StackRadar

CVE-2026-41254

High

Advisory

Published 18 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
30th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
303
of 17,781 indexed, latest versions
Container images
299
deployed by those charts
Fix available
7 of 7
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 303 of 17,781 indexed charts deploy, on 299 images.

Affected packageAffected versionsFixed inImages
lcms2deb2.5-0ubuntu4, 2.5-0ubuntu4.1, 2.6-3ubuntu2, 2.6-3ubuntu2.1+6 more2.5-0ubuntu4.2+esm1, 2.6-3ubuntu2.1+esm1, 2.9-1ubuntu0.1+esm1, 2.9-4ubuntu0.1~esm1+5 more235
lcms2apk2.16-r0, 2.17-r02.19-r040
javabitnami11.0.15-150, 11.0.18-10-1, 11.0.18-10-2, 11.0.20-8-3+12 more1.8.016
Javabitnami11.0.20-8, 11.0.21-10, 17.0.8-7, 17.0.10-13-1+2 more1.8.07
openjdk-17deb17.0.10+7-1~deb12u1, 17.0.13+11-2~deb12u1, 17.0.16+8-1~deb12u1, 17.0.17+10-1~deb12u1+2 more17.0.20+8-1~deb12u17
jrebitnami17.0.16-12-0, 17.0.19-11-2, 21.0.8-12-0, 21.0.9-15-0+1 more1.8.05
openjdk-21deb21.0.11+10-1~deb13u221.0.12+8-1~deb13u12
OSV records
ALPINE-CVE-2026-41254BIT-java-2026-41254BIT-jre-2026-41254DEBIAN-CVE-2026-41254UBUNTU-CVE-2026-41254
Also known as
BIT-java-min-2026-41254, GHSA-4xp6-rcgg-m9qq, USN-8209-1, USN-8209-2

Charts affected

303 by stars
ChartLatestAffected imagesRadar Score
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-41254.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
lcms2@2.9-4
2.9-4ubuntu0.1~esm1

Open the chart page →

28,605
keycloakwiremindVerified publisher25.3.11 of 2See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-41254.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
jre@21.0.9-15-0
1.8.0

Open the chart page →

7,624
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-41254.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
lcms2@2.12~rc1-2build2
2.12~rc1-2ubuntu0.1

Open the chart page →

14,100

Container images carrying it

299 by charts deploying them

A fixed version is listed for 7 of the 7 affected packages.

