StackRadar

CVE-2026-110654

Medium

Advisory

Published 14 Oct 2026In the index since 18 Oct 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
105
of 18,176 indexed, latest versions
Container images
93
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 105 of 18,176 indexed charts deploy, on 93 images.

Affected packageAffected versionsFixed inImages
zvbideb0.2.35-10, 0.2.35-13, 0.2.35-17, 0.2.35-19+5 moreno fix listed93
OSV records
DEBIAN-CVE-2026-110654UBUNTU-CVE-2026-110654

Charts affected

105 by stars
ChartLatestAffected imagesRadar Score
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-110654.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
zvbi@0.2.41-1
no fix listed

Open the chart page →

10,592
jellyfinth-chartsVerified publisher0.1.01 of 1See more

jellyfin th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-110654.

Container imageDigestPackageFixed in
jellyfin/jellyfin:10.10.77ae36aab93ef
zvbi@0.2.41-1
no fix listed

Open the chart page →

4,406
tdarrvhdirkVerified publisher5.0.52 of 2See more

tdarr vhdirk 5.0.5

2 of the 2 container images this version deploys carry CVE-2026-110654.

Container imageDigestPackageFixed in
haveagitgat/tdarr_node:2.17.013ff0913202dd
zvbi@0.2.35-17
no fix listed
ghcr.io/haveagitgat/tdarr:2.00.18.23fbe4c29d14c
zvbi@0.2.35-17
no fix listed

Open the chart page →

157,754
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-110654.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
zvbi@0.2.35-19
no fix listed

Open the chart page →

78,857
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-110654.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
zvbi@0.2.35-19
no fix listed

Open the chart page →

16,156

Container images carrying it

93 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
jellyfin/jellyfin:10.11:10.11.11:latestaefb67e6a7ff
zvbi@0.2.44-1
no fix listed
6
ciscolabs/rtsp-client:latesta7b60ec88285
zvbi@0.2.35-17
no fix listed
3
ciscolabs/rtsp-server:latestb59fc10bb821
zvbi@0.2.35-17
no fix listed
3
omecproject/cdn-video-repo:1.0.0:remote-v3d59ccb138ffb
zvbi@0.2.35-10
no fix listed
3
ghcr.io/music-assistant/server:2.10.645fdb050e069
zvbi@0.2.44-1
no fix listed
3
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
zvbi@0.2.44-1
no fix listed
3
alexandreroman/hello:latest4b79473442be
zvbi@0.2.35-13
no fix listed
2
kurento/kurento-media-server:latest03c0d34d0828
zvbi@0.2.42-2
no fix listed
2
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
zvbi@0.2.35-17
no fix listed
2
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
zvbi@0.2.44-1
no fix listed
2
ghcr.io/mealie-recipes/mealie:v3.28.08b02290f4d18
zvbi@0.2.44-1
no fix listed
2
ghcr.io/paperless-ngx/paperless-ngx:3.3.06b94799bc769
zvbi@0.2.44-1
no fix listed
2
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
zvbi@0.2.44-1
no fix listed
2
ghcr.io/smarter-project/hydra/isolated-vm:main4457b79b24cd
zvbi@0.2.41-1
no fix listed
2
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
zvbi@0.2.35-17
no fix listed
1
andrewmackrodt/firefox-x11:142.0.1-r133f9080470c9
zvbi@0.2.35-19
no fix listed
1
apache/tika:latest-fullab9cc988828c
zvbi@0.2.44-1ubuntu2
no fix listed
1
archivebox/archivebox:0.9.73d4720d86c0e9
zvbi@0.2.44-1
no fix listed
1
assistiot/video_augmentation:runner-cpu-lateste5ae539ce2cb
zvbi@0.2.35-17
no fix listed
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
zvbi@0.2.35-17
no fix listed
1
castopod/castopod:1.12.101fd37280cbb2
zvbi@0.2.41-1
no fix listed
1
castopod/castopod:1.15.54e4f0440520f
zvbi@0.2.44-1
no fix listed
1
chocobozzz/peertube:v8.1.5052712130691
zvbi@0.2.44-1
no fix listed
1
elastictranscoder/transcoder:627e21dcb4a0327029e6
zvbi@0.2.35-13
no fix listed
1
elastictranscoder/transcoder-handler:627e21dc5b75d19e2733
zvbi@0.2.35-13
no fix listed
1
haveagitgat/tdarr:2.00.181256348872ce
zvbi@0.2.35-17
no fix listed
1
haveagitgat/tdarr_node:2.17.013ff0913202dd
zvbi@0.2.35-17
no fix listed
1
intel/dlstreamer-pipeline-server:2022.1.1-ubuntu20aa8f5483a2ef
zvbi@0.2.35-17
no fix listed
1
jaedb/iris:latest048cfbf58d57
zvbi@0.2.41-1
no fix listed
1
jellyfin/jellyfin:10.11.81694ff069f0c
zvbi@0.2.44-1
no fix listed
1
jellyfin/jellyfin:10.11.717285f9cce63
zvbi@0.2.44-1
no fix listed
1
jellyfin/jellyfin:10.10.317c3a8d9dddb
zvbi@0.2.41-1
no fix listed
1
jellyfin/jellyfin:10.11.6333b64771663
zvbi@0.2.44-1
no fix listed
1
jellyfin/jellyfin:latest357724bf0ae2
zvbi@0.2.44-1
no fix listed
1
jellyfin/jellyfin:10.9.1079fb3d73a3e9
zvbi@0.2.41-1
no fix listed
1
jellyfin/jellyfin:10.10.77ae36aab93ef
zvbi@0.2.41-1
no fix listed
1
jellyfin/jellyfin:10.10.696b09723b22f
zvbi@0.2.41-1
no fix listed
1
josh5/unmanic:0.2.64d49c4816260
zvbi@0.2.35-19
no fix listed
1
langgenius/dify-api:0.6.11fca918260dd6
zvbi@0.2.41-1
no fix listed
1
langgenius/dify-plugin-daemon:0.6.10-local34412a22d1e1
zvbi@0.2.42-2
no fix listed
1
langgenius/dify-plugin-daemon:main-local4b07ca30ab2a
zvbi@0.2.42-2
no fix listed
1
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
zvbi@0.2.42-2
no fix listed
1
linuxchina/alibaba-rsocket-broker:1.1.3-k8sf758e2e567ee
zvbi@0.2.35-13
no fix listed
1
linuxserver/jellyfin:10.7.72427dde159a2
zvbi@0.2.35-17
no fix listed
1
livekit/ingress:v1.2.21ab01641b366
zvbi@0.2.35-19
no fix listed
1
machines/filestash:latestaff504cd28a8
zvbi@0.2.44-1
no fix listed
1
mlikiowa/napcat-docker:latest2cc70b45244a
zvbi@0.2.35-19
no fix listed
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
zvbi@0.2.44-1
no fix listed
1
nousresearch/hermes-agent:v2026.9.24fca358f12efd
zvbi@0.2.44-1
no fix listed
1
omecproject/cdn-antmedia:1.0.0b4ae7d0d6b74
zvbi@0.2.35-13
no fix listed
1

syft 1.42.1 · advisories as of 18 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.