StackRadar

CVE-2026-41254

High

Advisory

Published 18 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
30th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
303
of 17,781 indexed, latest versions
Container images
299
deployed by those charts
Fix available
7 of 7
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 303 of 17,781 indexed charts deploy, on 299 images.

Affected packageAffected versionsFixed inImages
lcms2deb2.5-0ubuntu4, 2.5-0ubuntu4.1, 2.6-3ubuntu2, 2.6-3ubuntu2.1+6 more2.5-0ubuntu4.2+esm1, 2.6-3ubuntu2.1+esm1, 2.9-1ubuntu0.1+esm1, 2.9-4ubuntu0.1~esm1+5 more235
lcms2apk2.16-r0, 2.17-r02.19-r040
javabitnami11.0.15-150, 11.0.18-10-1, 11.0.18-10-2, 11.0.20-8-3+12 more1.8.016
Javabitnami11.0.20-8, 11.0.21-10, 17.0.8-7, 17.0.10-13-1+2 more1.8.07
openjdk-17deb17.0.10+7-1~deb12u1, 17.0.13+11-2~deb12u1, 17.0.16+8-1~deb12u1, 17.0.17+10-1~deb12u1+2 more17.0.20+8-1~deb12u17
jrebitnami17.0.16-12-0, 17.0.19-11-2, 21.0.8-12-0, 21.0.9-15-0+1 more1.8.05
openjdk-21deb21.0.11+10-1~deb13u221.0.12+8-1~deb13u12
OSV records
ALPINE-CVE-2026-41254BIT-java-2026-41254BIT-jre-2026-41254DEBIAN-CVE-2026-41254UBUNTU-CVE-2026-41254
Also known as
BIT-java-min-2026-41254, GHSA-4xp6-rcgg-m9qq, USN-8209-1, USN-8209-2

Charts affected

303 by stars
ChartLatestAffected imagesRadar Score
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-41254.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
lcms2@2.9-4
2.9-4ubuntu0.1~esm1

Open the chart page →

28,605
keycloakwiremindVerified publisher25.3.11 of 2See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-41254.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
jre@21.0.9-15-0
1.8.0

Open the chart page →

7,624
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-41254.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
lcms2@2.12~rc1-2build2
2.12~rc1-2ubuntu0.1

Open the chart page →

14,100

Container images carrying it

299 by charts deploying them

A fixed version is listed for 7 of the 7 affected packages.

