StackRadar

CVE-2026-114110

Low

Advisory

Published 10 Apr 2026In the index since 22 Oct 2026
Severity
Low
worst across findings
CVSS
2.1
base score, highest
EPSS
0.003
18th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
21
of 18,219 indexed, latest versions
Container images
24
deployed by those charts
Fix available
1 of 1
affected package

uv vulnerable to arbitrary file deletion through RECORD entries

Carried by container images the latest versions of 21 of 18,219 indexed charts deploy, on 24 images.

Affected packageAffected versionsFixed inImages
uvpypi0.4.1, 0.4.29, 0.5.6, 0.5.27+12 more0.11.624
OSV records
GHSA-pjjw-68hj-v9mw

Charts affected

21 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
uv@0.9.17
0.11.6

Open the chart page →

83,728
difydify-helmVerified publisher0.39.03 of 11See more

dify dify-helm 0.39.0

3 of the 11 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
uv@0.8.9
0.11.6
langgenius/dify-agent-local-sandbox:1.17.0316279a82ead
uv@0.8.9
0.11.6
langgenius/dify-api:1.17.052be6088dd84
uv@0.8.9
0.11.6

Open the chart page →

63,621
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
uv@0.8.13
0.11.6

Open the chart page →

24,509
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
uv@0.10.6
0.11.6

Open the chart page →

6,533
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
uv@0.9.26
0.11.6

Open the chart page →

8,487
sentry-k8ssentry-k8sVerified publisher1.4.12 of 11See more

sentry-k8s sentry-k8s 1.4.1

2 of the 11 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
uv@0.9.28
0.11.6
ghcr.io/getsentry/snuba:26.7.210f8d164109b
uv@0.9.28
0.11.6

Open the chart page →

53,689
esphomealekcVerified publisher2.10.01 of 1See more

esphome alekc 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
esphome/esphome:2026.10.03a32372dfbd6
uv@0.10.1
0.11.6

Open the chart page →

3,839
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-rwd:log74ded2d92f07
uv@0.6.14
0.11.6

Open the chart page →

138,645
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
uv@0.4.29
0.11.6

Open the chart page →

18,379
kube-acp-stackcloudentity2.29.11 of 7See more

kube-acp-stack cloudentity 2.29.1

1 of the 7 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
uv@0.6.3
0.11.6

Open the chart page →

25,510
csghubcsghubVerified publisher2.6.01 of 35See more

csghub csghub 2.6.0

1 of the 35 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
uv@0.7.20
0.11.6

Open the chart page →

68,963
esphomeegebackVerified publisher2.0.271 of 1See more

esphome egeback 2.0.27

1 of the 1 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
esphome/esphome:2026.9.14ad55931c018
uv@0.10.1
0.11.6

Open the chart page →

4,025
esphomegabe565Verified publisher0.15.01 of 1See more

esphome gabe565 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:latest776a845d5089
uv@0.10.1
0.11.6

Open the chart page →

4,025
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
uv@0.6.1
0.11.6

Open the chart page →

6,590
esphomejeffrescVerified publisher0.2.21 of 1See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.4.078a82d810709
uv@0.10.1
0.11.6

Open the chart page →

50,047
oncall-hobbylovemew67Verified publisher0.0.51 of 2See more

oncall-hobby lovemew67 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
grafana/oncall:v1.13.11159b6b836fed
uv@0.5.6
0.11.6

Open the chart page →

7,235
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
uv@0.5.27
0.11.6

Open the chart page →

64,516
esphome-device-buildernewbenji-chartsVerified publisher0.1.11 of 1See more

esphome-device-builder newbenji-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.7.4e636269c6390
uv@0.10.1
0.11.6

Open the chart page →

4,077
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
uv@0.9.6
0.11.6

Open the chart page →

6,937
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
uv@0.4.1
0.11.6

Open the chart page →

24,438
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-114110.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
uv@0.10.6
0.11.6

Open the chart page →

6,004

Container images carrying it

24 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/airflow:2.10.2-python3.9ce90bdc3d2af
uv@0.4.1
0.11.6
1
bmeares/meerschaum:2.8.48e9c5bacaa82
uv@0.5.27
0.11.6
1
esphome/esphome:2026.10.03a32372dfbd6
uv@0.10.1
0.11.6
1
esphome/esphome:2026.9.14ad55931c018
uv@0.10.1
0.11.6
1
grafana/oncall:v1.13.11159b6b836fed
uv@0.5.6
0.11.6
1
grafana/oncall:v1.16.5499851658393
uv@0.8.13
0.11.6
1
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
uv@0.8.9
0.11.6
1
langgenius/dify-agent-local-sandbox:1.17.0316279a82ead
uv@0.8.9
0.11.6
1
langgenius/dify-api:1.17.052be6088dd84
uv@0.8.9
0.11.6
1
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
uv@0.9.17
0.11.6
1
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
uv@0.7.20
0.11.6
1
sysnet4admin/colosseum-rwd:log74ded2d92f07
uv@0.6.14
0.11.6
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
uv@0.6.3
0.11.6
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
uv@0.4.29
0.11.6
1
ghcr.io/esphome/esphome:latest776a845d5089
uv@0.10.1
0.11.6
1
ghcr.io/esphome/esphome:2026.4.078a82d810709
uv@0.10.1
0.11.6
1
ghcr.io/esphome/esphome:2026.7.4e636269c6390
uv@0.10.1
0.11.6
1
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
uv@0.9.28
0.11.6
1
ghcr.io/getsentry/snuba:26.7.210f8d164109b
uv@0.9.28
0.11.6
1
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
uv@0.10.6
0.11.6
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
uv@0.6.1
0.11.6
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
uv@0.9.6
0.11.6
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
uv@0.10.6
0.11.6
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
uv@0.9.26
0.11.6
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.