StackRadar

CVE-2026-114111

High

Advisory

Published 6 Oct 2026In the index since 22 Oct 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
0.001
2nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
148
of 18,219 indexed, latest versions
Container images
147
deployed by those charts
Fix available
1 of 1
affected package

sharp : Vulnerability in librsvg dependency CVE-2026-96889

Carried by container images the latest versions of 148 of 18,219 indexed charts deploy, on 147 images.

Affected packageAffected versionsFixed inImages
sharpnpm0.23.4, 0.27.2, 0.28.1, 0.29.0+18 more0.35.5147
OSV records
GHSA-wq5f-xc86-pv6w

Charts affected

148 by stars
ChartLatestAffected imagesRadar Score
rocketchatrocketchat-server7.1.01 of 12See more

rocketchat rocketchat-server 7.1.0

1 of the 12 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
sharp@0.33.5
0.35.5

Open the chart page →

17,042
penpotpenpotOfficialVerified publisher1.11.31 of 5See more

penpot penpot 1.11.3

1 of the 5 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
penpotapp/mcp:2.18.35e811e6eeb17
sharp@0.35.4
0.35.5

Open the chart page →

6,137
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
sharp@0.34.4
0.35.5

Open the chart page →

83,728
difydify-helmVerified publisher0.39.01 of 11See more

dify dify-helm 0.39.0

1 of the 11 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
langgenius/dify-web:1.17.06a81fcdd82b5
sharp@0.35.3
0.35.5

Open the chart page →

63,621
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
sharp@0.33.5
0.35.5

Open the chart page →

8,230
homarrhomarr-labsOfficialVerified publisher8.36.01 of 1See more

homarr homarr-labs 8.36.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v2.6.01e077fc77d3a
sharp@0.35.4
0.35.5

Open the chart page →

86
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
sharp@0.34.5
0.35.5

Open the chart page →

6,739
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latest27602401178d
sharp@0.34.5
0.35.5

Open the chart page →

3,607
umamichristianhuthVerified publisher8.0.01 of 1See more

umami christianhuth 8.0.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
sharp@0.35.4
0.35.5

Open the chart page →

305
umamiwaldo-visionVerified publisher0.0.11 of 1See more

umami waldo-vision 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
sharp@0.30.7
0.35.5

Open the chart page →

1,327
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
sharp@0.30.3
0.35.5

Open the chart page →

5,685
umamihelmforgeVerified publisher2.4.21 of 3See more

umami helmforge 2.4.2

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
sharp@0.35.4
0.35.5

Open the chart page →

2,047
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
sharp@0.32.6
0.35.5

Open the chart page →

3,471
cosmocosmo-platformOfficialVerified publisher0.22.11 of 10See more

cosmo cosmo-platform 0.22.1

1 of the 10 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
sharp@0.33.5
0.35.5

Open the chart page →

93,108
duplistatusduplistatusVerified publisher1.3.01 of 2See more

duplistatus duplistatus 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.5.0bede86cf183f
sharp@0.35.4
0.35.5

Open the chart page →

1,164
flyte-binaryflyte2.0.521 of 4See more

flyte-binary flyte 2.0.52

1 of the 4 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latest7e19bbdd2e7d
sharp@0.35.3
0.35.5

Open the chart page →

44,482
flyte-coreflyte2.0.521 of 3See more

flyte-core flyte 2.0.52

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latest7e19bbdd2e7d
sharp@0.35.3
0.35.5

Open the chart page →

929
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
sharp@0.29.0
0.35.5

Open the chart page →

100,710
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
sharp@0.33.4
0.35.5

Open the chart page →

5,642
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.5

Open the chart page →

192,164
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.5

Open the chart page →

192,144
seerrbdclark-helm-chartsVerified publisher0.1.61 of 1See more

seerr bdclark-helm-charts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.5.027602401178d
sharp@0.34.5
0.35.5

Open the chart page →

2,335
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
sharp@0.35.4
0.35.5

Open the chart page →

2,330
data-fairdata354-helmVerified publisher1.1.22 of 12See more

data-fair data354-helm 1.1.2

2 of the 12 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
sharp@0.32.6
0.35.5
ghcr.io/data-fair/portals:18b621866ceb2
sharp@0.31.3
0.35.5

