StackRadar

CVE-2026-42798

Medium

Advisory

Published 30 Apr 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
4.0
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
23
of 17,781 indexed, latest versions
Container images
22
deployed by those charts
Fix available
1 of 1
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 23 of 17,781 indexed charts deploy, on 22 images.

Affected packageAffected versionsFixed inImages
lcms2deb2.16-22.16-2+deb13u2, 2.16-2ubuntu0.222
OSV records
DEBIAN-CVE-2026-42798UBUNTU-CVE-2026-42798
Also known as
USN-8250-1

Charts affected

23 by stars
ChartLatestAffected imagesRadar Score
dask-kubernetes-operatordask2026.3.01 of 1See more

dask-kubernetes-operator dask 2026.3.0

1 of the 1 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

9,316
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
instill/artifact-backend:b28766ac4a393e601ed
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

30,816
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

12,037
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

11,205
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

15,712
iris-webappiris-webapp0.2.41 of 2See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

11,764
photoprismmmontesVerified publisher0.14.01 of 1See more

photoprism mmontes 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
photoprism/photoprism:251130db16ee6b1ba3
lcms2@2.16-2
2.16-2ubuntu0.2

Open the chart page →

11,103
wordpress-e2e-setupwoocommerce-e2e-setup0.1.11 of 2See more

wordpress-e2e-setup woocommerce-e2e-setup 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
library/wordpress:6.8-apache30bff39330d1
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

7,696
platform-apiappscodeVerified publisher2026.9.111 of 3See more

platform-api appscode 2026.9.11

1 of the 3 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

37,268
dokuwikiarea-42Verified publisher0.1.81 of 1See more

dokuwiki area-42 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
dokuwiki/dokuwiki:2025-05-14af08ecfdda239
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

7,489
iotaeclipse-aeriosVerified publisher1.0.21 of 4See more

iota eclipse-aerios 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
eclipseaerios/iota-messages-api:lateste7f5ba0bc64d
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

13,391
wordpresseoc-chartsVerified publisher0.14.41 of 1See more

wordpress eoc-charts 0.14.4

1 of the 1 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
library/wordpress:6.8.3-apache30bff39330d1
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

7,233
castopodhelmforgeVerified publisher1.2.71 of 3See more

castopod helmforge 1.2.7

1 of the 3 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
castopod/castopod:1.15.54e4f0440520f
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

9,342
chiefonboardinghelmforgeVerified publisher1.1.141 of 3See more

chiefonboarding helmforge 1.1.14

1 of the 3 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

10,849
paperlessk8s-home-lab-repo11.0.11 of 1See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

9,103
kbot-self-hostedkbot-self-hostedVerified publisher0.1.81 of 7See more

kbot-self-hosted kbot-self-hosted 0.1.8

1 of the 7 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.30206a6c708fc6
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

32,509
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

9,620
kube-wordpress-mysqlkube-wordpress-mysql0.1.01 of 2See more

kube-wordpress-mysql kube-wordpress-mysql 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
library/wordpress:php8.1-apachef73396626d2f
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

8,698
tinymediamanagermedia-servarrVerified publisher1.6.21 of 2See more

tinymediamanager media-servarr 1.6.2

1 of the 2 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
tinymediamanager/tinymediamanager:5.3.22b34dc85099e
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

7,944
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

11,950
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

10,605
transmissionryuunosukeds31.6.21 of 2See more

transmission ryuunosukeds3 1.6.2

1 of the 2 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
library/python:3.9da5aee29682d
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

9,534
nextcloudsb-helm-charts0.4.01 of 2See more

nextcloud sb-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-42798.

Container imageDigestPackageFixed in
library/nextcloud:31.0.10-apacheb7faa1653c39
lcms2@2.16-2
2.16-2+deb13u2

Open the chart page →

9,755

Container images carrying it

22 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/wordpress:6.8.3-apache:6.8-apache30bff39330d1
lcms2@2.16-2
2.16-2+deb13u2
2
castopod/castopod:1.15.54e4f0440520f
lcms2@2.16-2
2.16-2+deb13u2
1
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
lcms2@2.16-2
2.16-2+deb13u2
1
dokuwiki/dokuwiki:2025-05-14af08ecfdda239
lcms2@2.16-2
2.16-2+deb13u2
1
eclipseaerios/iota-messages-api:lateste7f5ba0bc64d
lcms2@2.16-2
2.16-2+deb13u2
1
gotenberg/gotenberg:8.30206a6c708fc6
lcms2@2.16-2
2.16-2+deb13u2
1
instill/artifact-backend:b28766ac4a393e601ed
lcms2@2.16-2
2.16-2+deb13u2
1
library/nextcloud:31.0.10-apacheb7faa1653c39
lcms2@2.16-2
2.16-2+deb13u2
1
library/python:3.9da5aee29682d
lcms2@2.16-2
2.16-2+deb13u2
1
library/wordpress:php8.1-apachef73396626d2f
lcms2@2.16-2
2.16-2+deb13u2
1
mindsdb/mindsdb:latest163011c09299
lcms2@2.16-2
2.16-2+deb13u2
1
photoprism/photoprism:251130db16ee6b1ba3
lcms2@2.16-2
2.16-2ubuntu0.2
1
tinymediamanager/tinymediamanager:5.3.22b34dc85099e
lcms2@2.16-2
2.16-2+deb13u2
1
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
lcms2@2.16-2
2.16-2+deb13u2
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
lcms2@2.16-2
2.16-2+deb13u2
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
lcms2@2.16-2
2.16-2+deb13u2
1
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
lcms2@2.16-2
2.16-2+deb13u2
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
lcms2@2.16-2
2.16-2+deb13u2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
lcms2@2.16-2
2.16-2+deb13u2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
lcms2@2.16-2
2.16-2+deb13u2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
lcms2@2.16-2
2.16-2+deb13u2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
lcms2@2.16-2
2.16-2+deb13u2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.