StackRadar

CVE-2026-114111

High

Advisory

Published 6 Oct 2026In the index since 22 Oct 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
0.001
2nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
148
of 18,219 indexed, latest versions
Container images
147
deployed by those charts
Fix available
1 of 1
affected package

sharp : Vulnerability in librsvg dependency CVE-2026-96889

Carried by container images the latest versions of 148 of 18,219 indexed charts deploy, on 147 images.

Affected packageAffected versionsFixed inImages
sharpnpm0.23.4, 0.27.2, 0.28.1, 0.29.0+18 more0.35.5147
OSV records
GHSA-wq5f-xc86-pv6w

Charts affected

148 by stars
ChartLatestAffected imagesRadar Score
rocketchatrocketchat-server7.1.01 of 12See more

rocketchat rocketchat-server 7.1.0

1 of the 12 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
sharp@0.33.5
0.35.5

Open the chart page →

17,042
penpotpenpotOfficialVerified publisher1.11.31 of 5See more

penpot penpot 1.11.3

1 of the 5 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
penpotapp/mcp:2.18.35e811e6eeb17
sharp@0.35.4
0.35.5

Open the chart page →

6,137
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
sharp@0.34.4
0.35.5

Open the chart page →

83,728
difydify-helmVerified publisher0.39.01 of 11See more

dify dify-helm 0.39.0

1 of the 11 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
langgenius/dify-web:1.17.06a81fcdd82b5
sharp@0.35.3
0.35.5

Open the chart page →

63,621
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
sharp@0.33.5
0.35.5

Open the chart page →

8,230
homarrhomarr-labsOfficialVerified publisher8.36.01 of 1See more

homarr homarr-labs 8.36.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v2.6.01e077fc77d3a
sharp@0.35.4
0.35.5

Open the chart page →

86
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
sharp@0.34.5
0.35.5

Open the chart page →

6,739
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latest27602401178d
sharp@0.34.5
0.35.5

Open the chart page →

3,607
umamichristianhuthVerified publisher8.0.01 of 1See more

umami christianhuth 8.0.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
sharp@0.35.4
0.35.5

Open the chart page →

305
umamiwaldo-visionVerified publisher0.0.11 of 1See more

umami waldo-vision 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
sharp@0.30.7
0.35.5

Open the chart page →

1,327
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
sharp@0.30.3
0.35.5

Open the chart page →

5,685
umamihelmforgeVerified publisher2.4.21 of 3See more

umami helmforge 2.4.2

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
sharp@0.35.4
0.35.5

Open the chart page →

2,047
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
sharp@0.32.6
0.35.5

Open the chart page →

3,471
cosmocosmo-platformOfficialVerified publisher0.22.11 of 10See more

cosmo cosmo-platform 0.22.1

1 of the 10 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
sharp@0.33.5
0.35.5

Open the chart page →

93,108
duplistatusduplistatusVerified publisher1.3.01 of 2See more

duplistatus duplistatus 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.5.0bede86cf183f
sharp@0.35.4
0.35.5

Open the chart page →

1,164
flyte-binaryflyte2.0.521 of 4See more

flyte-binary flyte 2.0.52

1 of the 4 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latest7e19bbdd2e7d
sharp@0.35.3
0.35.5

Open the chart page →

44,482
flyte-coreflyte2.0.521 of 3See more

flyte-core flyte 2.0.52

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latest7e19bbdd2e7d
sharp@0.35.3
0.35.5

Open the chart page →

929
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
sharp@0.29.0
0.35.5

Open the chart page →

100,710
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
sharp@0.33.4
0.35.5

Open the chart page →

5,642
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.5

Open the chart page →

192,164
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.5

Open the chart page →

192,144
seerrbdclark-helm-chartsVerified publisher0.1.61 of 1See more

seerr bdclark-helm-charts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.5.027602401178d
sharp@0.34.5
0.35.5

Open the chart page →

2,335
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
sharp@0.35.4
0.35.5

Open the chart page →

2,330
data-fairdata354-helmVerified publisher1.1.22 of 12See more

data-fair data354-helm 1.1.2

2 of the 12 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
sharp@0.32.6
0.35.5
ghcr.io/data-fair/portals:18b621866ceb2
sharp@0.31.3
0.35.5

Open the chart page →

43,739
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
sharp@0.34.5
0.35.5

Open the chart page →

9,931
joplin-serverdjjudas21Verified publisher6.0.01 of 1See more

joplin-server djjudas21 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
joplin/server:3.7.23f7b852959aa
sharp@0.34.5
0.35.5

Open the chart page →

2,983
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
sharp@0.29.3
0.35.5

Open the chart page →

4,997
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
sharp@0.34.5
0.35.5

Open the chart page →

3,462
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
langgenius/dify-web:0.6.11a2a294743634
sharp@0.33.2
0.35.5

Open the chart page →

22,866
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
sharp@0.34.5
0.35.5

Open the chart page →

1,623
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
sharp@0.34.5
0.35.5

Open the chart page →

841
chibisafel4gVerified publisher0.1.12 of 3See more

chibisafe l4g 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
chibisafe/chibisafe:latest534ba9902a37
sharp@0.33.3
0.35.5
chibisafe/chibisafe-server:latesta3a8606cd9b5
sharp@0.33.2
0.35.5

Open the chart page →

4,023
lakilakiOfficialVerified publisher1.11.01 of 2See more

laki laki 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
sharp@0.35.3
0.35.5