Container imageDigestPackageFixed inUsed by
hyperledger/fabric-ca-tools:latest4ce6f43ded2e
lcms2@2.6-3ubuntu2
2.6-3ubuntu2.1+esm1
4
hyperledger/fabric-couchdb:0.4.15f6c724592abf
lcms2@2.6-3ubuntu2.1
2.6-3ubuntu2.1+esm1
4
gchq/hdfs:3.3.35ec58edbb2db
lcms2@2.14-2build1
2.14-2ubuntu0.1
3
jacobalberty/unifi:v10.0.162896c0ab82d33
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
3
omecproject/cdn-video-repo:1.0.0:remote-v3d59ccb138ffb
lcms2@2.6-3ubuntu2.1
2.6-3ubuntu2.1+esm1
3
selenium/hub:3.141.5902f251d48d5f
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
3
signoz/zookeeper:3.7.1fcc4a3288154
java@11.0.20-8-5
Java@11.0.20-8
1.8.0
1.8.0
3
quay.io/devtron/ai-agent:0.0.16545dac92173
lcms2@2.14-2
2.14-2+deb12u1
3
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
lcms2@2.14-2
2.14-2+deb12u1
3
apache/druid:37.0.00116fb802786
lcms2@2.14-2
openjdk-17@17.0.18+8-1~deb12u1
2.14-2+deb12u1
17.0.20+8-1~deb12u1
2
apache/tika:2.9.2.1-fullae0b86d3c4d0
lcms2@2.14-2build1
2.14-2ubuntu0.1
2
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
java@21.0.8-12-0
1.8.0
2
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
java@11.0.20-8-3
Java@11.0.20-8
1.8.0
1.8.0
2
gjeanmart/safe-ganache-node:latest926264c8f2d1
lcms2@2.14-2
2.14-2+deb12u1
2
hookiesolutions/webhookie:latest0629694246ba
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
2
hyperledger/besu:22.4-openjdk-latesta674d35eec9a
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
2
jlesage/jdownloader-2:v26.03.13d6cb102bd9b
lcms2@2.16-r0
2.19-r0
2
kurento/kurento-media-server:latest03c0d34d0828
lcms2@2.14-2build1
2.14-2ubuntu0.1
2
library/python:3.7eedf63967cdb
lcms2@2.14-2
2.14-2+deb12u1
2
library/wordpress:6.8.3-apache:6.8-apache30bff39330d1
lcms2@2.16-2
2.16-2+deb13u2
2
linuxserver/ubooquity:2.1.2-ls369932d6759112
lcms2@2.16-r0
2.19-r0
2
louislam/uptime-kuma:2.3.29aeb4e51d038
lcms2@2.14-2
2.14-2+deb12u1
2
mbentley/omada-controller:4.3f4e682274bed
lcms2@2.9-1ubuntu0.1
2.9-1ubuntu0.1+esm1
2
moreillon/user-manager:v5.0.2e1c9bfab5c16
lcms2@2.14-2
2.14-2+deb12u1
2
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
lcms2@2.16-r0
2.19-r0
2
opendatacube/ows:latest668cbb41473c
lcms2@2.14-2build1
2.14-2ubuntu0.1
2
qichenxu4pd/pythonexample:1.0f3a8502bc21b
lcms2@2.14-2
2.14-2+deb12u1
2
wurstmeister/zookeeper:latest7a7fd44a7210
lcms2@2.5-0ubuntu4
2.5-0ubuntu4.2+esm1
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
lcms2@2.14-2build1
2.14-2ubuntu0.1
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
lcms2@2.12~rc1-2build2
2.12~rc1-2ubuntu0.1
2
ghcr.io/flaresolverr/flaresolverr:v3.4.67962759d99d7
lcms2@2.14-2
2.14-2+deb12u1
2
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
2
ghcr.io/games-on-whales/steam:1.0.09b6105be7ad0
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
2
ghcr.io/smarter-project/hydra/isolated-vm:main4457b79b24cd
lcms2@2.14-2
2.14-2+deb12u1
2
1dev/server:11.9.0cd5b12fe5471
lcms2@2.14-2build1
2.14-2ubuntu0.1
1
5200710/hadoop:3.2.3-java8092d3088a5fb
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
akaunting/akaunting:3.0.1552811b36ec3a
lcms2@2.14-2
2.14-2+deb12u1
1
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
lcms2@2.16-r0
2.19-r0
1
andrewmackrodt/firefox-x11:142.0.1-r133f9080470c9
lcms2@2.12~rc1-2build2
2.12~rc1-2ubuntu0.1
1
anguda/ant-media:2.5c435285fc241
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
anujdatar/cups:25.07.01685df04a643b
lcms2@2.14-2
2.14-2+deb12u1
1
apache/druid:29.0.10cef139b6bf1
lcms2@2.14-2
openjdk-17@17.0.10+7-1~deb12u1
2.14-2+deb12u1
17.0.20+8-1~deb12u1
1
apachepulsar/pulsar:2.10.03b262ab7a7d9
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
apachepulsar/pulsar:2.9.0d056c89b7131
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
apachepulsar/pulsar:2.8.2d538416d5afe
lcms2@2.9-4
2.9-4ubuntu0.1~esm1
1
apache/tika:2.9.0.092d055a84e9e
lcms2@2.12~rc1-2build2
2.12~rc1-2ubuntu0.1
1
appwrite/appwrite:1.9.01aaa70127114
lcms2@2.17-r0
2.19-r0
1
assistiot/smart-orchestrator_scheduler_mc:latestb1dbe4d62a03
lcms2@2.14-2
2.14-2+deb12u1
1
avinash263/pyredis263:latestaa2b8727f1a6
lcms2@2.14-2
2.14-2+deb12u1
1
beyzkaya/blog-backend:v1.0.112a6a3d1c5f9
lcms2@2.14-2
2.14-2+deb12u1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.