CVE-2026-55594

Medium

Advisory

Published 1 Jul 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 113; of 17,781 indexed, latest versions
Container images: 121; deployed by those charts
Fix available: 1 of 1; affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 113 of 17,781 indexed charts deploy, on 121 images.

Affected package	Affected versions	Fixed in	Images
imagemagickdeb	8:6.8.9.9-7ubuntu5.9, 8:6.9.10.23+dfsg-2.1ubuntu11.4, 8:6.9.11.60+dfsg-1.3build2, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+22 more	8:6.9.11.60+dfsg-1.6+deb12u12, 8:7.1.1.43+dfsg1-1+deb13u11	121

OSV records: DEBIAN-CVE-2026-55594 UBUNTU-CVE-2026-55594

Charts affected

113 by stars

Chart

Latest

Affected images

Radar Score

stakefishstakefish

0.1.0

1 of 8 See more

stakefish stakefish 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-55594.

Container image	Digest	Package	Fixed in
thongngo3301/stakefish :latest	a341af5976e3	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

20,223

verbasubstratus

0.4.0

1 of 1 See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-55594.

Container image	Digest	Package	Fixed in
substratusai/verba :v0.4.0-baseURL2	61695be635eb	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u1	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

13,390

stash-boxswuuper-github

0.1.1

1 of 2 See more

stash-box swuuper-github 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-55594.

Container image	Digest	Package	Fixed in
stashapp/stash-box :latest	a534c8afdf39	imagemagick@8:6.9.12.98+dfsg1-5.2build2	no fix listed

Open the chart page →

8,193

cronjobt3n

0.1.0

1 of 1 See more

cronjob t3n 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-55594.

Container image	Digest	Package	Fixed in
library/python :3.8	d41127070014	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

11,199

helm-testtest-helm-artifacthub

1.0.0

1 of 2 See more

helm-test test-helm-artifacthub 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-55594.

Container image	Digest	Package	Fixed in
carlosmz87/test_helm_backend :latest	8ffa63aa995d	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

11,648

codegentest-opea

1.0.0

1 of 5 See more

codegen test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-55594.

Container image	Digest	Package	Fixed in
opea/codegen-ui :1.0	2bee4eb66f3e	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u1	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

28,814

codetranstest-opea

1.0.0

1 of 5 See more

codetrans test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-55594.

Container image	Digest	Package	Fixed in
opea/codetrans-ui :1.0	3ef121f34610	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u1	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

28,385

docsumtest-opea

1.0.0

1 of 5 See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-55594.

Container image	Digest	Package	Fixed in
opea/docsum-ui :1.0	7f854e9bffaf	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u1	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

28,858

nextcloudth-charts

0.4.0

1 of 1 See more

nextcloud th-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-55594.

Container image	Digest	Package	Fixed in
library/nextcloud :31.0.6-apache	588609d76b21	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u3	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

10,086

tfy-distributortruefoundry

0.0.1

1 of 4 See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-55594.

Container image	Digest	Package	Fixed in
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

17,323

demo-backendv2fly

0.0.3

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-55594.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

14,358

maybe-financevicsufer

0.2.7

1 of 3 See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-55594.

Container image	Digest	Package	Fixed in
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

10,795

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-55594.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	imagemagick@8:6.9.12.98+dfsg1-5.2build2	no fix listed

Open the chart page →

7,628

Container images carrying it

121 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/nathanvaughn/webtrees :2.2.6	034151b61a80	imagemagick@8:7.1.1.43+dfsg1-1+deb13u8	8:7.1.1.43+dfsg1-1+deb13u11	1
ghcr.io/nefelim4ag/pingdom-operator :0.0.15	f8c7afdcf439	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u1	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/opencost/opencost-parquet-exporter :v0.2.1	ce85ef0ce665	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	imagemagick@8:7.1.1.43+dfsg1-1+deb13u7	8:7.1.1.43+dfsg1-1+deb13u11	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.3	57ad9565bff3	imagemagick@8:7.1.1.43+dfsg1-1+deb13u3	8:7.1.1.43+dfsg1-1+deb13u11	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	imagemagick@8:7.1.1.43+dfsg1-1+deb13u3	8:7.1.1.43+dfsg1-1+deb13u11	1
ghcr.io/paperless-ngx/paperless-ngx :2.0.1	ab255bea133e	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	imagemagick@8:7.1.1.43+dfsg1-1+deb13u7	8:7.1.1.43+dfsg1-1+deb13u11	1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/wgbh-mla/pbcore-util :pr-6	6e04659a3baa	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u5	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u1	8:6.9.11.60+dfsg-1.6+deb12u12	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u9	8:6.9.11.60+dfsg-1.6+deb12u12	1