StackRadar

CVE-2026-62291

Medium

Advisory

Published 20 Aug 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
27
of 17,781 indexed, latest versions
Container images
23
deployed by those charts
Fix available
1 of 1
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 27 of 17,781 indexed charts deploy, on 23 images.

Affected packageAffected versionsFixed inImages
libheifdeb1.17.6-1ubuntu4, 1.17.6-1ubuntu4.1, 1.17.6-1ubuntu4.2, 1.17.6-1ubuntu4.4+5 more1.17.6-1ubuntu4.823
OSV records
UBUNTU-CVE-2026-62291
Also known as
USN-8683-1

Charts affected

27 by stars
ChartLatestAffected imagesRadar Score
zabbixzabbix-communityVerified publisher7.1.01 of 5See more

zabbix zabbix-community 7.1.0

1 of the 5 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
zabbix/zabbix-web-nginx-pgsql:ubuntu-7.0.237d4d58086515
libheif@1.17.6-1ubuntu4.2
1.17.6-1ubuntu4.8

Open the chart page →

13,664
penpotpenpotOfficialVerified publisher1.9.01 of 4See more

penpot penpot 1.9.0

1 of the 4 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
penpotapp/exporter:2.17.272a8061e8806
libheif@1.21.2-3ubuntu0.4
no fix listed

Open the chart page →

4,314
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8

Open the chart page →

19,391
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.6.3-local3c694329357b
libheif@1.17.6-1ubuntu4.4
1.17.6-1ubuntu4.8

Open the chart page →

22,002
minecraft-proxyminecraft-server-chartsVerified publisher3.10.01 of 1See more

minecraft-proxy minecraft-server-charts 3.10.0

1 of the 1 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
itzg/bungeecord:latest1c59f9631f3b
libheif@1.21.2-3ubuntu0.4
no fix listed

Open the chart page →

3,074
photoprismandrenarchyVerified publisher8.15.01 of 1See more

photoprism andrenarchy 8.15.0

1 of the 1 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
photoprism/photoprism:260728958642220223
libheif@1.23.1-photoprism1
no fix listed

Open the chart page →

8,825
tt-rssangelnu7.0.01 of 2See more

tt-rss angelnu 7.0.0

1 of the 2 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
ghcr.io/angelnu/tt-rss:2.0.10068d332ae2410f8
libheif@1.21.2-3ubuntu0.4
no fix listed

Open the chart page →

1,201
calibre-webk8s-home-lab-repo9.1.11 of 1See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
libheif@1.17.6-1ubuntu4.6
1.17.6-1ubuntu4.8

Open the chart page →

4,477
nominatimrobjuz6.4.11 of 4See more

nominatim robjuz 6.4.1

1 of the 4 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
mediagis/nominatim:5.3.27923a8e67197
libheif@1.17.6-1ubuntu4.4
1.17.6-1ubuntu4.8

Open the chart page →

8,690
structurizrvirtualrootVerified publisher0.5.01 of 1See more

structurizr virtualroot 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
structurizr/onpremises:2025.11.094b5ffb5119c8
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8

Open the chart page →

4,378
zabbix-server-mysqlfermosit3.0.21 of 4See more

zabbix-server-mysql fermosit 3.0.2

1 of the 4 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
zabbix/zabbix-web-nginx-mysql:ubuntu-6.4-latest0e5f69c4c54e
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8

Open the chart page →

12,840
phpqonstruktVerified publisher0.2.01 of 1See more

php qonstrukt 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
qonstrukt/php:8.4-v8-apache089af7925aa1
libheif@1.17.6-1ubuntu4.6
1.17.6-1ubuntu4.8

Open the chart page →

23,964
node-appbryopsida0.5.11 of 2See more

node-app bryopsida 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8

Open the chart page →

14,352
opencloudcommunity-opencloud3.0.01 of 11See more

opencloud community-opencloud 3.0.0

1 of the 11 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
apache/tika:latest-full80072bb73dd3
libheif@1.21.2-3ubuntu0.4
no fix listed

Open the chart page →

3,773
datumcosmicrocks1.0.51 of 2See more

datum cosmicrocks 1.0.5

1 of the 2 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
ghcr.io/cosmicrocks/datum:v0.4.0beta76771c3cc8c3
libheif@1.17.6-1ubuntu4.2
1.17.6-1ubuntu4.8

Open the chart page →

2,944
photoprismdjjudas21Verified publisher99.99.991 of 1See more

photoprism djjudas21 99.99.99

1 of the 1 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
photoprism/photoprism:240711-cefc6fd632ca74
libheif@1.17.6-1ubuntu4
1.17.6-1ubuntu4.8