Open the chart page →

778
plane-enterprisemakeplaneOfficialVerified publisher3.10.123 of 13See more

plane-enterprise makeplane 3.10.12

3 of the 13 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
makeplane/live-commercial:v3.3.3fab034a2be8c
sharp@0.35.4
0.35.5
makeplane/silo-commercial:v3.3.312c33418c1ec
sharp@0.35.4
0.35.5
makeplane/space-commercial:v3.3.3c4a6236c4080
sharp@0.35.4
0.35.5

Open the chart page →

7,311
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
sharp@0.29.3
0.35.5

Open the chart page →

69,868
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.61 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.6

1 of the 34 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
sharp@0.35.4
0.35.5

Open the chart page →

27,946
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
sharp@0.34.5
0.35.5

Open the chart page →

8,566
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
sharp@0.33.5
0.35.5

Open the chart page →

50,051
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
sharp@0.33.4
0.35.5

Open the chart page →

3,337
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
sharp@0.34.3
0.35.5

Open the chart page →

6,346
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
sharp@0.33.5
0.35.5

Open the chart page →

13,731
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
speckle/speckle-server:2.26.379f14a2bf931
sharp@0.34.4
0.35.5

Open the chart page →

11,427
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
sharp@0.34.5
0.35.5

Open the chart page →

55,054
u-storeunifieVerified publisher1.2.01 of 1See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
sharp@0.33.5
0.35.5

Open the chart page →

86,409
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
sharp@0.33.4
0.35.5

Open the chart page →

6,272
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
sharp@0.34.5
0.35.5

Open the chart page →

1,649
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
sharp@0.34.5
0.35.5

Open the chart page →

4,985
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
sharp@0.33.5
0.35.5

Open the chart page →

6,567
cliproxyapi-dashboardalekcVerified publisher0.1.21 of 1See more

cliproxyapi-dashboard alekc 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
ghcr.io/itsmylife44/cliproxyapi-dashboard/dashboard:0.1.9088f02aa3034e
sharp@0.34.5
0.35.5

Open the chart page →

550
jellyseerralexmorbo-jellyseerrVerified publisher1.0.31 of 1See more

jellyseerr alexmorbo-jellyseerr 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-114111.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:2.2.3a324fa4d81cc
sharp@0.33.4
0.35.5

Open the chart page →

3,692

Container images carrying it

147 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/data-fair/data-fair:3cc9498b64b5b
sharp@0.32.6
0.35.5
1
ghcr.io/data-fair/portals:18b621866ceb2
sharp@0.31.3
0.35.5
1
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
sharp@0.35.3
0.35.5
1
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
sharp@0.35.4
0.35.5
1
ghcr.io/documenso/documensod9985f66c19c
sharp@0.35.4
0.35.5
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
sharp@0.33.4
0.35.5
1
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
sharp@0.35.4
0.35.5
1
ghcr.io/fluxerapp/fluxer-api:2026.820.164808f683541d5374
sharp@0.34.5
0.35.5
1
ghcr.io/gethomepage/homepage:latest:v2.4.0643bd0be730d
sharp@0.35.4
0.35.5
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
sharp@0.35.3
0.35.5
1
ghcr.io/gethomepage/homepage:v1.13.2a0b71c8e7572
sharp@0.34.5
0.35.5
1
ghcr.io/gethomepage/homepage:v1.11.0b129cb0f674b
sharp@0.34.5
0.35.5
1
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
sharp@0.34.5
0.35.5
1
ghcr.io/harish2k01/portfolio-tracker:0.7.043be1d6b454e
sharp@0.34.5
0.35.5
1
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
sharp@0.35.3
0.35.5
1
ghcr.io/itsmylife44/cliproxyapi-dashboard/dashboard:0.1.9088f02aa3034e
sharp@0.34.5
0.35.5
1
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
sharp@0.34.5
0.35.5
1
ghcr.io/kagent-dev/kagent/ui:0.10.4a6edf70c6e8e
sharp@0.35.4
0.35.5
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
sharp@0.34.3
0.35.5
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
sharp@0.33.3
0.35.5
1
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
sharp@0.34.5
0.35.5
1
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
sharp@0.35.3
0.35.5
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
sharp@0.34.5
0.35.5
1
ghcr.io/microboxlabs/miot-docs:latest893259699070
sharp@0.35.4
0.35.5
1
ghcr.io/microboxlabs/miot-docs:latestd3431480deea
sharp@0.35.4
0.35.5
1
ghcr.io/multica-ai/multica-web:v0.6.5f38d02584705
sharp@0.35.4
0.35.5
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
sharp@0.34.5
0.35.5
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
sharp@0.34.5
0.35.5
1
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
sharp@0.35.4
0.35.5
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
sharp@0.33.4
0.35.5
1
ghcr.io/papra-hq/papra:26.7.0-rootlessbf4a66e776d0
sharp@0.35.4
0.35.5
1
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
sharp@0.34.4
0.35.5
1
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
sharp@0.34.5
0.35.5
1
ghcr.io/seerr-team/seerr:v3.5.1d8fab675b55a
sharp@0.34.5
0.35.5
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
sharp@0.33.5
0.35.5
1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
sharp@0.33.5
0.35.5
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
sharp@0.33.5
0.35.5
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
sharp@0.34.3
0.35.5
1
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
sharp@0.30.7
0.35.5
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
sharp@0.34.5
0.35.5
1
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
sharp@0.32.0
0.35.5
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
sharp@0.34.5
0.35.5
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
sharp@0.33.5
0.35.5
1
ghcr.io/xmv-solutions-gmbh/strapi:latest5ffcc95d11e8
sharp@0.33.5
0.35.5
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
sharp@0.33.5
0.35.5
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
sharp@0.28.1
0.35.5
1
quay.io/kuberay/dashboard:v1.7.149b50dcc8d53
sharp@0.34.5
0.35.5
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.