CVE-2026-4775

High

Advisory

Published 24 Mar 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.8; base score, highest
EPSS: 0.006; 45th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 351; of 17,781 indexed, latest versions
Container images: 371; deployed by those charts
Fix available: 2 of 2; affected packages

Red Hat Security Advisory: libtiff security update

Carried by container images the latest versions of 351 of 17,781 indexed charts deploy, on 371 images.

Affected package	Affected versions	Fixed in	Images
tiffdeb	4.0.3-7ubuntu0.9, 4.0.6-1ubuntu0.2, 4.0.6-1ubuntu0.4, 4.0.6-1ubuntu0.5+43 more	4.5.0-6+deb12u4, 4.7.0-3+deb13u2	349
libtiffrpm	4.0.3-32.el7, 4.0.9-17.el8, 4.0.9-18.el8, 4.0.9-28.el8_8+4 more	0:4.0.3-35.el7_9.2, 0:4.0.9-37.el8_10, 0:4.4.0-15.el9_7.3	22

OSV records: DEBIAN-CVE-2026-4775 RHSA-2026:12271 RHSA-2026:16055 RHSA-2026:25910 UBUNTU-CVE-2026-4775
Also known as: RHSA-2026:19363, RHSA-2026:19604, RHSA-2026:19659, RHSA-2026:19702

Charts affected

351 by stars

Chart

Latest

Affected images

Radar Score

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-4775.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	tiff@4.3.0-6ubuntu0.13	no fix listed

