StackRadar

CVE-2026-41254

High

Advisory

Published 18 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
30th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
303
of 17,781 indexed, latest versions
Container images
299
deployed by those charts
Fix available
7 of 7
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 303 of 17,781 indexed charts deploy, on 299 images.

Affected packageAffected versionsFixed inImages
lcms2deb2.5-0ubuntu4, 2.5-0ubuntu4.1, 2.6-3ubuntu2, 2.6-3ubuntu2.1+6 more2.5-0ubuntu4.2+esm1, 2.6-3ubuntu2.1+esm1, 2.9-1ubuntu0.1+esm1, 2.9-4ubuntu0.1~esm1+5 more235
lcms2apk2.16-r0, 2.17-r02.19-r040
javabitnami11.0.15-150, 11.0.18-10-1, 11.0.18-10-2, 11.0.20-8-3+12 more1.8.016
Javabitnami11.0.20-8, 11.0.21-10, 17.0.8-7, 17.0.10-13-1+2 more1.8.07
openjdk-17deb17.0.10+7-1~deb12u1, 17.0.13+11-2~deb12u1, 17.0.16+8-1~deb12u1, 17.0.17+10-1~deb12u1+2 more17.0.20+8-1~deb12u17
jrebitnami17.0.16-12-0, 17.0.19-11-2, 21.0.8-12-0, 21.0.9-15-0+1 more1.8.05
openjdk-21deb21.0.11+10-1~deb13u221.0.12+8-1~deb13u12
OSV records
ALPINE-CVE-2026-41254BIT-java-2026-41254BIT-jre-2026-41254DEBIAN-CVE-2026-41254UBUNTU-CVE-2026-41254
Also known as
BIT-java-min-2026-41254, GHSA-4xp6-rcgg-m9qq, USN-8209-1, USN-8209-2

Charts affected

303 by stars
ChartLatestAffected imagesRadar Score
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-41254.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
lcms2@2.9-4
2.9-4ubuntu0.1~esm1

Open the chart page →

28,605
keycloakwiremindVerified publisher25.3.11 of 2See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-41254.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
jre@21.0.9-15-0
1.8.0

Open the chart page →

7,624
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-41254.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
lcms2@2.12~rc1-2build2
2.12~rc1-2ubuntu0.1

Open the chart page →

14,100

Container images carrying it

299 by charts deploying them

A fixed version is listed for 7 of the 7 affected packages.