Container imageDigestPackageFixed inUsed by
bitnami/jmx-exporter9cc4a173c69e
jre@17.0.19-11-2
1.8.0
1
bitnamilegacy/cassandra:4.1.7-debian-12-r32b7a217999a1
java@11.0.25-11-1
1.8.0
1
bitnamilegacy/elasticsearch:8.12.215d4647fd491
java@17.0.10-13-2
Java@17.0.10-13-2
1.8.0
1.8.0
1
bitnamilegacy/elasticsearch:8.12.1-debian-11-r29cfd2df1294d
java@17.0.10-13-1
Java@17.0.10-13-1
1.8.0
1.8.0
1
bitnamilegacy/elasticsearch:9.0.1-debian-12-r0e6f6ddcce2f1
java@21.0.7-9-0
1.8.0
1
bitnamilegacy/kafka:3.5.0-debian-11-r08657bb93a581
java@17.0.7-7-2
1.8.0
1
bitnamilegacy/kafka:3.4.0-debian-11-r6ac64829e45b3
java@11.0.18-10-2
1.8.0
1
bitnamilegacy/kafka:2.8.1-debian-11-r7b6e381ffd6ae
java@11.0.15-150
1.8.0
1
bitnamilegacy/keycloak:20.0.5cb04e49e6eb1
java@17.0.6-10-4
1.8.0
1
bitnamilegacy/keycloak:24.0.4cc599cbd15ff
java@17.0.11-12-0
Java@17.0.11-12-0
1.8.0
1.8.0
1
bitnamilegacy/keycloak:26.3.3-debian-12-r0da3df0976a9f
jre@21.0.8-12-0
1.8.0
1
bitnamilegacy/matomo:5.3.2-debian-12-r13f02c000c54b1
lcms2@2.14-2
2.14-2+deb12u1
1
bitnamilegacy/opensearch:2.18.0-debian-12-r0d8440eb6b290
java@17.0.13-12-1
1.8.0
1
bitnamilegacy/zookeeper:3.7.2-debian-11-r5cbf54314c401
java@11.0.21-10-6
Java@11.0.21-10
1.8.0
1.8.0
1
bitnamilegacy/zookeeper:3.8.1-debian-11-r6dba59d740e13
java@11.0.18-10-1
1.8.0
1
bitnami/tomcat:latest113674f60814
jre@21.0.12-10-3
1.8.0
1
blakeblackshear/frigate:0.10.0-amd64ae269270ad9e
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
bnjbvr/kresus:0.22.137e216b182c8
lcms2@2.14-2
2.14-2+deb12u1
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
carlosmz87/test_helm_backend:latest8ffa63aa995d
lcms2@2.14-2
2.14-2+deb12u1
1
castopod/castopod:1.12.101fd37280cbb2
lcms2@2.14-2
2.14-2+deb12u1
1
castopod/castopod:1.15.54e4f0440520f
lcms2@2.16-2
2.16-2+deb13u2
1
cheyang/distributed-tf:1.6.046cc34755493
lcms2@2.6-3ubuntu2
2.6-3ubuntu2.1+esm1
1
chibisafe/chibisafe-server:latest3da4fcbc1a18
lcms2@2.16-r0
2.19-r0
1
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
lcms2@2.16-2
2.16-2+deb13u2
1
conductoross/conductor:3.31.09fba127693e6
openjdk-21@21.0.11+10-1~deb13u2
21.0.12+8-1~deb13u1
1
copyparty/ac:1.19.200a0a8605062c
lcms2@2.16-r0
2.19-r0
1
countly/countly-server:25.05.4e3c238248f99
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
datamate/seafile-professional:11.0.202dd66b722464
lcms2@2.12~rc1-2build2
2.12~rc1-2ubuntu0.1
1
deconzcommunity/deconz:2.29.2062de2362641
lcms2@2.14-2
2.14-2+deb12u1
1
deluan/navidrome:0.61.29fa40b3d8dec
lcms2@2.16-r0
2.19-r0
1
docuseal/docuseal:2.4.17493fd7f6728
lcms2@2.17-r0
2.19-r0
1
dokuwiki/dokuwiki:2025-05-14af08ecfdda239
lcms2@2.16-2
2.16-2+deb13u2
1
eclipseaerios/iota-messages-api:lateste7f5ba0bc64d
lcms2@2.16-2
2.16-2+deb13u2
1
felipecs8/app-db-connection-test:v129e06c9c6385
lcms2@2.14-2
2.14-2+deb12u1
1
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
lcms2@2.14-2
2.14-2+deb12u1
1
gchq/accumulo:2.0.1c460bb587d6d
lcms2@2.14-2build1
2.14-2ubuntu0.1
1
geoscienceaustralia/dea-k8s-data:latestf4039b45572a
lcms2@2.9-1ubuntu0.1
2.9-1ubuntu0.1+esm1
1
gotenberg/gotenberg:8.30206a6c708fc6
lcms2@2.16-2
2.16-2+deb13u2
1
gridgain/community:8.9.11d32d182a0e6a
lcms2@2.16-r0
2.19-r0
1
helicone/supabase-migration-runner:v2025.03.05-14a913936c97b
lcms2@2.14-2
2.14-2+deb12u1
1
hyperledger/fabric-couchdb:0.4.10c65891b6c237
lcms2@2.6-3ubuntu2
2.6-3ubuntu2.1+esm1
1
instill/artifact-backend:b28766ac4a393e601ed
lcms2@2.16-2
2.16-2+deb13u2
1
intel/dlstreamer-pipeline-server:2022.1.1-ubuntu20aa8f5483a2ef
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
lcms2@2.14-2
2.14-2+deb12u1
1
ispras/svacer:11-2-042aa9fa9f189
lcms2@2.12~rc1-2build2
2.12~rc1-2ubuntu0.1
1
jacobalberty/unifi:v7.1.664a3616625dda
lcms2@2.9-1ubuntu0.1
2.9-1ubuntu0.1+esm1
1
jacobalberty/unifi:v7.4.162b3edc809a3ff
lcms2@2.9-1ubuntu0.1
2.9-1ubuntu0.1+esm1
1
jacobalberty/unifi:5.10.19c409924e2463
lcms2@2.6-3ubuntu2.1
2.6-3ubuntu2.1+esm1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.