StackRadar

CVE-2026-113680

Medium

Advisory

Published 20 Oct 2026In the index since 24 Oct 2026
Severity
Medium
worst across findings
CVSS
6.8
base score, highest
EPSS
0.001
2nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
380
of 18,232 indexed, latest versions
Container images
377
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 380 of 18,232 indexed charts deploy, on 377 images.

Affected packageAffected versionsFixed inImages
harfbuzzdeb0.9.27-1ubuntu1.1, 1.0.1-1ubuntu0.1, 1.7.2-1ubuntu1, 2.6.4-1ubuntu4+11 moreno fix listed377
OSV records
DEBIAN-CVE-2026-113680UBUNTU-CVE-2026-113680

Charts affected

380 by stars
ChartLatestAffected imagesRadar Score
stunner-kurento-one2one-callstunner0.1.01 of 2See more

stunner-kurento-one2one-call stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
kurento/kurento-media-server:latest03c0d34d0828
harfbuzz@8.3.0-2build2
no fix listed

Open the chart page →

14,223
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

86,137
flaresolverrsudo-kraken-flaresolverrVerified publisher2.1.41 of 1See more

flaresolverr sudo-kraken-flaresolverr 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
ghcr.io/flaresolverr/flaresolverr:v3.4.67962759d99d7
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

44,796
nagvissvtech-public-helm-charts1.0.01 of 1See more

nagvis svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
svtechnmaa/svtech_nagvis:v1.2.118394b08e6c3
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

84,631
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
harfbuzz@2.6.4-1ubuntu4.2
no fix listed

Open the chart page →

76,449
stash-boxswuuper-githubVerified publisher0.1.11 of 2See more

stash-box swuuper-github 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
stashapp/stash-box:latesta534c8afdf39
harfbuzz@8.3.0-2build2
no fix listed

Open the chart page →

10,196
cronjobt3n0.1.01 of 1See more

cronjob t3n 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
library/python:3.8d41127070014
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

78,300
spring-boot-helm-startertest0.1.01 of 1See more

spring-boot-helm-starter test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
alexandreroman/hello:latest4b79473442be
harfbuzz@1.7.2-1ubuntu1
no fix listed

Open the chart page →

116,760
helm-testtest-helm-artifacthubVerified publisher1.0.01 of 2See more

helm-test test-helm-artifacthub 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
carlosmz87/test_helm_backend:latest8ffa63aa995d
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

75,471
codegentest-opea1.0.01 of 5See more

codegen test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
opea/codegen-ui:1.02bee4eb66f3e
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

108,485
codetranstest-opea1.0.01 of 5See more

codetrans test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
opea/codetrans-ui:1.03ef121f34610
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

108,010
docsumtest-opea1.0.01 of 5See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
opea/docsum-ui:1.07f854e9bffaf
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

108,512
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

11,193
nextcloudth-chartsVerified publisher0.4.01 of 1See more

nextcloud th-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
library/nextcloud:31.0.6-apache588609d76b21
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

65,813
owncloudth-chartsVerified publisher0.2.11 of 1See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
owncloud/server:10.15.051d9b74fc2a8
harfbuzz@2.6.4-1ubuntu4.2
no fix listed

Open the chart page →

11,842
openunison-operatortremolo3.0.331 of 1See more

openunison-operator tremolo 3.0.33

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
ghcr.io/openunison/openunison-kubernetes-operator:1.0.1533fbac79f442
harfbuzz@8.3.0-2build2
no fix listed

Open the chart page →

1,217
orchestratremolo3.1.582 of 5See more

orchestra tremolo 3.1.58

2 of the 5 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
ghcr.io/openunison/openunison-k8s:1.0.53d8c8e5a4830f
harfbuzz@8.3.0-2build2
no fix listed
ghcr.io/openunison/openunison-kubernetes-operator:1.0.1533fbac79f442
harfbuzz@8.3.0-2build2
no fix listed

Open the chart page →

4,151
tfy-distributortruefoundryVerified publisher0.0.11 of 4See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

96,471
altinnendata-apitumogroup0.1.291 of 1See more

altinnendata-api tumogroup 0.1.29

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
sondresjo/altinnendata-api:v1.13.051fc4bde3f8d
harfbuzz@8.3.0-2build2
no fix listed

