StackRadar

CVE-2026-107705

Medium

Advisory

Published 8 Oct 2026In the index since 10 Oct 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
70
of 18,117 indexed, latest versions
Container images
63
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 70 of 18,117 indexed charts deploy, on 63 images.

Affected packageAffected versionsFixed inImages
popplerdeb0.86.1-0ubuntu1, 22.02.0-2, 22.02.0-2ubuntu0.1, 22.02.0-2ubuntu0.3+17 moreno fix listed63
OSV records
DEBIAN-CVE-2026-107705UBUNTU-CVE-2026-107705

Charts affected

70 by stars
ChartLatestAffected imagesRadar Score
kbot-self-hostedkbot-self-hostedVerified publisher0.1.81 of 7See more

kbot-self-hosted kbot-self-hosted 0.1.8

1 of the 7 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.30206a6c708fc6
poppler@25.03.0-5+deb13u2
no fix listed

Open the chart page →

38,885
penpotkubitodevVerified publisher1.2.11 of 5See more

penpot kubitodev 1.2.1

1 of the 5 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
penpotapp/exporter:2.2.15c835ffd87ab
poppler@22.02.0-2ubuntu0.5
no fix listed

Open the chart page →

19,492
filestashmt1905024.0.01 of 1See more

filestash mt190502 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
machines/filestash:latestaff504cd28a8
poppler@25.03.0-5+deb13u4
no fix listed

Open the chart page →

3,784
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
poppler@25.03.0-5+deb13u2
no fix listed

Open the chart page →

14,269
nominatimnominatim-chart1.3.01 of 3See more

nominatim nominatim-chart 1.3.0

1 of the 3 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
mediagis/nominatim:3.7c15e941485ef
poppler@0.86.1-0ubuntu1
no fix listed

Open the chart page →

25,346
paperless-ngxoli-the-devVerified publisher1.3.11 of 1See more

paperless-ngx oli-the-dev 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.06b94799bc769
poppler@25.03.0-5+deb13u4
no fix listed

Open the chart page →

5,253
cupsr2dlan-helm-chartsVerified publisher0.1.01 of 1See more

cups r2dlan-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
anujdatar/cups:25.07.01685df04a643b
poppler@22.12.0-2+deb12u1
no fix listed

Open the chart page →

9,208
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
poppler@22.02.0-2ubuntu0.13
no fix listed

Open the chart page →

9,502
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
poppler@25.03.0-5+deb13u2
no fix listed

Open the chart page →

12,873
stirling-pdfrubxkubeVerified publisher0.1.21 of 1See more

stirling-pdf rubxkube 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
poppler@24.02.0-1ubuntu9.8
no fix listed

Open the chart page →

7,396
seafileschmitzis13.0.131 of 4See more

seafile schmitzis 13.0.13

1 of the 4 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
schmitzis/monorepo:seafile-13.0-latestc583f1be2af2
poppler@24.02.0-1ubuntu9.9
no fix listed

Open the chart page →

44,556
photoprismschoolguys-helmcharts0.3.81 of 1See more

photoprism schoolguys-helmcharts 0.3.8

1 of the 1 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
photoprism/photoprism:260601650c6ad5a651
poppler@26.01.0-2build2
no fix listed

Open the chart page →

61,619
backendsignalen4.25.01 of 4See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
signalen/backend:2.50.1826bb090bc4e4
poppler@22.12.0-2+deb12u3
no fix listed

Open the chart page →

14,556
kurento_webrtc_demostunner0.1.01 of 2See more

kurento_webrtc_demo stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
kurento/kurento-media-server:latest03c0d34d0828
poppler@24.02.0-1ubuntu9.8
no fix listed

Open the chart page →

14,002
stunner-kurento-one2one-callstunner0.1.01 of 2See more

stunner-kurento-one2one-call stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
kurento/kurento-media-server:latest03c0d34d0828
poppler@24.02.0-1ubuntu9.8
no fix listed

Open the chart page →

14,002
stash-boxswuuper-githubVerified publisher0.1.11 of 2See more

stash-box swuuper-github 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
stashapp/stash-box:latesta534c8afdf39
poppler@24.02.0-1ubuntu9.4
no fix listed

Open the chart page →

9,800
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
poppler@24.02.0-1ubuntu9
no fix listed

Open the chart page →

49,016
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
poppler@22.12.0-2+b1
no fix listed

Open the chart page →

12,072
changedetection-iozekker6Verified publisher1.103.01 of 1See more

changedetection-io zekker6 1.103.0

1 of the 1 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.834df3680db1c
poppler@22.12.0-2+deb12u3
no fix listed

Open the chart page →

3,002
zoo-project-druzoo-projectOfficialVerified publisher0.10.91 of 6See more

zoo-project-dru zoo-project 0.10.9

1 of the 6 container images this version deploys carry CVE-2026-107705.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-51e7d55383f24594959b69e58518961c6aa66740da112e8d03f1
poppler@22.02.0-2ubuntu0.13
no fix listed

