StackRadar

CVE-2026-112405

High

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
128
of 18,219 indexed, latest versions
Container images
106
deployed by those charts
Fix available
1 of 2
affected packages

Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

Carried by container images the latest versions of 128 of 18,219 indexed charts deploy, on 106 images.

Affected packageAffected versionsFixed inImages
pillowpypi12.0.0, 12.1.0, 12.1.1, 12.2.0+1 more13.0.0101
pillowdeb9.4.0-1.1+b1, 9.4.0-1.1+deb12u1no fix listed5
OSV records
DEBIAN-CVE-2026-112405GHSA-cp9v-662q-vvx9

Charts affected

128 by stars
ChartLatestAffected imagesRadar Score
pgadmin4runixVerified publisher1.70.41 of 1See more

pgadmin4 runix 1.70.4

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.18c332c5f6dfba
pillow@12.3.0
13.0.0

Open the chart page →

449
home-assistanthelm-hassVerified publisher0.3.871 of 1See more

home-assistant helm-hass 0.3.87

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,436
mlflowcommunity-chartsVerified publisher1.11.71 of 1See more

mlflow community-charts 1.11.7

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
burakince/mlflow:3.16.0ab4b566644b9
pillow@12.3.0
13.0.0

Open the chart page →

1,404
netboxnetboxOfficialVerified publisher8.3.931 of 5See more

netbox netbox 8.3.93

1 of the 5 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/netbox-community/netbox:v4.7.31d6e0b5fbd48
pillow@12.3.0
13.0.0

Open the chart page →

1,889
weblateweblateOfficialVerified publisher0.5.441 of 3See more

weblate weblate 0.5.44

1 of the 3 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
weblate/weblate:2026.10.1.26663a7c8b444
pillow@12.3.0
13.0.0

Open the chart page →

7,687
difydify-helmVerified publisher0.39.02 of 11See more

dify dify-helm 0.39.0

2 of the 11 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
pillow@12.3.0
13.0.0
langgenius/dify-api:1.17.052be6088dd84
pillow@12.3.0
13.0.0

Open the chart page →

63,621
nautobotnautobotOfficialVerified publisher3.2.01 of 1See more

nautobot nautobot 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
networktocode/nautobot:3.0-py3.13ed484336b1ad
pillow@12.2.0
13.0.0

Open the chart page →

5,723
paperless-ngxpaperless-ngxVerified publisher0.3.251 of 3See more

paperless-ngx paperless-ngx 0.3.25

1 of the 3 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
pillow@12.3.0
13.0.0

Open the chart page →

9,700
home-assistantalekcVerified publisher2.12.21 of 1See more

home-assistant alekc 2.12.2

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,436
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
pillow@12.3.0
13.0.0

Open the chart page →

3,985
baserowbaserow-chartVerified publisher1.1.11 of 6See more

baserow baserow-chart 1.1.1

1 of the 6 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
baserow/backend:2.4.1497347d0ba74
pillow@12.3.0
13.0.0

Open the chart page →

19,474
pgadmincetic0.1.121 of 1See more

pgadmin cetic 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
pillow@12.3.0
13.0.0

Open the chart page →

449
grafana-pdf-exporterwiremindVerified publisher2.1.11 of 1See more

grafana-pdf-exporter wiremind 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
pillow@9.4.0-1.1+b1
no fix listed

Open the chart page →

10,945
matrixzekker6Verified publisher3.33.01 of 4See more

matrix zekker6 3.33.0

1 of the 4 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.163.0e98ab72138d9
pillow@12.3.0
13.0.0

Open the chart page →

6,303
changedetectionalekcVerified publisher0.14.71 of 1See more

changedetection alekc 0.14.7

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
pillow@12.3.0
13.0.0

Open the chart page →

2,728
simple-krr-dashboardhelm-simple-krr-dashboardVerified publisher1.6.21 of 3See more

simple-krr-dashboard helm-simple-krr-dashboard 1.6.2

1 of the 3 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
robustadev/krr:v1.30.0b8d782e568c7
pillow@12.3.0
13.0.0

Open the chart page →

3,403
home-assistanthome-assistantVerified publisher0.5.141 of 3See more

home-assistant home-assistant 0.5.14

1 of the 3 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,661
calibre-webk8s-home-lab-repo9.1.11 of 1See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
pillow@12.3.0
13.0.0

Open the chart page →

7,133
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
pillow@12.1.1
13.0.0

Open the chart page →

6,533
mlflow-tracking-servermlflow-tracking-serverVerified publisher4.1.01 of 1See more

mlflow-tracking-server mlflow-tracking-server 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/mlflow-oidc/mlflow-tracking-server:3.16.1-9.0.2-20261001970ba1cc1e69
pillow@12.3.0
13.0.0

Open the chart page →

1,003
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
pillow@12.0.0
13.0.0

Open the chart page →

113,367
skypilotskypilotOfficialVerified publisher0.14.11 of 3See more

skypilot skypilot 0.14.1

1 of the 3 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.14.125577df35586
pillow@12.3.0
13.0.0

Open the chart page →

6,695
pretixtechwolf12Verified publisher2026.8.01 of 3See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
pretix/standalone:2026.8.0ec17c2f761f7
pillow@12.3.0
13.0.0

Open the chart page →

10,388
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
pillow@12.0.0
13.0.0

