StackRadar

CVE-2026-112395

Medium

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
17th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
275
of 18,208 indexed, latest versions
Container images
253
deployed by those charts
Fix available
1 of 2
affected packages

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Carried by container images the latest versions of 275 of 18,208 indexed charts deploy, on 253 images.

Affected packageAffected versionsFixed inImages
pillowpypi8.2.0, 8.3.1, 8.3.2, 8.4.0+22 more13.0.0253
pillowdeb9.4.0-1.1+b1, 9.4.0-1.1+deb12u1, 11.1.0-5+deb13u4no fix listed6
OSV records
DEBIAN-CVE-2026-112395GHSA-462x-pgg6-55fp

Charts affected

275 by stars
ChartLatestAffected imagesRadar Score
pgadmin4runixVerified publisher1.70.41 of 1See more

pgadmin4 runix 1.70.4

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.18c332c5f6dfba
pillow@12.3.0
13.0.0

Open the chart page →

229
home-assistanthelm-hassVerified publisher0.3.871 of 1See more

home-assistant helm-hass 0.3.87

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,196
mlflowcommunity-chartsVerified publisher1.11.71 of 1See more

mlflow community-charts 1.11.7

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
burakince/mlflow:3.16.0ab4b566644b9
pillow@12.3.0
13.0.0

Open the chart page →

1,190
netboxnetboxOfficialVerified publisher8.3.931 of 5See more

netbox netbox 8.3.93

1 of the 5 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/netbox-community/netbox:v4.7.31d6e0b5fbd48
pillow@12.3.0
13.0.0

Open the chart page →

1,666
netboxbootcVerified publisher4.1.11 of 4See more

netbox bootc 4.1.1

1 of the 4 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.2.83d652dca5351
pillow@9.2.0
13.0.0

Open the chart page →

10,077
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
pillow@11.0.0
13.0.0

Open the chart page →

12,160
weblateweblateOfficialVerified publisher0.5.431 of 3See more

weblate weblate 0.5.43

1 of the 3 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
weblate/weblate:2026.10.1.1b0f200f38d70
pillow@12.3.0
13.0.0

Open the chart page →

7,734
difydify-helmVerified publisher0.39.02 of 11See more

dify dify-helm 0.39.0

2 of the 11 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
pillow@12.3.0
13.0.0
langgenius/dify-api:1.17.052be6088dd84
pillow@12.3.0
13.0.0

Open the chart page →

63,506
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
pillow@9.1.0
13.0.0

Open the chart page →

9,331
synapsehalkeye0.40.01 of 2See more

synapse halkeye 0.40.0

1 of the 2 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
pillow@10.4.0
13.0.0

Open the chart page →

7,729
daskdask2024.1.12 of 2See more

dask dask 2024.1.1

2 of the 2 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/dask/dask:2024.1.0080150de7d86
pillow@10.0.1
13.0.0
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
pillow@10.2.0
13.0.0

Open the chart page →

14,949
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
pillow@10.1.0
13.0.0

Open the chart page →

7,629
frigateblakeblackshear7.8.01 of 1See more

frigate blakeblackshear 7.8.0

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/blakeblackshear/frigate:0.14.122e3d0b486df
pillow@10.4.0
13.0.0

Open the chart page →

4,463
paperless-ngxfmjstudios0.2.81 of 5See more

paperless-ngx fmjstudios 0.2.8

1 of the 5 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
pillow@10.3.0
13.0.0

Open the chart page →

35,475
nautobotnautobotOfficialVerified publisher3.1.21 of 1See more

nautobot nautobot 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
networktocode/nautobot:3.0-py3.13ed484336b1ad
pillow@12.2.0
13.0.0

Open the chart page →

5,471
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
pillow@11.1.0
13.0.0

Open the chart page →

21,802
paperless-ngxpaperless-ngxVerified publisher0.3.251 of 3See more

paperless-ngx paperless-ngx 0.3.25

1 of the 3 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
pillow@12.3.0
13.0.0

Open the chart page →

9,536
home-assistantalekcVerified publisher2.12.21 of 1See more

home-assistant alekc 2.12.2

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,196
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
pillow@12.3.0
13.0.0

Open the chart page →

3,705
baserowbaserow-chartVerified publisher1.1.11 of 6See more

baserow baserow-chart 1.1.1

1 of the 6 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
baserow/backend:2.4.1497347d0ba74
pillow@12.3.0
13.0.0

Open the chart page →

19,235
pgadmincetic0.1.121 of 1See more

pgadmin cetic 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
pillow@12.3.0
13.0.0

Open the chart page →

229
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
pillow@10.2.0
13.0.0

Open the chart page →

18,133
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
pillow@10.2.0
13.0.0

Open the chart page →

84,871
taigarc-helm-charts0.1.01 of 7See more

taiga rc-helm-charts 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
taigaio/taiga-back:6.4.29f97323cc150
pillow@8.2.0
13.0.0

