-3ubuntu0.6209
libpngapk1.6.53-r0, 1.6.54-r0, 1.6.55-r0, 1.6.56-r0+1 more1.6.58-r152
OSV records
ALPINE-CVE-2026-40930UBUNTU-CVE-2026-40930
Also known as
USN-8639-1

Charts affected

332 by stars
ChartLatestAffected imagesRadar Score
airsonicgeek-cookbookVerified publisher6.4.21 of 1See more

airsonic geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

18,230
calibre-webgeek-cookbookVerified publisher8.4.21 of 1See more

calibre-web geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
linuxserver/calibre-web:version-0.6.12938810eca3d3
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

16,123
double-takegeek-cookbookVerified publisher2.3.21 of 1See more

double-take geek-cookbook 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
jakowenko/double-take:1.6.0b858bac9e32a
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

12,222
gapsgeek-cookbookVerified publisher5.4.21 of 1See more

gaps geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
housewrecker/gaps:latestf417dd0a7547
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

8,943
lidarrgeek-cookbookVerified publisher14.2.21 of 1See more

lidarr geek-cookbook 14.2.2

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/lidarr:v1.0.0.225554ebc1f90963
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

14,283
nzbhydra2geek-cookbookVerified publisher10.4.21 of 1See more

nzbhydra2 geek-cookbook 10.4.2

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

17,702
openkmgeek-cookbookVerified publisher4.2.01 of 1See more

openkm geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
openkm/openkm-ce:6.3.113bc465a7461b
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

27,949
photoprismgeek-cookbookVerified publisher7.2.01 of 1See more

photoprism geek-cookbook 7.2.0

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
photoprism/photoprism:220629-jammy2954334adbda
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

19,503
puppeteergeek-cookbookVerified publisher1.2.21 of 1See more

puppeteer geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
ghcr.io/jr0dd/puppeteer:v13.3.26047599cd78e
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

15,730
seafilegeek-cookbookVerified publisher3.2.01 of 1See more

seafile geek-cookbook 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

24,293
xtevegeek-cookbookVerified publisher8.4.21 of 1See more

xteve geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/xteve:v2.2.0.200292b3614670f
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

17,929
dispatchoor-uigeneral-helm-chartsVerified publisher0.1.01 of 1See more

dispatchoor-ui general-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
ghcr.io/ethpandaops/dispatchoor-web:latest18e30413dac2
libpng@1.6.54-r0
1.6.58-r1

Open the chart page →

1,338
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.82 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

2 of the 5 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
jingking/geonetwork-hnap:4.2.843e74ab234e1
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
library/kibana:7.17.150172f1c538e7
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

34,754
jaegergpg-dev3.3.31 of 5See more

jaeger gpg-dev 3.3.3

1 of the 5 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

19,229
video-analytics-demogpu-operator0.1.91 of 3See more

video-analytics-demo gpu-operator 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
anguda/ant-media:2.5c435285fc241
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

15,722
gravitino-iceberg-rest-server-helmgravitino-iceberg-rest-server1.3.111 of 1See more

gravitino-iceberg-rest-server-helm gravitino-iceberg-rest-server 1.3.11

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
apache/gravitino-iceberg-rest:1.3.080136ae753ee
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

4,556
grayloggraylogVerified publisher1.0.21 of 4See more

graylog graylog 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
graylog/graylog:6.1.1019de1aff48c2
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

5,261
hawk-envoy-pluginhawk0.1.01 of 4See more

hawk-envoy-plugin hawk 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
kong/httpbin:latesta6ac46531193
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

9,096
pageshelm-chart-repos-camden1.0.01 of 3See more

pages helm-chart-repos-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

20,190
appwritehelmforgeVerified publisher1.3.41 of 5See more

appwrite helmforge 1.3.4

1 of the 5 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
appwrite/console:8.7.383dcdc8492ac6
libpng@1.6.55-r0
1.6.58-r1

Open the chart page →

6,952
ckanhelmforgeVerified publisher1.3.81 of 6See more

ckan helmforge 1.3.8

1 of the 6 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
libpng1.6@1.6.37-3ubuntu0.4
1.6.37-3ubuntu0.6

Open the chart page →

9,920
countlyhelmforgeVerified publisher1.2.61 of 3See more

countly helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

18,813
openreel-videohelmforgeVerified publisher1.0.31 of 1See more

openreel-video helmforge 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
helmforge/openreel-video:v0.5.07ba0d47b943f
libpng@1.6.57-r0
1.6.58-r1

Open the chart page →

1,085
pageshelm-repo1.0.01 of 3See more

pages helm-repo 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

20,190
svacerhelm-svacer0.6.01 of 1See more

svacer helm-svacer 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
ispras/svacer:11-2-042aa9fa9f189
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

6,015
nominatimheywood8-helm-chartsVerified publisher3.10.81 of 3See more

nominatim heywood8-helm-charts 3.10.8

1 of the 3 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
mediagis/nominatim:4.2d0eae7b51374
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

14,290
printserverhmediadeVerified publisher1.0.21 of 4See more

printserver hmediade 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
hmediade/printserver:latest481a552c8e1c
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

10,839
eoloplanthttpd-eoloplant0.1.01 of 7See more

eoloplant httpd-eoloplant 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

32,205
prometheushuangchengwu-helm-chart0.1.02 of 3See more

prometheus huangchengwu-helm-chart 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:9.2.0133d35d2c263
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6
apache/skywalking-ui:9.2.0295f1dc87d98
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

16,401
skywalking-v1huangchengwu-helm-chart0.1.02 of 4See more

skywalking-v1 huangchengwu-helm-chart 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:8.9.1b4ec8c18d079
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
apache/skywalking-ui:8.9.180530f0308a5
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

