StackRadar

CVE-2026-84446

High

Advisory

Published 18 Sept 2026In the index since 20 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
346
of 17,813 indexed, latest versions
Container images
235
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 346 of 17,813 indexed charts deploy, on 235 images.

Affected packageAffected versionsFixed inImages
libheifdeb1.15.1-1, 1.15.1-1+deb12u1, 1.19.8-1, 1.19.8-1+deb13u1no fix listed235
OSV records
DEBIAN-CVE-2026-84446
Trending
Rank 19 in indexed charts, since 20 Sept 2026. See the ranking →

Charts affected

346 by stars
ChartLatestAffected imagesRadar Score
nextcloudnextcloud9.3.01 of 1See more

nextcloud nextcloud 9.3.0

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nextcloud:34.0.4-apachea5ace30c695a
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

3,948
nginx-ingressnginxVerified publisher2.7.31 of 1See more

nginx-ingress nginx 2.7.3

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
nginx/nginx-ingress:5.6.33e97f06dce1c
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,131
zammadzammadOfficialVerified publisher19.0.01 of 5See more

zammad zammad 19.0.0

1 of the 5 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
ghcr.io/zammad/zammad:7.1.3-0014ce435c77651e
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

6,649
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

10,817
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

64,141
openprojectopenproject-helm-chartsOfficialVerified publisher13.12.02 of 5See more

openproject openproject-helm-charts 13.12.0

2 of the 5 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
openproject/hocuspocus:release-338001b288dc1359dfb5
libheif@1.15.1-1+deb12u1
no fix listed
openproject/openproject:17.8.0-slim48952034215d
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

20,467
oneuptimeoneuptimeOfficialVerified publisher13.0.81 of 7See more

oneuptime oneuptime 13.0.8

1 of the 7 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
oneuptime/runner:release10f7787ca20d
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

11,196
wordpressgroundhog2k0.16.41 of 1See more

wordpress groundhog2k 0.16.4

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/wordpress:7.1.0-apacheedeeae67330a
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

3,017
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
budibase/proxy:3.41.38d780b6ee602
libheif@1.19.8-1
no fix listed

Open the chart page →

9,698
paperless-ngxfmjstudios0.2.81 of 5See more

paperless-ngx fmjstudios 0.2.8

1 of the 5 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
libheif@1.15.1-1
no fix listed

Open the chart page →

31,292
nextcloudgroundhog2k0.22.71 of 3See more

nextcloud groundhog2k 0.22.7

1 of the 3 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nextcloud:35.0.0:35.0.0-apache3e9f6eaa5dc8
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

3,966
paperless-ngxpaperless-ngxVerified publisher0.3.221 of 3See more

paperless-ngx paperless-ngx 0.3.22

1 of the 3 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

8,820
cortexcortex3.3.81 of 4See more

cortex cortex 3.3.8

1 of the 4 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:1.31abe47724e466
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

3,198
wordpresshelmforgeVerified publisher3.0.61 of 3See more

wordpress helmforge 3.0.6

1 of the 3 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/wordpress:7.1.0-apacheedeeae67330a
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

3,480
nginx-ingressnginx-ingress-chartVerified publisher0.0.0-edge1 of 1See more

nginx-ingress nginx-ingress-chart 0.0.0-edge

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
nginx/nginx-ingress:edge520d439f9a9a
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,410
passboltpassbolt2.1.11 of 6See more

passbolt passbolt 2.1.1

1 of the 6 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
passbolt/passbolt:5.13.0-1-ceaf3a620902a0
libheif@1.19.8-1
no fix listed

Open the chart page →

13,270
minecraft-overvieweralphani-helm-chartsVerified publisher0.1.01 of 3See more

minecraft-overviewer alphani-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:stable0aa2d81d65bc
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

3,134
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

9,691
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/python:3.7eedf63967cdb
libheif@1.15.1-1
no fix listed

Open the chart page →

161,942
dask-kubernetes-operatordask2026.3.01 of 1See more

dask-kubernetes-operator dask 2026.3.0

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
libheif@1.19.8-1
no fix listed

Open the chart page →

9,680
part-dbpart-dbVerified publisher0.1.21 of 1See more

part-db part-db 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
jbtronics/part-db1:latestfd68338829ed
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

3,379
qgis-serverqgis-serverVerified publisher0.1.101 of 3See more

qgis-server qgis-server 0.1.10

1 of the 3 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:1.27.409369da6b103
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

5,524
spartanspartan0.9.11 of 1See more

spartan spartan 0.9.1

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,580
repmanszpadel-chartsVerified publisher3.52.171 of 3See more

repman szpadel-charts 3.52.17

1 of the 3 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:1.27.3fb197595ebe7
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

7,148
pretixtechwolf12Verified publisher2026.7.01 of 3See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
pretix/standalone:2026.7.05df3b7aa852e
libheif@1.19.8-1
no fix listed

Open the chart page →

10,248
vrijbrpvrijbrpVerified publisher0.1.51 of 5See more

vrijbrp vrijbrp 0.1.5

1 of the 5 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

8,545
wgerwgerOfficialVerified publisher1.0.01 of 8See more

wger wger 1.0.0

1 of the 8 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:stable0aa2d81d65bc
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

8,399
paperlesszekker6Verified publisher11.8.01 of 1See more

paperless zekker6 11.8.0

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

4,834
paperless-ngxadnoctemVerified publisher0.4.21 of 5See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

20,721
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
libheif@1.19.8-1
no fix listed

Open the chart page →

12,333
typo3christianhuthVerified publisher7.7.21 of 2See more

typo3 christianhuth 7.7.2

1 of the 2 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
martinhelmich/typo3:12.4c83a4f3fd7ae
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