Open the chart page →

7,286

Container images carrying it

63 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:3.3.06b94799bc769
poppler@25.03.0-5+deb13u4
no fix listed
4
ghcr.io/dgtlmoon/changedetection.io:0.60.8:latest34df3680db1c
poppler@22.12.0-2+deb12u3
no fix listed
3
apache/tika:2.9.2.1-fullae0b86d3c4d0
poppler@24.02.0-1ubuntu9
no fix listed
2
gotenberg/gotenberg:8.36.087c16b9f3642
poppler@25.03.0-5+deb13u4
no fix listed
2
gotenberg/gotenberg:8:8.37.0f29984bd1e22
poppler@25.03.0-5+deb13u4
no fix listed
2
kurento/kurento-media-server:latest03c0d34d0828
poppler@24.02.0-1ubuntu9.8
no fix listed
2
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
poppler@0.86.1-0ubuntu1
no fix listed
2
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
poppler@25.03.0-5+deb13u4
no fix listed
2
anujdatar/cups:25.07.01685df04a643b
poppler@22.12.0-2+deb12u1
no fix listed
1
apache/tika:latest-fullab9cc988828c
poppler@26.01.0-2ubuntu0.1
no fix listed
1
archivebox/archivebox:0.9.708c21bb233130
poppler@25.03.0-5+deb13u4
no fix listed
1
buall/postgres-stack:18.6881a785642cb
poppler@25.03.0-5+deb13u4
no fix listed
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
poppler@22.02.0-2ubuntu0.13
no fix listed
1
datamate/seafile-professional:11.0.202dd66b722464
poppler@22.02.0-2ubuntu0.10
no fix listed
1
gotenberg/gotenberg:8.30206a6c708fc6
poppler@25.03.0-5+deb13u2
no fix listed
1
gotenberg/gotenberg:8.7.0437b9cd3c351
poppler@22.12.0-2+b1
no fix listed
1
gotenberg/gotenberg:8.3467097317623a
poppler@25.03.0-5+deb13u3
no fix listed
1
gotenberg/gotenberg:8.0.1cf0b9a7ca3cf
poppler@22.12.0-2+b1
no fix listed
1
inventree/inventree:1.5.74aefd6e2bb0e
poppler@25.03.0-5+deb13u4
no fix listed
1
machines/filestash:latestaff504cd28a8
poppler@25.03.0-5+deb13u4
no fix listed
1
mediagis/nominatim:5.3.27923a8e67197
poppler@24.02.0-1ubuntu9.9
no fix listed
1
mediagis/nominatim:3.7c15e941485ef
poppler@0.86.1-0ubuntu1
no fix listed
1
mediagis/nominatim:4.2d0eae7b51374
poppler@22.02.0-2ubuntu0.3
no fix listed
1
openkm/openkm-ce:6.3.113bc465a7461b
poppler@0.86.1-0ubuntu1
no fix listed
1
openproject/openproject:17.9.1-slim2beeecac788d
poppler@25.03.0-5+deb13u4
no fix listed
1
penpotapp/exporter:2.18.3418232d6ca31
poppler@25.03.0-5+deb13u4
no fix listed
1
penpotapp/exporter:2.2.15c835ffd87ab
poppler@22.02.0-2ubuntu0.5
no fix listed
1
penpotapp/exporter:1.16.0-betafa7086ad92b1
poppler@22.02.0-2ubuntu0.1
no fix listed
1
phntom/mattermost-team-edition:9.3.051cf9da4aa2e
poppler@22.02.0-2ubuntu0.3
no fix listed
1
photoprism/photoprism:260601650c6ad5a651
poppler@26.01.0-2build2
no fix listed
1
photoprism/photoprism:260728958642220223
poppler@26.01.0-2ubuntu0.1
no fix listed
1
photoprism/photoprism:240711-cefc6fd632ca74
poppler@24.02.0-1ubuntu9
no fix listed
1
postgis/postgis:18-3.67e00e8c3539f
poppler@25.03.0-5+deb13u4
no fix listed
1
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
poppler@22.12.0-2+b1
no fix listed
1
schmitzis/monorepo:seafile-13.0-latestc583f1be2af2
poppler@24.02.0-1ubuntu9.9
no fix listed
1
signalen/backend:2.50.1826bb090bc4e4
poppler@22.12.0-2+deb12u3
no fix listed
1
stashapp/stash-box:latesta534c8afdf39
poppler@24.02.0-1ubuntu9.4
no fix listed
1
timescale/timescaledb-ha:pg15-latesta8e3322e1cf9
poppler@22.02.0-2ubuntu0.1
no fix listed
1
timescale/timescaledb-ha:pg14.6-ts2.9.1-p1cdb9ae118899
poppler@22.02.0-2ubuntu0.1
no fix listed
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
poppler@22.02.0-2ubuntu0.6
no fix listed
1
timescale/timescaledb-ha:pg16e9f34d8dd276
poppler@22.02.0-2ubuntu0.13
no fix listed
1
timescale/timescaledb-ha:pg14-ts2.6-latested719c0cd19d
poppler@22.02.0-2
no fix listed
1
webodm/webodm_webapp:3.3.0ed7b1aa0e40f
poppler@22.02.0-2ubuntu0.13
no fix listed
1
zooproject/zoo-project:dru-51e7d55383f24594959b69e58518961c6aa66740da112e8d03f1
poppler@22.02.0-2ubuntu0.13
no fix listed
1
ghcr.io/afairgiant/medikeep:v0.71.0086579173033
poppler@22.12.0-2+deb12u3
no fix listed
1
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
poppler@25.03.0-5+deb13u2
no fix listed
1
ghcr.io/caninehq/canine:latest68b19aee1c64
poppler@22.12.0-2+deb12u2
no fix listed
1
ghcr.io/deltabadger/deltabadger:2.23.3bffe3c22fabc
poppler@25.03.0-5+deb13u4
no fix listed
1
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
poppler@22.12.0-2+deb12u3
no fix listed
1
ghcr.io/fluxerapp/fluxer-api:2026.820.164808f683541d5374
poppler@22.12.0-2+deb12u3
no fix listed
1

syft 1.42.1 · advisories as of 14 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.