Open the chart page →

43,739
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
sharp@0.34.5
0.35.5

Open the chart page →

9,931
joplin-serverdjjudas21Verified publisher6.0.01 of 1See more

joplin-server djjudas21 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
joplin/server:3.7.23f7b852959aa
sharp@0.34.5
0.35.5

Open the chart page →

2,983
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
sharp@0.29.3
0.35.5

Open the chart page →

4,997
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
sharp@0.34.5
0.35.5

Open the chart page →

3,462
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
langgenius/dify-web:0.6.11a2a294743634
sharp@0.33.2
0.35.5

Open the chart page →

22,866
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
sharp@0.34.5
0.35.5

Open the chart page →

1,623
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
sharp@0.34.5
0.35.5

Open the chart page →

841
chibisafel4gVerified publisher0.1.12 of 3See more

chibisafe l4g 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
chibisafe/chibisafe:latest534ba9902a37
sharp@0.33.3
0.35.5
chibisafe/chibisafe-server:latesta3a8606cd9b5
sharp@0.33.2
0.35.5

Open the chart page →

4,023
lakilakiOfficialVerified publisher1.11.01 of 2See more

laki laki 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
sharp@0.35.3
0.35.5

Open the chart page →

778
plane-enterprisemakeplaneOfficialVerified publisher3.10.123 of 13See more

plane-enterprise makeplane 3.10.12

3 of the 13 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
makeplane/live-commercial:v3.3.3fab034a2be8c
sharp@0.35.4
0.35.5
makeplane/silo-commercial:v3.3.312c33418c1ec
sharp@0.35.4
0.35.5
makeplane/space-commercial:v3.3.3c4a6236c4080
sharp@0.35.4
0.35.5

Open the chart page →

7,311
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
sharp@0.29.3
0.35.5

Open the chart page →

69,868
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.61 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.6

1 of the 34 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
sharp@0.35.4
0.35.5

Open the chart page →

27,946
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
sharp@0.34.5
0.35.5

Open the chart page →

8,566
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
sharp@0.33.5
0.35.5

Open the chart page →

50,051
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
sharp@0.33.4
0.35.5

Open the chart page →

3,337
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
sharp@0.34.3
0.35.5

Open the chart page →

6,346
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
sharp@0.33.5
0.35.5

Open the chart page →

13,731
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
speckle/speckle-server:2.26.379f14a2bf931
sharp@0.34.4
0.35.5

Open the chart page →

11,427
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
sharp@0.34.5
0.35.5

Open the chart page →

55,054
u-storeunifieVerified publisher1.2.01 of 1See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
sharp@0.33.5
0.35.5

Open the chart page →

86,409
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
sharp@0.33.4
0.35.5

Open the chart page →

6,272
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
sharp@0.34.5
0.35.5

Open the chart page →

1,649
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
sharp@0.34.5
0.35.5

Open the chart page →

4,985
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
sharp@0.33.5
0.35.5

Open the chart page →

6,567
cliproxyapi-dashboardalekcVerified publisher0.1.21 of 1See more

cliproxyapi-dashboard alekc 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/itsmylife44/cliproxyapi-dashboard/dashboard:0.1.9088f02aa3034e
sharp@0.34.5
0.35.5

Open the chart page →

550
jellyseerralexmorbo-jellyseerrVerified publisher1.0.31 of 1See more

jellyseerr alexmorbo-jellyseerr 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:2.2.3a324fa4d81cc
sharp@0.33.4
0.35.5