Open the chart page →

16,954
komgahelmforgeVerified publisher1.4.151 of 1See more

komga helmforge 1.4.15

1 of the 1 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
gotson/komga:1.26.36c2a967bbe9a
libheif@1.21.2-3ubuntu0.3
no fix listed

Open the chart page →

2,261
opencloudjacobcolvinVerified publisher0.2.31 of 13See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
libheif@1.17.6-1ubuntu4
1.17.6-1ubuntu4.8

Open the chart page →

45,239
k8s-dev-podk8s-dev-pod0.3.11 of 1See more

k8s-dev-pod k8s-dev-pod 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8

Open the chart page →

8,811
komgarubxkubeVerified publisher0.1.31 of 1See more

komga rubxkube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
gotson/komga:1.26.36c2a967bbe9a
libheif@1.21.2-3ubuntu0.3
no fix listed

Open the chart page →

2,261
snipeitschmitzis6.1.01 of 2See more

snipeit schmitzis 6.1.0

1 of the 2 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
snipe/snipe-it:v8.3.1141ebf2386fe
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8

Open the chart page →

6,094
photoprismschoolguys-helmcharts0.3.81 of 1See more

photoprism schoolguys-helmcharts 0.3.8

1 of the 1 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
photoprism/photoprism:260601650c6ad5a651
libheif@1.22.2-photoprism1
no fix listed

Open the chart page →

10,348
kurento_webrtc_demostunner0.1.01 of 2See more

kurento_webrtc_demo stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
kurento/kurento-media-server:latest03c0d34d0828
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8

Open the chart page →

12,460
stunner-kurento-one2one-callstunner0.1.01 of 2See more

stunner-kurento-one2one-call stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
kurento/kurento-media-server:latest03c0d34d0828
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8

Open the chart page →

12,460
stash-boxswuuper-githubVerified publisher0.1.11 of 2See more

stash-box swuuper-github 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
stashapp/stash-box:latesta534c8afdf39
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8

Open the chart page →

8,193
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
libheif@1.17.6-1ubuntu4
1.17.6-1ubuntu4.8

Open the chart page →

45,239
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-62291.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8

Open the chart page →

7,628

Container images carrying it

23 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/tika:2.9.2.1-fullae0b86d3c4d0
libheif@1.17.6-1ubuntu4
1.17.6-1ubuntu4.8
2
gotson/komga:1.26.36c2a967bbe9a
libheif@1.21.2-3ubuntu0.3
no fix listed
2
kurento/kurento-media-server:latest03c0d34d0828
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8
2
apache/tika:latest-full80072bb73dd3
libheif@1.21.2-3ubuntu0.4
no fix listed
1
itzg/bungeecord:latest1c59f9631f3b
libheif@1.21.2-3ubuntu0.4
no fix listed
1
langgenius/dify-plugin-daemon:0.6.3-local3c694329357b
libheif@1.17.6-1ubuntu4.4
1.17.6-1ubuntu4.8
1
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8
1
linuxserver/calibre-web:0.6.24241009026e6f
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8
1
mediagis/nominatim:5.3.27923a8e67197
libheif@1.17.6-1ubuntu4.4
1.17.6-1ubuntu4.8
1
penpotapp/exporter:2.17.272a8061e8806
libheif@1.21.2-3ubuntu0.4
no fix listed
1
photoprism/photoprism:260601650c6ad5a651
libheif@1.22.2-photoprism1
no fix listed
1
photoprism/photoprism:260728958642220223
libheif@1.23.1-photoprism1
no fix listed
1
photoprism/photoprism:240711-cefc6fd632ca74
libheif@1.17.6-1ubuntu4
1.17.6-1ubuntu4.8
1
qonstrukt/php:8.4-v8-apache089af7925aa1
libheif@1.17.6-1ubuntu4.6
1.17.6-1ubuntu4.8
1
snipe/snipe-it:v8.3.1141ebf2386fe
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8
1
stashapp/stash-box:latesta534c8afdf39
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8
1
structurizr/onpremises:2025.11.094b5ffb5119c8
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8
1
zabbix/zabbix-web-nginx-mysql:ubuntu-6.4-latest0e5f69c4c54e
libheif@1.17.6-1ubuntu4.1
1.17.6-1ubuntu4.8
1
zabbix/zabbix-web-nginx-pgsql:ubuntu-7.0.237d4d58086515
libheif@1.17.6-1ubuntu4.2
1.17.6-1ubuntu4.8
1
ghcr.io/angelnu/tt-rss:2.0.10068d332ae2410f8
libheif@1.21.2-3ubuntu0.4
no fix listed
1
ghcr.io/cosmicrocks/datum:v0.4.0beta76771c3cc8c3
libheif@1.17.6-1ubuntu4.2
1.17.6-1ubuntu4.8
1
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
libheif@1.17.6-1ubuntu4.6
1.17.6-1ubuntu4.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.