StackRadar

CVE-2026-113786

Low

Advisory

Published 21 Oct 2026In the index since 22 Oct 2026
Severity
Low
worst across findings
CVSS
2.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
25
of 18,219 indexed, latest versions
Container images
23
deployed by those charts
Fix available
1 of 1
affected package

pypdf: Unvalidated JPEG image data loading

Carried by container images the latest versions of 25 of 18,219 indexed charts deploy, on 23 images.

Affected packageAffected versionsFixed inImages
pypdfpypi5.0.1, 5.1.0, 5.3.0, 5.4.0+11 more6.21.123
OSV records
GHSA-5hx5-vpf9-5wcv

Charts affected

25 by stars
ChartLatestAffected imagesRadar Score
datahubdatahubVerified publisher1.1.71 of 4See more

datahub datahub 1.1.7

1 of the 4 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
acryldata/datahub-actions:v1.7.0.1c5fd70130157
pypdf@6.16.2
6.21.1

Open the chart page →

1,774
difydify-helmVerified publisher0.39.02 of 11See more

dify dify-helm 0.39.0

2 of the 11 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
pypdf@6.14.2
6.21.1
langgenius/dify-api:1.17.052be6088dd84
pypdf@6.15.0
6.21.1

Open the chart page →

63,621
litellm-helmlitellm1.106.21 of 2See more

litellm-helm litellm 1.106.2

1 of the 2 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:1.106.27294b90f868c
pypdf@6.19.0
6.21.1

Open the chart page →

5,381
calibre-webk8s-home-lab-repo9.1.11 of 1See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
pypdf@6.4.2
6.21.1

Open the chart page →

7,133
pretixtechwolf12Verified publisher2026.8.01 of 3See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
pretix/standalone:2026.8.0ec17c2f761f7
pypdf@6.19.0
6.21.1

Open the chart page →

10,388
agentareaagentareaVerified publisher0.0.291 of 17See more

agentarea agentarea 0.0.29

1 of the 17 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
agentarea/agentarea-mcp-runner:0.1.1066fa4a71695
pypdf@6.19.0
6.21.1

Open the chart page →

12,411
langflow-idelangflow0.1.21 of 2See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
langflowai/langflow:latesta0396e089eb9
pypdf@6.19.0
6.21.1

Open the chart page →

4,790
langflow-runtimelangflow0.1.11 of 1See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
langflowai/langflow:latesta0396e089eb9
pypdf@6.19.0
6.21.1

Open the chart page →

578
securosecuroVerified publisher0.16.51 of 4See more

securo securo 0.16.5

1 of the 4 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
ghcr.io/securo-finance/securo-backend:0.16.50e40c6858fb3
pypdf@6.20.1
6.21.1

Open the chart page →

4,077
litellmalareira0.3.01 of 1See more

litellm alareira 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:main-stable7294b90f868c
pypdf@6.19.0
6.21.1

Open the chart page →

188
argonix-apiargonix0.6.51 of 4See more

argonix-api argonix 0.6.5

1 of the 4 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api:0.6.5431abcce7c1e
pypdf@6.14.2
6.21.1

Open the chart page →

6,780
calibre-web-automatedcalibre-web-automatedVerified publisher1.2.31 of 1See more

calibre-web-automated calibre-web-automated 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
crocodilestick/calibre-web-automated:v4.0.6c31a738b6d5e
pypdf@6.6.2
6.21.1

Open the chart page →

8,893
calibre-webcharts-derwitt-devVerified publisher1.1.41 of 1See more

calibre-web charts-derwitt-dev 1.1.4

1 of the 1 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
ghcr.io/wittdennis/calibre-web:1.1.31086aac67a05
pypdf@6.10.2
6.21.1

Open the chart page →

6,428
csghubcsghubVerified publisher2.6.01 of 35See more

csghub csghub 2.6.0

1 of the 35 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
pypdf@5.1.0
6.21.1

Open the chart page →

68,963
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
pypdf@5.3.0
6.21.1

Open the chart page →

56,433
rag-apihajowielandVerified publisher1.0.01 of 1See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latesta62ce2221b43
pypdf@6.19.0
6.21.1

Open the chart page →

1,808
langflowhelmforgeVerified publisher2.0.41 of 1See more

langflow helmforge 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.6a0396e089eb9
pypdf@6.19.0
6.21.1

Open the chart page →

578
inventreeinventreeOfficialVerified publisher0.4.341 of 2See more

inventree inventree 0.4.34

1 of the 2 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
inventree/inventree:1.6.17c1e251a6c52
pypdf@6.20.0
6.21.1

Open the chart page →

5,919
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
pypdf@5.4.0
6.21.1

Open the chart page →

10,010
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest92b8fab500f9
pypdf@6.19.0
6.21.1

Open the chart page →

9,240
opds-shelfopds-shelfVerified publisher0.4.01 of 3See more

opds-shelf opds-shelf 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:latestb206b791d77b
pypdf@6.10.2
6.21.1

Open the chart page →

6,279
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
pypdf@6.10.2
6.21.1

Open the chart page →

9,934
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
pypdf@6.9.0
6.21.1

Open the chart page →

6,456
backendsignalen4.25.01 of 4See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
signalen/backend:2.50.1826bb090bc4e4
pypdf@6.18.0
6.21.1

Open the chart page →

36,570
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-113786.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
pypdf@5.0.1
6.21.1

Open the chart page →

10,394

Container images carrying it

23 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
langflowai/langflow:1.12.6:latesta0396e089eb9
pypdf@6.19.0
6.21.1
3
ghcr.io/berriai/litellm:1.106.2:main-stable7294b90f868c
pypdf@6.19.0
6.21.1
2
acryldata/datahub-actions:v1.7.0.1c5fd70130157
pypdf@6.16.2
6.21.1
1
agentarea/agentarea-mcp-runner:0.1.1:latest066fa4a71695
pypdf@6.19.0
6.21.1
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
pypdf@5.4.0
6.21.1
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
pypdf@6.10.2
6.21.1
1
crocodilestick/calibre-web-automated:v4.0.6c31a738b6d5e
pypdf@6.6.2
6.21.1
1
inventree/inventree:1.6.17c1e251a6c52
pypdf@6.20.0
6.21.1
1
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
pypdf@6.14.2
6.21.1
1
langgenius/dify-api:1.0.0066035f93856
pypdf@5.3.0
6.21.1
1
langgenius/dify-api:1.17.052be6088dd84
pypdf@6.15.0
6.21.1
1
linuxserver/calibre-web:0.6.24241009026e6f
pypdf@5.0.1
6.21.1
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
pypdf@6.9.0
6.21.1
1
onyxdotapp/onyx-backend:latest92b8fab500f9
pypdf@6.19.0
6.21.1
1
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
pypdf@5.1.0
6.21.1
1
pretix/standalone:2026.8.0ec17c2f761f7
pypdf@6.19.0
6.21.1
1
signalen/backend:2.50.1826bb090bc4e4
pypdf@6.18.0
6.21.1
1
ghcr.io/argonix-io/argonix-api:0.6.5431abcce7c1e
pypdf@6.14.2
6.21.1
1
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latesta62ce2221b43
pypdf@6.19.0
6.21.1
1
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
pypdf@6.4.2
6.21.1
1
ghcr.io/linuxserver/calibre-web:latestb206b791d77b
pypdf@6.10.2
6.21.1
1
ghcr.io/securo-finance/securo-backend:0.16.50e40c6858fb3
pypdf@6.20.1
6.21.1
1
ghcr.io/wittdennis/calibre-web:1.1.31086aac67a05
pypdf@6.10.2
6.21.1
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.