Container imageDigestPackageFixed inUsed by
openkm/openkm-ce:6.3.113bc465a7461b
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
openproject/hocuspocus:release-338001b288dc1359dfb5
lcms2@2.14-2
2.14-2+deb12u1
1
opsmx11/issuegen:v2.1.05c50ca123d88
lcms2@2.5-0ubuntu4.1
2.5-0ubuntu4.2+esm1
1
owncloud/ocis:7.1.388e7c854517d
lcms2@2.16-r0
2.19-r0
1
owncloud/ocis:8.0.1b38fd8fdd58f
lcms2@2.17-r0
2.19-r0
1
owncloud/server:10.15.051d9b74fc2a8
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
penpotapp/backend:2.2.147853d9bb9dd
lcms2@2.12~rc1-2build2
2.12~rc1-2ubuntu0.1
1
penpotapp/exporter:2.2.15c835ffd87ab
lcms2@2.12~rc1-2build2
2.12~rc1-2ubuntu0.1
1
phntom/mattermost-team-edition:9.3.051cf9da4aa2e
lcms2@2.12~rc1-2build2
2.12~rc1-2ubuntu0.1
1
photoprism/photoprism:220629-jammy2954334adbda
lcms2@2.12~rc1-2build2
2.12~rc1-2ubuntu0.1
1
photoprism/photoprism:251130db16ee6b1ba3
lcms2@2.16-2
2.16-2ubuntu0.1
1
photoprism/photoprism:240711-cefc6fd632ca74
lcms2@2.14-2build1
2.14-2ubuntu0.1
1
pmoscode/axelor-open-suite:v7.2.57a58f4d762f5c
java@17.0.8-7-5
Java@17.0.8-7
1.8.0
1.8.0
1
postgis/postgis:17-3.4-alpine5a1dbedac34e
lcms2@2.16-r0
2.19-r0
1
project2team4/react:latest3ff031a08887
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
reaper99/recipya:v1.2.27f7ec3aeb88c
lcms2@2.16-r0
2.19-r0
1
rundeck/rundeck:3.2.74d64fe56f767
lcms2@2.6-3ubuntu2.1
2.6-3ubuntu2.1+esm1
1
rundeck/rundeck:3.0.16b13e8059ad72
lcms2@2.6-3ubuntu2.1
2.6-3ubuntu2.1+esm1
1
saidsef/scapy-containerised:v2025.02f17f7c435891
lcms2@2.16-r0
2.19-r0
1
sashafefler/spacecapybara_app:latestf96d7804c0ca
lcms2@2.14-2
2.14-2+deb12u1
1
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
lcms2@2.14-2
2.14-2+deb12u1
1
sismics/docs:v1.10f4b0ef019cf1
lcms2@2.9-1ubuntu0.1
2.9-1ubuntu0.1+esm1
1
sissbruecker/linkding:1.41.0-plusa222fb777e1f
lcms2@2.14-2
2.14-2+deb12u1
1
socialmediamacroscope/autophrase:0.1.570fb11d4f531
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
socialmediamacroscope/histogram:0.1.26418f9bdb4d2
lcms2@2.14-2
2.14-2+deb12u1
1
socialmediamacroscope/network_analysis:0.1.3b351c21422e6
lcms2@2.14-2
2.14-2+deb12u1
1
socialmediamacroscope/preprocessing:0.1.3ca863306314b
lcms2@2.14-2
2.14-2+deb12u1
1
socialmediamacroscope/topic_modeling:0.1.3fa490acac2f8
lcms2@2.14-2
2.14-2+deb12u1
1
soldevelo/kafka:4.0.0-debian-12-r0cfdc08c2f577
jre@17.0.16-12-0
1.8.0
1
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
speckle/speckle-preview-service:2.26.3092384dba45d
lcms2@2.14-2
2.14-2+deb12u1
1
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
lcms2@2.14-2
2.14-2+deb12u1
1
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
lcms2@2.14-2
2.14-2+deb12u1
1
speckle/speckle-preview-service:2.23.14-branch.testing6.334655-b4e04ee6dee853ba74a
lcms2@2.14-2
2.14-2+deb12u1
1
speckle/speckle-preview-service:2.25.10-branch.testing6.645-b125c1e787adcb20a3a
lcms2@2.14-2
2.14-2+deb12u1
1
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
lcms2@2.14-2
2.14-2+deb12u1
1
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
lcms2@2.14-2
2.14-2+deb12u1
1
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
lcms2@2.14-2
2.14-2+deb12u1
1
stashapp/stash:v0.31.1df744af5a0c9
lcms2@2.17-r0
2.19-r0
1
stashapp/stash-box:latesta534c8afdf39
lcms2@2.14-2build1
2.14-2ubuntu0.1
1
streamnative/private-cloud-console:v2.3.27-all91e54375e154
lcms2@2.16-r0
2.19-r0
1
substratusai/verba:v0.4.0-baseURL261695be635eb
lcms2@2.14-2
2.14-2+deb12u1
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
sysnet4admin/colosseum-cms:loge74b43c7f492
lcms2@2.14-2
2.14-2+deb12u1
1
sysnet4admin/colosseum-prm:log5802bfcd7fed
lcms2@2.14-2
2.14-2+deb12u1
1
teknas09/bird-pod:latest12a1fa85c4aa
lcms2@2.14-2
2.14-2+deb12u1
1
tensorflow/tensorflow:1.6.0-devel1e3172090703
lcms2@2.6-3ubuntu2
2.6-3ubuntu2.1+esm1
1
theradius/loggia:0.463ba348546ec
lcms2@2.14-2
2.14-2+deb12u1
1
thingsboard/tb-postgres:latest2d17e4e36edc
lcms2@2.14-2
openjdk-17@17.0.17+10-1~deb12u1
2.14-2+deb12u1
17.0.20+8-1~deb12u1
1
thongngo3301/stakefish:latesta341af5976e3
lcms2@2.14-2
2.14-2+deb12u1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.