Open the chart page →

989
demo-backendv2flyVerified publisher0.0.31 of 1See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

97,326
tdarrvhdirkVerified publisher5.0.52 of 2See more

tdarr vhdirk 5.0.5

2 of the 2 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
haveagitgat/tdarr_node:2.17.013ff0913202dd
harfbuzz@2.6.4-1ubuntu4.2
no fix listed
ghcr.io/haveagitgat/tdarr:2.00.18.23fbe4c29d14c
harfbuzz@2.6.4-1ubuntu4
no fix listed

Open the chart page →

156,714
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
harfbuzz@2.7.4-1ubuntu3.1
no fix listed

Open the chart page →

78,945
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

70,771
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
harfbuzz@8.3.0-2build2
no fix listed

Open the chart page →

5,455
kongwallarmVerified publisher4.6.31 of 7See more

kong wallarm 4.6.3

1 of the 7 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
wallarm/kong:3.1.0-ubuntu-4.6.0ea9608c82e40
harfbuzz@2.6.4-1ubuntu4.2
no fix listed

Open the chart page →

75,668
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
harfbuzz@2.6.4-1ubuntu4
no fix listed

Open the chart page →

15,896
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
harfbuzz@2.6.4-1ubuntu4
no fix listed

Open the chart page →

31,434
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
harfbuzz@2.7.4-1ubuntu3.1
no fix listed

Open the chart page →

16,335
sockpuppetbrowserzekker6Verified publisher0.1.01 of 1See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
dgtlmoon/sockpuppetbrowser:latest1d8f72d2ce20
harfbuzz@6.0.0+dfsg-3
no fix listed

Open the chart page →

5,341
zoo-project-druzoo-projectOfficialVerified publisher0.11.01 of 6See more

zoo-project-dru zoo-project 0.11.0

1 of the 6 container images this version deploys carry CVE-2026-113680.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-e150308e13ba5e922d16e0eaef6547d60ffb2a40d05f09b1b46d
harfbuzz@2.7.4-1ubuntu3.2
no fix listed

