StackRadar

CVE-2026-110654

Medium

Advisory

Published 14 Oct 2026In the index since 18 Oct 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
105
of 18,176 indexed, latest versions
Container images
93
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 105 of 18,176 indexed charts deploy, on 93 images.

Affected packageAffected versionsFixed inImages
zvbideb0.2.35-10, 0.2.35-13, 0.2.35-17, 0.2.35-19+5 moreno fix listed93
OSV records
DEBIAN-CVE-2026-110654UBUNTU-CVE-2026-110654

Charts affected

105 by stars
ChartLatestAffected imagesRadar Score
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-110654.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
zvbi@0.2.41-1
no fix listed

Open the chart page →

10,592
jellyfinth-chartsVerified publisher0.1.01 of 1See more

jellyfin th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-110654.

Container imageDigestPackageFixed in
jellyfin/jellyfin:10.10.77ae36aab93ef
zvbi@0.2.41-1
no fix listed

Open the chart page →

4,406
tdarrvhdirkVerified publisher5.0.52 of 2See more

tdarr vhdirk 5.0.5

2 of the 2 container images this version deploys carry CVE-2026-110654.

Container imageDigestPackageFixed in
haveagitgat/tdarr_node:2.17.013ff0913202dd
zvbi@0.2.35-17
no fix listed
ghcr.io/haveagitgat/tdarr:2.00.18.23fbe4c29d14c
zvbi@0.2.35-17
no fix listed

Open the chart page →

157,754
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-110654.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
zvbi@0.2.35-19
no fix listed

Open the chart page →

78,857
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-110654.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
zvbi@0.2.35-19
no fix listed

Open the chart page →

16,156

Container images carrying it

93 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
opea/speecht5:1.0249afad3d268
zvbi@0.2.41-1
no fix listed
1
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
zvbi@0.2.41-1+deb12u1
no fix listed
1
opencsghq/csgbot:v0.6.9-ee7d0271e26521
zvbi@0.2.44-1
no fix listed
1
opendronemap/nodeodm:3.6.2fcd99eb23d8d
zvbi@0.2.42-2
no fix listed
1
photoprism/photoprism:220629-jammy2954334adbda
zvbi@0.2.35-19
no fix listed
1
photoprism/photoprism:260601650c6ad5a651
zvbi@0.2.44-1ubuntu2
no fix listed
1
photoprism/photoprism:260728958642220223
zvbi@0.2.44-1ubuntu2
no fix listed
1
photoprism/photoprism:240711-cefc6fd632ca74
zvbi@0.2.42-2
no fix listed
1
ryuunosukeds3/nadeko-bot-docker:latestc0398f13e8a9
zvbi@0.2.35-19
no fix listed
1
scrapinghub/splash:3.4.1a5f89bc84606
zvbi@0.2.35-13
no fix listed
1
selenium/node-chrome:4.48.0-202609055ac71fd8dd1e
zvbi@0.2.42-2
no fix listed
1
selenium/node-firefox:4.48.0-2026090574a5c1c90f95
zvbi@0.2.42-2
no fix listed
1
sismics/docs:v1.10f4b0ef019cf1
zvbi@0.2.35-13
no fix listed
1
stashapp/stash:latest24dbd7607174
zvbi@0.2.35-17
no fix listed
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
zvbi@0.2.35-10
no fix listed
1
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
zvbi@0.2.35-19
no fix listed
1
ghcr.io/beluga-cloud/jellyfin/jellyfin:10.8.1368f52b993a7f
zvbi@0.2.35-19
no fix listed
1
ghcr.io/cjmalloy/jasper:v1.3.282726a947bb65b
zvbi@0.2.41-1+deb12u1
no fix listed
1
ghcr.io/fluxerapp/fluxer-api:2026.820.164808f683541d5374
zvbi@0.2.41-1+deb12u1
no fix listed
1
ghcr.io/fluxerapp/fluxer-media-proxy:2026.820.164955ced7544e6b3f
zvbi@0.2.44-1
no fix listed
1
ghcr.io/haveagitgat/tdarr:2.00.18.23fbe4c29d14c
zvbi@0.2.35-17
no fix listed
1
ghcr.io/immich-app/immich-server:v3.3.3bae7664ff3aa
zvbi@0.2.44-1
no fix listed
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
zvbi@0.2.44-1
no fix listed
1
ghcr.io/jellyfin/jellyfin:12.2c3efa69a22f2
zvbi@0.2.44-1
no fix listed
1
ghcr.io/k8s-at-home/bazarr:v1.0.3fdb5501cdfb9
zvbi@0.2.35-17
no fix listed
1
ghcr.io/k8s-at-home/lidarr:v1.0.0.225554ebc1f90963
zvbi@0.2.35-17
no fix listed
1
ghcr.io/k8s-at-home/xteve:v2.2.0.200292b3614670f
zvbi@0.2.35-17
no fix listed
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
zvbi@0.2.41-1+deb12u1
no fix listed
1
ghcr.io/linuxserver/audacity:version-3.0.2cdf203db1e50
zvbi@0.2.35-17
no fix listed
1
ghcr.io/linuxserver/booksonic:version-1.2677efca1065d
zvbi@0.2.35-13
no fix listed
1
ghcr.io/linuxserver/booksonic-air:version-v2009.1.0baa4fa9549dc
zvbi@0.2.35-13
no fix listed
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
zvbi@0.2.41-1
no fix listed
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
zvbi@0.2.41-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
zvbi@0.2.41-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
zvbi@0.2.44-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
zvbi@0.2.44-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
zvbi@0.2.44-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
zvbi@0.2.41-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
zvbi@0.2.41-1
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
zvbi@0.2.44-1
no fix listed
1
ghcr.io/smarter-project/gstreamer:v1.0.25ecb16015aa8
zvbi@0.2.35-17
no fix listed
1
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
zvbi@0.2.35-17
no fix listed
1
quay.io/go-skynet/local-ai:latestf1bc435659b9
zvbi@0.2.42-2
no fix listed
1

syft 1.42.1 · advisories as of 18 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.