Open the chart page →

7,849

Container images carrying it

371 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
hazelcast/management-center :5.3.2	f9d34300d330	libtiff@4.0.9-28.el8_8	0:4.0.9-37.el8_10	1
hecrom/myweatherangularclient :1.3.11	bb0372939c19	tiff@4.5.0-6+deb12u1	4.5.0-6+deb12u4	1
helicone/supabase-migration-runner :v2025.03.05-1	4a913936c97b	tiff@4.5.0-6	4.5.0-6+deb12u4	1
huginn/huginn-single-process :4d17829cf6b15b004ad3f4be196303dca4944810	c794eddc7b47	tiff@4.0.9-5ubuntu0.3	no fix listed	1
hyperledger/fabric-couchdb :0.4.10	c65891b6c237	tiff@4.0.6-1ubuntu0.4	no fix listed	1
ibmcom/bai-elasticsearch-dev :19.0.2	5441dba2fa00	libtiff@4.0.3-32.el7	0:4.0.3-35.el7_9.2	1
ibmcom/bai-flink-dev :19.0.2	e31ff09e8aad	libtiff@4.0.3-32.el7	0:4.0.3-35.el7_9.2	1
ibmcom/bai-flink-zookeeper-dev :19.0.2	58548034cf55	libtiff@4.0.3-32.el7	0:4.0.3-35.el7_9.2	1
intel/dlstreamer-pipeline-server :2022.1.1-ubuntu20	aa8f5483a2ef	tiff@4.1.0+git191117-2ubuntu0.20.04.3	no fix listed	1
intel/multimodal-data-visualization-streaming :3.0	1a89327e499b	tiff@4.1.0+git191117-2ubuntu0.20.04.3	no fix listed	1
intelowlproject/intelowl :v6.6.1	0b22e547ea6b	tiff@4.5.0-6+deb12u1	4.5.0-6+deb12u4	1
ispras/svacer :11-2-0	42aa9fa9f189	tiff@4.3.0-6ubuntu0.10	no fix listed	1
itzg/bungeecord :latest	1c59f9631f3b	tiff@4.7.0-3ubuntu5	no fix listed	1
itzg/minecraft-server :2026.9.0	4e29d14082d9	tiff@4.5.1+git230720-4ubuntu2.5	no fix listed	1
itzg/minecraft-server :latest	8672e335dbef	tiff@4.5.1+git230720-4ubuntu2.5	no fix listed	1
jaedb/iris :latest	048cfbf58d57	tiff@4.5.0-6+deb12u2	4.5.0-6+deb12u4	1
jhoncytech/bookworm-apache-wordpress :latest	18c3ca1f411e	tiff@4.5.0-6+deb12u1	4.5.0-6+deb12u4	1
knspar/phronetis-operator :0.1.6	0c4f0543ee58	tiff@4.5.0-6+deb12u1	4.5.0-6+deb12u4	1
kong/httpbin :latest	a6ac46531193	tiff@4.3.0-6ubuntu0.10	no fix listed	1
kusionstack/kusion :v0.14.0	126c8f0b0976	tiff@4.3.0-6ubuntu0.10	no fix listed	1
kuzwolka/aws9 :main	1ad759b961b1	tiff@4.5.0-6+deb12u2	4.5.0-6+deb12u4	1
kuzwolka/aws9 :news	3e8880fbbb96	tiff@4.5.0-6+deb12u2	4.5.0-6+deb12u4	1
kuzwolka/aws9 :blog	4a7707410bf1	tiff@4.5.0-6+deb12u2	4.5.0-6+deb12u4	1
kuzwolka/aws9 :shop	84a9d9766345	tiff@4.5.0-6+deb12u2	4.5.0-6+deb12u4	1
laly9999/node-app :1	dd0e503913e1	tiff@4.5.0-6+deb12u2	4.5.0-6+deb12u4	1
langflowai/langflow-frontend :latest	54f67f1961fe	tiff@4.5.0-6+deb12u3	4.5.0-6+deb12u4	1
langgenius/dify-api :0.6.11	fca918260dd6	tiff@4.5.0-6+deb12u1	4.5.0-6+deb12u4	1
langgenius/dify-plugin-daemon :0.6.3-local	3c694329357b	tiff@4.5.1+git230720-4ubuntu2.5	no fix listed	1
langgenius/dify-plugin-daemon :0.5.1-local	8269050f192e	tiff@4.5.1+git230720-4ubuntu2.4	no fix listed	1
langgenius/dify-plugin-daemon :main-local	da995c129e2f	tiff@4.5.1+git230720-4ubuntu2.5	no fix listed	1
library/nextcloud :31.0.6-apache	588609d76b21	tiff@4.5.0-6+deb12u2	4.5.0-6+deb12u4	1
library/nextcloud :31.0.10-apache	b7faa1653c39	tiff@4.7.0-3+deb13u1	4.7.0-3+deb13u2	1
library/nginx :1.27.4	09369da6b103	tiff@4.5.0-6+deb12u2	4.5.0-6+deb12u4	1
library/nginx :1.27	6784fb0834aa	tiff@4.5.0-6+deb12u2	4.5.0-6+deb12u4	1
library/nginx :1.25.1	67f9a4f10d14	tiff@4.5.0-6	4.5.0-6+deb12u4	1
library/nginx :1.25.4	9ff236ed47fe	tiff@4.5.0-6+deb12u1	4.5.0-6+deb12u4	1
library/nginx :1.27.3	fb197595ebe7	tiff@4.5.0-6+deb12u1	4.5.0-6+deb12u4	1
library/python :3.8	d41127070014	tiff@4.5.0-6+deb12u1	4.5.0-6+deb12u4	1
library/python :3.9	da5aee29682d	tiff@4.7.0-3+deb13u1	4.7.0-3+deb13u2	1
library/wordpress :6.4.3-apache	8ae66efb09a2	tiff@4.5.0-6+deb12u1	4.5.0-6+deb12u4	1
library/wordpress :php8.1-apache	f73396626d2f	tiff@4.7.0-3+deb13u1	4.7.0-3+deb13u2	1
linuxserver/calibre :version-v5.21.0	a847b5b2d860	tiff@4.0.9-5ubuntu0.4	no fix listed	1
linuxserver/calibre-web :0.6.24	241009026e6f	tiff@4.5.1+git230720-4ubuntu2.3	no fix listed	1
linuxserver/calibre-web :version-0.6.12	938810eca3d3	tiff@4.1.0+git191117-2ubuntu0.20.04.1	no fix listed	1
linuxserver/deluge :18.04.1	0ac871624394	tiff@4.0.9-5ubuntu0.4	no fix listed	1
linuxserver/deluge :version-2.0.3-2201906121747ubuntu18.04.1	2ce561a95e7b	tiff@4.0.9-5ubuntu0.4	no fix listed	1
linuxserver/lazylibrarian :version-1152df82	f93d2560e233	tiff@4.0.9-5ubuntu0.4	no fix listed	1
livekit/ingress :v1.2.2	1ab01641b366	tiff@4.3.0-6ubuntu0.4	no fix listed	1
logiqai/flash :v3.10.2	65b996bc7bdc	tiff@4.5.0-6+deb12u1	4.5.0-6+deb12u4	1
louislam/uptime-kuma :2.0.2	4c364ef96aad	tiff@4.5.0-6+deb12u3	4.5.0-6+deb12u4	1