Open the chart page →

3,692

Container images carrying it

147 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.5
3
joplin/server:3.7.2:latest3f7b852959aa
sharp@0.34.5
0.35.5
3
rcdelacruz/my-strapi-app:js-amd6438007f358355
sharp@0.32.0
0.35.5
3
ghcr.io/microboxlabs/miot-app:0.5.203cc10a496ced
sharp@0.34.5
0.35.5
3
ghcr.io/seerr-team/seerr:latest:v3.5.027602401178d
sharp@0.34.5
0.35.5
3
ghcr.io/umami-software/umami:3.4.085909afc45bd
sharp@0.35.4
0.35.5
3
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d469:2.18.12-branch.testing3.88744-f55b3414bd113093583
sharp@0.32.6
0.35.5
2
sysnet4admin/dashboard:bluec5bd3bb1b5a6
sharp@0.33.4
0.35.5
2
ghcr.io/homarr-labs/homarr:v2.6.01e077fc77d3a
sharp@0.35.4
0.35.5
2
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
sharp@0.34.5
0.35.5
2
ghcr.io/nucleuscloud/neosync/app:0.5.41ca31ec35b829
sharp@0.34.1
0.35.5
2
ghcr.io/unionai-oss/flyteconsole-v2:latest7e19bbdd2e7d
sharp@0.35.3
0.35.5
2
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
sharp@0.33.5
0.35.5
1
alquimiaai/studio:certification38a1f0341982
sharp@0.34.4
0.35.5
1
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
sharp@0.34.3
0.35.5
1
assistiot/dlt_api:2.1.0c8a170683be7
sharp@0.27.2
0.35.5
1
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
sharp@0.30.7
0.35.5
1
bpatrik/pigallery2:1.9.0-debian-buster21fbaa5fae61
sharp@0.23.4
0.35.5
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
sharp@0.29.0
0.35.5
1
chibisafe/chibisafe:latest534ba9902a37
sharp@0.33.3
0.35.5
1
chibisafe/chibisafe-server:latesta3a8606cd9b5
sharp@0.33.2
0.35.5
1
chocobozzz/peertube:v8.1.5052712130691
sharp@0.34.5
0.35.5
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
sharp@0.33.5
0.35.5
1
directus/directus:12.0.29c8470ea465c
sharp@0.34.5
0.35.5
1
directus/directus:11.1.0e3c8bb975350
sharp@0.33.5
0.35.5
1
documenso/documenso:v1.8.17f16a9449f18
sharp@0.32.6
0.35.5
1
drumsergio/pumperly:1.17.0f7efe5fc03f3
sharp@0.35.4
0.35.5
1
dserio83/velero-ui:0.3.1b4e1ec6664d3
sharp@0.33.5
0.35.5
1
evoapicloud/evolution-api:latest966625532d90
sharp@0.34.5
0.35.5
1
fallenbagel/jellyseerr:latest91edd5620e51
sharp@0.33.4
0.35.5
1
fallenbagel/jellyseerr:2.2.3a324fa4d81cc
sharp@0.33.4
0.35.5
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
sharp@0.32.6
0.35.5
1
flanksource/incident-manager-ui:v1.4.3542bb089c79fc0
sharp@0.34.5
0.35.5
1
flanksource/incident-manager-ui:v1.4.3228d17f0c08b20
sharp@0.34.5
0.35.5
1
fosrl/pangolin:latest17774ddbb4bf
sharp@0.35.4
0.35.5
1
fosrl/pangolin:1.13.0c32ad797ab96
sharp@0.34.4
0.35.5
1
helmforge/opencut:v0.3.0bf11156e0ab5
sharp@0.34.5
0.35.5
1
helmforge/strapi-base:5.52.25a6c2c449840
sharp@0.35.3
0.35.5
1
ianw/quickchart:v1.7.1dc49dd460c37
sharp@0.30.7
0.35.5
1
jakowenko/double-take:1.6.0b858bac9e32a
sharp@0.29.2
0.35.5
1
joplin/server:3.0-beta52af57880c0e
sharp@0.33.3
0.35.5
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
sharp@0.34.5
0.35.5
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
sharp@0.34.5
0.35.5
1
langgenius/dify-web:1.17.06a81fcdd82b5
sharp@0.35.3
0.35.5
1
langgenius/dify-web:0.6.11a2a294743634
sharp@0.33.2
0.35.5
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
sharp@0.34.4
0.35.5
1
langgenius/dify-web:1.0.0d64914ff0d6d
sharp@0.33.5
0.35.5
1
lbenicio/helm-pilot:0.2.54594a2632510
sharp@0.34.5
0.35.5
1
library/ghost:6.37.01ef2e532ca4d
sharp@0.34.5
0.35.5
1
library/ghost:6.25.12654b1e90413
sharp@0.34.5
0.35.5
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.