Open the chart page →

7,055

Container images carrying it

377 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/flaresolverr/flaresolverr:latest:v3.5.2c80ae007ce2c
harfbuzz@6.0.0+dfsg-3
no fix listed
5
flaresolverr/flaresolverr:latest:v3.5.0139dfee1c6f8
harfbuzz@6.0.0+dfsg-3
no fix listed
4
hyperledger/fabric-ca-tools:latest4ce6f43ded2e
harfbuzz@1.0.1-1ubuntu0.1
no fix listed
4
hyperledger/fabric-couchdb:0.4.15f6c724592abf
harfbuzz@1.0.1-1ubuntu0.1
no fix listed
4
ciscolabs/rtsp-client:latesta7b60ec88285
harfbuzz@2.6.4-1ubuntu4.2
no fix listed
3
ciscolabs/rtsp-server:latestb59fc10bb821
harfbuzz@2.6.4-1ubuntu4.2
no fix listed
3
freikin/dawarich:1.16.0b533e6eac446
harfbuzz@10.2.0-1+deb13u1
no fix listed
3
library/nextcloud:35.0.2:35.0.2-apachea588aa535370
harfbuzz@10.2.0-1+deb13u1
no fix listed
3
omecproject/cdn-video-repo:1.0.0:remote-v3d59ccb138ffb
harfbuzz@1.0.1-1ubuntu0.1
no fix listed
3
ghcr.io/paperless-ngx/paperless-ngx:3.3.49bc6e8248891
harfbuzz@10.2.0-1+deb13u1
no fix listed
3
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
harfbuzz@10.2.0-1+deb13u1
no fix listed
3
quay.io/devtron/ai-agent:0.0.16545dac92173
harfbuzz@6.0.0+dfsg-3
no fix listed
3
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
harfbuzz@6.0.0+dfsg-3
no fix listed
3
alexandreroman/hello:latest4b79473442be
harfbuzz@1.7.2-1ubuntu1
no fix listed
2
apache/tika:2.9.0.092d055a84e9e
harfbuzz@2.7.4-1ubuntu3.1
no fix listed
2
gjeanmart/safe-ganache-node:latest926264c8f2d1
harfbuzz@6.0.0+dfsg-3
no fix listed
2
gotenberg/gotenberg:8.38.1aa552cc115db
harfbuzz@10.2.0-1+deb13u1
no fix listed
2
gradiant/srsran-5g:23_10_19061b1bf0f36
harfbuzz@2.6.4-1ubuntu4.2
no fix listed
2
homebridge/homebridge:latestd2370beb6a02
harfbuzz@8.3.0-2build2
no fix listed
2
hookiesolutions/webhookie:latest0629694246ba
harfbuzz@2.6.4-1ubuntu4
no fix listed
2
hyperledger/besu:22.4-openjdk-latesta674d35eec9a
harfbuzz@2.6.4-1ubuntu4
no fix listed
2
jacobalberty/unifi:v10.0.162896c0ab82d33
harfbuzz@2.6.4-1ubuntu4.3
no fix listed
2
kurento/kurento-media-server:latest03c0d34d0828
harfbuzz@8.3.0-2build2
no fix listed
2
library/node:lts14078204b6bb
harfbuzz@6.0.0+dfsg-3
no fix listed
2
library/python:3.7eedf63967cdb
harfbuzz@6.0.0+dfsg-3
no fix listed
2
louislam/uptime-kuma:2.5.69912da7d7d9b
harfbuzz@6.0.0+dfsg-3
no fix listed
2
louislam/uptime-kuma:2.3.29aeb4e51d038
harfbuzz@6.0.0+dfsg-3
no fix listed
2
moreillon/user-manager:v5.0.2e1c9bfab5c16
harfbuzz@6.0.0+dfsg-3
no fix listed
2
owncloud/server:10.16.6:10.16.6-20261022879638cd818b
harfbuzz@2.7.4-1ubuntu3.2
no fix listed
2
qichenxu4pd/pythonexample:1.0f3a8502bc21b
harfbuzz@6.0.0+dfsg-3
no fix listed
2
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d469:2.18.12-branch.testing3.88744-f55b3414bd113093583
harfbuzz@6.0.0+dfsg-3
no fix listed
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
harfbuzz@8.3.0-2build2
no fix listed
2
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
harfbuzz@2.6.4-1ubuntu4
no fix listed
2
ghcr.io/games-on-whales/steam:1.0.09b6105be7ad0
harfbuzz@2.6.4-1ubuntu4
no fix listed
2
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
harfbuzz@10.2.0-1+deb13u1
no fix listed
2
ghcr.io/mealie-recipes/mealie:v3.29.078eb28b8776d
harfbuzz@10.2.0-1+deb13u1
no fix listed
2
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
harfbuzz@10.2.0-1+deb13u1
no fix listed
2
ghcr.io/openunison/openunison-kubernetes-operator:1.0.1533fbac79f442
harfbuzz@8.3.0-2build2
no fix listed
2
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
harfbuzz@10.2.0-1+deb13u1
no fix listed
2
ghcr.io/smarter-project/hydra/isolated-vm:main4457b79b24cd
harfbuzz@6.0.0+dfsg-3
no fix listed
2
1dev/server:11.9.0cd5b12fe5471
harfbuzz@8.3.0-2build2
no fix listed
1
5200710/hadoop:3.2.3-java8092d3088a5fb
harfbuzz@2.6.4-1ubuntu4.2
no fix listed
1
aapjeisbaas/wp-frankenphp:v0.3.19c09a3563ca3
harfbuzz@10.2.0-1+deb13u1
no fix listed
1
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
harfbuzz@2.6.4-1ubuntu4
no fix listed
1
andrewmackrodt/firefox-x11:142.0.1-r133f9080470c9
harfbuzz@2.7.4-1ubuntu3.2
no fix listed
1
anguda/ant-media:2.5c435285fc241
harfbuzz@2.6.4-1ubuntu4.2
no fix listed
1
anujdatar/cups:25.07.01685df04a643b
harfbuzz@6.0.0+dfsg-3
no fix listed
1
apache/druid:37.0.00116fb802786
harfbuzz@6.0.0+dfsg-3
no fix listed
1
apache/druid:29.0.10cef139b6bf1
harfbuzz@6.0.0+dfsg-3
no fix listed
1
apachepulsar/pulsar:2.10.03b262ab7a7d9
harfbuzz@2.6.4-1ubuntu4
no fix listed
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.