Open the chart page →

5,163
wgerwgerOfficialVerified publisher2.0.01 of 7See more

wger wger 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
wger/server:2.71c5789b93bfe
pillow@12.3.0
13.0.0

Open the chart page →

9,278
paperlesszekker6Verified publisher11.14.01 of 1See more

paperless zekker6 11.14.0

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
pillow@12.3.0
13.0.0

Open the chart page →

5,685
paperless-ngxadnoctemVerified publisher0.5.11 of 5See more

paperless-ngx adnoctem 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
pillow@12.3.0
13.0.0

Open the chart page →

29,566
agentareaagentareaVerified publisher0.0.291 of 17See more

agentarea agentarea 0.0.29

1 of the 17 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
agentarea/agentarea-mcp-runner:0.1.1066fa4a71695
pillow@12.3.0
13.0.0

Open the chart page →

12,411
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
pillow@12.3.0
13.0.0

Open the chart page →

8,119
music-assistantbdclark-helm-chartsVerified publisher0.4.151 of 1See more

music-assistant bdclark-helm-charts 0.4.15

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
pillow@12.3.0
13.0.0

Open the chart page →

5,246
aibrixdanchevVerified publisher0.8.01 of 5See more

aibrix danchev 0.8.0

1 of the 5 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.8.058b915e3708d
pillow@12.3.0
13.0.0

Open the chart page →

6,720
mealiedeimosfr-charts1.0.171 of 1See more

mealie deimosfr-charts 1.0.17

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.29.078eb28b8776d
pillow@12.3.0
13.0.0

Open the chart page →

3,921
craftycontrollerdrewburr-labs-helm-chartsVerified publisher0.3.01 of 1See more

craftycontroller drewburr-labs-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
pillow@12.2.0
13.0.0

Open the chart page →

40,069
taigafermosit0.0.111 of 7See more

taiga fermosit 0.0.11

1 of the 7 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
pillow@12.0.0
13.0.0

Open the chart page →

10,492
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest33afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,436
bazarrhalkeye0.2.01 of 1See more

bazarr halkeye 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
linuxserver/bazarr:latestfb0437897eaa
pillow@12.3.0
13.0.0

Open the chart page →

527
immichimmich-helmVerified publisher0.5.11 of 4See more

immich immich-helm 0.5.1

1 of the 4 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v3.3.41ab8674e7cec
pillow@12.3.0
13.0.0

Open the chart page →

9,913
langflow-idelangflow0.1.21 of 2See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
langflowai/langflow:latesta0396e089eb9
pillow@12.3.0
13.0.0

Open the chart page →

4,790
langflow-runtimelangflow0.1.11 of 1See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
langflowai/langflow:latesta0396e089eb9
pillow@12.3.0
13.0.0

Open the chart page →

578
home-assistantloeken-at-homeVerified publisher2026.9.21 of 1See more

home-assistant loeken-at-home 2026.9.2

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
loeken/home-assistant:2026.9.2b1dff5b4c593
pillow@12.3.0
13.0.0

Open the chart page →

2,793
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.61 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.6

1 of the 34 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-chatbot604b1f493c92
pillow@12.3.0
13.0.0

Open the chart page →

27,946
paperless-ngxpaperlessVerified publisher0.4.01 of 3See more

paperless-ngx paperless 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngxdigest-pinnedaa810a36942c
pillow@12.3.0
13.0.0

Open the chart page →

11,485
home-assistantpree-helm-chartsVerified publisher1.85.01 of 1See more

home-assistant pree-helm-charts 1.85.0

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,436
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
pillow@12.2.0
13.0.0

Open the chart page →

50,051
sceptresceptreai0.1.122 of 5See more

sceptre sceptreai 0.1.12

2 of the 5 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
maponyacharles/sceptreai:mlflow-0.1.1242d418654ebd
pillow@12.3.0
13.0.0
maponyacharles/sceptreai:api-0.1.127b37b092130a
pillow@12.3.0
13.0.0

Open the chart page →

6,626
securosecuroVerified publisher0.16.51 of 4See more

securo securo 0.16.5

1 of the 4 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/securo-finance/securo-backend:0.16.50e40c6858fb3
pillow@12.3.0
13.0.0

Open the chart page →

4,077
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
pillow@12.2.0
13.0.0

Open the chart page →

53,689
waldurwaldur-chartsVerified publisher8.1.31 of 3See more

waldur waldur-charts 8.1.3

1 of the 3 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
opennode/waldur-mastermind:8.1.382e8f276c5ed
pillow@12.3.0
13.0.0

Open the chart page →

4,521
akto-ai-guardrails-v2akto0.3.01 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

1 of the 6 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
aktosecurity/akto-agent-guard-embedder:1.1.4dbc566b2376c
pillow@12.3.0
13.0.0

Open the chart page →

53,168
esphomealekcVerified publisher2.10.01 of 1See more

esphome alekc 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-112405.

Container imageDigestPackageFixed in
esphome/esphome:2026.10.03a32372dfbd6
pillow@12.3.0
13.0.0

Open the chart page →

3,839

Container images carrying it

106 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
pillow@9.4.0-1.1+b1
no fix listed
1
ghcr.io/wittdennis/calibre-web:1.1.31086aac67a05
pillow@12.3.0
13.0.0
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
pillow@12.2.0
13.0.0
1
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
pillow@12.0.0
13.0.0
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
pillow@12.0.0
13.0.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
pillow@12.2.0
13.0.0
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.