20,650
mvfi4trustVerified publisher1.1.21 of 1See more

mvf i4trust 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
wistefan/mvf:lateste0887302b2d8
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

7,144
vcwaltidi4trustVerified publisher0.0.191 of 1See more

vcwaltid i4trust 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

7,862
ikigaiikigai-chartVerified publisher0.0.92 of 58See more

ikigai ikigai-chart 0.0.9

2 of the 58 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
dremio/dremio-oss:24.1.080ed2e3b7c43
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6
library/zookeeper:3.8-temurin55d1e5b2e601
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

37,671
nifi-registryimprowisedVerified publisher1.0.01 of 2See more

nifi-registry improwised 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
apache/nifi-registry:1.27.063b8e3e40742
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

5,320
itm-servicesintelVerified publisher2.0.01 of 8See more

itm-services intel 2.0.0

1 of the 8 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
intel/dlstreamer-pipeline-server:2022.1.1-ubuntu20aa8f5483a2ef
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

18,066
multimodal-data-visualizationintelVerified publisher3.0.01 of 2See more

multimodal-data-visualization intel 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
intel/multimodal-data-visualization-streaming:3.01a89327e499b
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

11,069
manyfoldjeffrescVerified publisher1.0.31 of 1See more

manyfold jeffresc 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
libpng@1.6.55-r0
1.6.58-r1

Open the chart page →

1,960
valheim-serverk8s-chartsVerified publisher1.3.01 of 1See more

valheim-server k8s-charts 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
mbround18/valheim:3.1.070bd4da591cd
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

6,075
audiobookshelfk8s-home-lab-repo2.0.11 of 1See more

audiobookshelf k8s-home-lab-repo 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.32.1a52dc5db694a
libpng@1.6.53-r0
1.6.58-r1

Open the chart page →

2,350
lidarrk8s-home-lab-repo15.3.11 of 1See more

lidarr k8s-home-lab-repo 15.3.1

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
ghcr.io/home-operations/lidarr:3.1.29df1e14c8e09
libpng@1.6.56-r0
1.6.58-r1

Open the chart page →

1,568
unifik8sonlabVerified publisher0.3.71 of 1See more

unifi k8sonlab 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
jacobalberty/unifi:v10.0.162896c0ab82d33
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

7,268
kadeck-teamskadeck1.1.211 of 1See more

kadeck-teams kadeck 1.1.21

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
xeotek/kadeck:6.3.439a3b37a17c5
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

3,576
kadeck-webkadeck0.6.01 of 1See more

kadeck-web kadeck 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
xeotek/kadeck:4.2.94c6b04d9ce55
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

7,254
kron-aapm-agentkron-aapm-agent1.1.01 of 1See more

kron-aapm-agent kron-aapm-agent 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
krontechnology/aapm-agent:1.1.07feef7d2ab42
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3

Open the chart page →

8,884
aapm-servicekron-pam-aapm-helmcharts1.2.51 of 1See more

aapm-service kron-pam-aapm-helmcharts 1.2.5

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
krontechnology/aapm-service:1.1.39dd602db8baa
libpng1.6@1.6.37-3ubuntu0.4
1.6.37-3ubuntu0.6

Open the chart page →

2,606
kron-aapm-agentkron-pam-aapm-helmcharts1.2.51 of 1See more

kron-aapm-agent kron-pam-aapm-helmcharts 1.2.5

1 of the 1 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
krontechnology/aapm-agent:1.8.41cc7d5be6529
libpng1.6@1.6.37-3ubuntu0.4
1.6.37-3ubuntu0.6

Open the chart page →

2,707
kubernetes-netskope-publisherkubernetes-netskope-publisherVerified publisher1.5.01 of 2See more

kubernetes-netskope-publisher kubernetes-netskope-publisher 1.5.0

1 of the 2 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
netskopeprivateaccess/publisher_u22:latest93e2fd164a93
libpng1.6@1.6.37-3ubuntu0.5
1.6.37-3ubuntu0.6

Open the chart page →

3,528
penpotkubitodevVerified publisher1.2.12 of 5See more

penpot kubitodev 1.2.1

2 of the 5 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
penpotapp/backend:2.2.147853d9bb9dd
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6
penpotapp/exporter:2.2.15c835ffd87ab
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

16,877
kusionkusionstackVerified publisher0.14.11 of 3See more

kusion kusionstack 0.14.1

1 of the 3 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
kusionstack/kusion:v0.14.0126c8f0b0976
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

6,824
stakitkvalitetsitVerified publisher0.3.111 of 3See more

stakit kvalitetsit 0.3.11

1 of the 3 container images this version deploys carry CVE-2026-40930.

Container imageDigestPackageFixed in
kvalitetsit/stakit-backend:0.3.0f0af0ba589af
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6

Open the chart page →

7,802

Container images carrying it

261 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
ghcr.io/star-whale/server:0.6.158368359c8dd0
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
ghcr.io/voxpupuli/container-puppetdb:7.18.0-v1.5.0a56dfe91f5b1
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6
1
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6
1
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6
1
ghcr.io/wenisch-tech/chronoreaper:1.1.10447726cec07b
libpng@1.6.57-r0
1.6.58-r1
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
libpng1.6@1.6.37-2
1.6.37-2ubuntu0.1~esm3
1
quay.io/deployhub/ms-nginx:svccat-v11.0.815-g717581d2d3400664e8
libpng@1.6.53-r0
1.6.58-r1
1
quay.io/deployhub/ms-ui:svccat-v11.0.815-g717581f5dedbc31e6f
libpng@1.6.53-r0
1.6.58-r1
1
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
libpng1.6@1.6.37-3build5
1.6.37-3ubuntu0.6
1
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
libpng@1.6.57-r0
1.6.58-r1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.