8,802
commonground-gatewaycommonground-gateway1.5.41 of 7See more

commonground-gateway commonground-gateway 1.5.4

1 of the 7 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/gateway-ui:stag6a5594b7b32c
libheif@1.15.1-1
no fix listed

Open the chart page →

9,807
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
libheif@1.19.8-1
no fix listed

Open the chart page →

11,608
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
libheif@1.15.1-1
no fix listed

Open the chart page →

14,012
dragonfly-stackdragonflyVerified publisher0.1.21 of 7See more

dragonfly-stack dragonfly 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
dragonflyoss/client:v0.1.82edf3e921f4e0
libheif@1.15.1-1
no fix listed

Open the chart page →

18,997
nginx-phpfpmdrpsychickVerified publisher0.1.11 of 2See more

nginx-phpfpm drpsychick 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,580
enbuildenbuildVerified publisher0.0.502 of 6See more

enbuild enbuild 0.0.50

2 of the 6 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
libheif@1.19.8-1
no fix listed
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

32,055
roundcubeencircle360-ossVerified publisher0.8.31 of 1See more

roundcube encircle360-oss 0.8.3

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
roundcube/roundcubemail:1.6.16-apache-nonroot17d9d9580962
libheif@1.19.8-1
no fix listed

Open the chart page →

5,824
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

6,565
hello-helmhellok8s0.1.01 of 2See more

hello-helm hellok8s 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,753
mywebapphelm-nginxVerified publisher0.1.01 of 1See more

mywebapp helm-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,580
iris-webappiris-webapp0.2.41 of 2See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
libheif@1.19.8-1
no fix listed

Open the chart page →

12,109
web-chartkbt-ktcloudlab0.1.01 of 1See more

web-chart kbt-ktcloudlab 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,580
app-componentkeltio-helm-chartsVerified publisher3.14.01 of 1See more

app-component keltio-helm-charts 3.14.0

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,580
overpass-apil4gVerified publisher0.1.21 of 1See more

overpass-api l4g 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
wiktorn/overpass-api:latest9bb5f4a9b54c
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

3,599
langflow-idelangflow0.1.21 of 2See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
langflowai/langflow-frontend:latest54f67f1961fe
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

4,028
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
libheif@1.15.1-1+deb12u1
no fix listed

Open the chart page →

13,969
redminemt1905027.3.41 of 3See more

redmine mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/redmine:6.1.204ac44a2595b
libheif@1.19.8-1
no fix listed

Open the chart page →

7,343
12factormyaVerified publisher24.1.21 of 1See more

12factor mya 24.1.2

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,580
my-react-appmy-react-app0.1.51 of 1See more

my-react-app my-react-app 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-84446.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
libheif@1.19.8-1+deb13u1
no fix listed

Open the chart page →

1,580

Container images carrying it

235 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
libheif@1.15.1-1+deb12u1
no fix listed
1
ghcr.io/mcwarman/backstage-sample-app/app:mainfae3c1f04311
libheif@1.19.8-1
no fix listed
1
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
libheif@1.19.8-1
no fix listed
1
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
libheif@1.15.1-1
no fix listed
1
ghcr.io/opencatalogi/web-app:deva1a7f507f6ae
libheif@1.15.1-1
no fix listed
1
ghcr.io/opencost/opencost-parquet-exporter:v0.2.1ce85ef0ce665
libheif@1.15.1-1+deb12u1
no fix listed
1
ghcr.io/open-telemetry/demo:1.12.0-imageprovider4e322858fe56
libheif@1.15.1-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
libheif@1.15.1-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
libheif@1.19.8-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
libheif@1.19.8-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
libheif@1.19.8-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
libheif@1.15.1-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
libheif@1.15.1-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
libheif@1.19.8-1
no fix listed
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
libheif@1.15.1-1+deb12u1
no fix listed
1
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
libheif@1.19.8-1+deb13u1
no fix listed
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
libheif@1.15.1-1+deb12u1
no fix listed
1
ghcr.io/wittdennis/calibre-web:1.1.1aa7d5d5dd6be
libheif@1.15.1-1+deb12u1
no fix listed
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
libheif@1.15.1-1
no fix listed
1
ghcr.io/zammad/zammad:7.1.3-0014ce435c77651e
libheif@1.19.8-1+deb13u1
no fix listed
1
ghcr.io/zoriya/kyoo_autosync:4.7.1fbba58ddb1a6
libheif@1.15.1-1+deb12u1
no fix listed
1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
libheif@1.15.1-1+deb12u1
no fix listed
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
libheif@1.15.1-1
no fix listed
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
libheif@1.15.1-1
no fix listed
1
public.ecr.aws/jtekt-corporation/image-storage-service-gui:v1.9.434823c8abe00
libheif@1.15.1-1
no fix listed
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
libheif@1.15.1-1
no fix listed
1
public.ecr.aws/jtekt-corporation/shinsei-manager-front:v1.5.5f8fb4eea4071
libheif@1.15.1-1
no fix listed
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
libheif@1.15.1-1
no fix listed
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
libheif@1.15.1-1+deb12u1
no fix listed
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
libheif@1.15.1-1
no fix listed
1
quay.io/mittwald/kube-httpcache:stable2169032c5840
libheif@1.15.1-1+deb12u1
no fix listed
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
libheif@1.15.1-1
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
libheif@1.19.8-1
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
libheif@1.15.1-1+deb12u1
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
libheif@1.15.1-1+deb12u1
no fix listed
1

syft 1.42.1 · advisories as of 20 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.