Open the chart page →

8,526
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
pillow@10.3.0
13.0.0

Open the chart page →

2,028
grafana-pdf-exporterwiremindVerified publisher2.1.11 of 1See more

grafana-pdf-exporter wiremind 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
pillow@9.4.0-1.1+b1
pillow@9.4.0
no fix listed
13.0.0

Open the chart page →

10,798
matrixzekker6Verified publisher3.33.01 of 4See more

matrix zekker6 3.33.0

1 of the 4 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.163.0e98ab72138d9
pillow@12.3.0
13.0.0

Open the chart page →

6,075
changedetectionalekcVerified publisher0.14.71 of 1See more

changedetection alekc 0.14.7

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
pillow@12.3.0
13.0.0

Open the chart page →

2,534
convertigoconvertigoOfficialVerified publisher8.4.61 of 5See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
pillow@10.3.0
13.0.0

Open the chart page →

17,635
defectdojodefectdojo1.9.581 of 4See more

defectdojo defectdojo 1.9.58

1 of the 4 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
defectdojo/defectdojo-django:3.4.200e391fb1d6975
pillow@12.3.0
13.0.0

Open the chart page →

2,305
openshift-secured-pgadmineximiaitVerified publisher0.2.01 of 2See more

openshift-secured-pgadmin eximiait 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
dpage/pgadmin4:7.537946e4f3e7b
pillow@9.5.0
13.0.0

Open the chart page →

15,763
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
pillow@8.4.0
13.0.0

Open the chart page →

9,555
mlflowgetindataVerified publisher0.1.21 of 1See more

mlflow getindata 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
pillow@10.3.0
13.0.0

Open the chart page →

2,775
simple-krr-dashboardhelm-simple-krr-dashboardVerified publisher1.6.21 of 3See more

simple-krr-dashboard helm-simple-krr-dashboard 1.6.2

1 of the 3 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
robustadev/krr:v1.30.0b8d782e568c7
pillow@12.3.0
13.0.0

Open the chart page →

3,130
home-assistanthome-assistantVerified publisher0.5.141 of 3See more

home-assistant home-assistant 0.5.14

1 of the 3 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,420
calibre-webk8s-home-lab-repo9.1.11 of 1See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
pillow@12.3.0
13.0.0

Open the chart page →

6,871
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
pillow@12.1.1
13.0.0

Open the chart page →

6,252
mlflow-tracking-servermlflow-tracking-serverVerified publisher4.1.01 of 1See more

mlflow-tracking-server mlflow-tracking-server 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/mlflow-oidc/mlflow-tracking-server:3.16.1-9.0.2-20261001970ba1cc1e69
pillow@12.3.0
13.0.0

Open the chart page →

789
kobotoolboxone-acre-fundVerified publisher0.7.42 of 9See more

kobotoolbox one-acre-fund 0.7.4

2 of the 9 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
kobotoolbox/kobocat:2.022.24ab15679454415
pillow@9.1.0
13.0.0
kobotoolbox/kpi:2.022.24dbcacc01bccd4
pillow@9.1.0
13.0.0

Open the chart page →

24,379
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
pillow@12.0.0
13.0.0

Open the chart page →

113,160
skypilotskypilotOfficialVerified publisher0.14.11 of 3See more

skypilot skypilot 0.14.1

1 of the 3 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.14.125577df35586
pillow@12.3.0
13.0.0

Open the chart page →

6,484
pretixtechwolf12Verified publisher2026.8.01 of 3See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
pretix/standalone:2026.8.0ec17c2f761f7
pillow@12.3.0
13.0.0

Open the chart page →

10,080
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
pillow@12.0.0
13.0.0

Open the chart page →

4,889
wgerwgerOfficialVerified publisher2.0.01 of 7See more

wger wger 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
wger/server:2.71c5789b93bfe
pillow@12.3.0
13.0.0

Open the chart page →

9,140
paperlesszekker6Verified publisher11.13.01 of 1See more

paperless zekker6 11.13.0

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
pillow@12.3.0
13.0.0

Open the chart page →

5,509
paperless-ngxadnoctemVerified publisher0.5.11 of 5See more

paperless-ngx adnoctem 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
pillow@12.3.0
13.0.0

Open the chart page →

27,329
agentareaagentareaVerified publisher0.0.281 of 17See more

agentarea agentarea 0.0.28

1 of the 17 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
agentarea/agentarea-mcp-runner:0.1.1066fa4a71695
pillow@12.3.0
13.0.0

Open the chart page →

12,172
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
pillow@11.3.0
13.0.0

Open the chart page →

14,774
clearml-servingallegroaiVerified publisher1.6.22 of 9See more

clearml-serving allegroai 1.6.2

2 of the 9 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
pillow@9.4.0
13.0.0
allegroai/clearml-serving-statistics:1.3.0c58d9da7bdf8
pillow@9.4.0
13.0.0

Open the chart page →

26,263
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-112395.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
pillow@12.3.0
13.0.0

Open the chart page →

7,885

Container images carrying it

253 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
pillow@12.0.0
13.0.0
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
pillow@10.3.0
13.0.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
pillow@12.2.0
13.0.0
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.