StackRadar

CVE-2026-114112

High

Advisory

Published 8 Sept 2026In the index since 22 Oct 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
0.002
8th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
127
of 18,219 indexed, latest versions
Container images
126
deployed by those charts
Fix available
1 of 1
affected package

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

Carried by container images the latest versions of 127 of 18,219 indexed charts deploy, on 126 images.

Affected packageAffected versionsFixed inImages
sharpnpm0.23.4, 0.27.2, 0.28.1, 0.29.0+17 more0.35.4126
OSV records
GHSA-rgj7-g3m4-5g8c

Charts affected

127 by stars
ChartLatestAffected imagesRadar Score
podscopepodscope0.2.31 of 1See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
sharp@0.34.5
0.35.4

Open the chart page →

1,609
radar-self-enrolment-uiradar-baseVerified publisher0.4.21 of 1See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
sharp@0.34.4
0.35.4

Open the chart page →

1,627
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
sharp@0.33.3
0.35.4

Open the chart page →

6,444
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
sharp@0.33.3
0.35.4

Open the chart page →

8,175
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
sharp@0.34.5
0.35.4

Open the chart page →

9,153
unifi-protectschichtelVerified publisher0.10.11 of 1See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
sharp@0.30.7
0.35.4

Open the chart page →

7,256
joplin-serverschoenwald1.0.31 of 1See more

joplin-server schoenwald 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
joplin/server:3.7.23f7b852959aa
sharp@0.34.5
0.35.4

Open the chart page →

2,983
seerr-chartseerr-chartVerified publisher3.10.11 of 1See more

seerr-chart seerr-chart 3.10.1

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.5.1d8fab675b55a
sharp@0.34.5
0.35.4

Open the chart page →

2,177
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e12 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
sharp@0.32.6
0.35.4
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
sharp@0.32.6
0.35.4

Open the chart page →

17,745
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb2 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
sharp@0.32.6
0.35.4
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
sharp@0.32.6
0.35.4

Open the chart page →

17,830
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f82 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
sharp@0.32.6
0.35.4
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
sharp@0.32.6
0.35.4

Open the chart page →

15,935
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091142 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
sharp@0.32.6
0.35.4
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
sharp@0.32.6
0.35.4

Open the chart page →

17,830
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4692 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d4694bd113093583
sharp@0.32.6
0.35.4
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
sharp@0.32.6
0.35.4

Open the chart page →

15,538
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3412 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.12-branch.testing3.88744-f55b3414bd113093583
sharp@0.32.6
0.35.4
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
sharp@0.32.6
0.35.4

Open the chart page →

15,538
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b22 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
sharp@0.32.6
0.35.4
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
sharp@0.32.6
0.35.4

Open the chart page →

17,398
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef3 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

3 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
sharp@0.32.6
0.35.4
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
sharp@0.32.6
0.35.4
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
sharp@0.32.6
0.35.4

Open the chart page →

17,065
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
sharp@0.34.3
0.35.4

Open the chart page →

12,159
strapistrapi-xmv0.1.21 of 1See more

strapi strapi-xmv 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latest5ffcc95d11e8
sharp@0.33.5
0.35.4

Open the chart page →

754
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
sharp@0.34.5
0.35.4

Open the chart page →

6,283
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
sharp@0.33.5
0.35.4
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
sharp@0.33.5
0.35.4
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
sharp@0.33.5
0.35.4

Open the chart page →

9,588
homepageunknowniq1.8.81 of 2See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.2.0753eeb0cc22a
sharp@0.35.3
0.35.4

Open the chart page →

751
kenerunxwaresVerified publisher2026.10.11 of 2See more

kener unxwares 2026.10.1

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
rajnandan1/kener:4.1.7-alpined920a2b71c20
sharp@0.34.5
0.35.4

Open the chart page →

1,971
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
sharp@0.34.5
0.35.4

Open the chart page →

5,137
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
sharp@0.34.5
0.35.4

Open the chart page →

3,033
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
sharp@0.33.5
0.35.4

Open the chart page →

8,030
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
sharp@0.32.0
0.35.4

Open the chart page →

4,295
welcome-clientwelcome-client26.0.01 of 1See more

welcome-client welcome-client 26.0.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
lucassandin/welcome-client:latest48468b1ccd16
sharp@0.33.3
0.35.4

Open the chart page →

1,664

Container images carrying it

126 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
lucassandin/welcome-client:latest48468b1ccd16
sharp@0.33.3
0.35.4
1
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
sharp@0.30.7
0.35.4
1
misskey/misskey:12.110.1e08b7c478093
sharp@0.30.3
0.35.4
1
moreillon/food-manager:lateste8fd856e593d
sharp@0.29.3
0.35.4
1
n8nio/n8n:1.115.1ed16e560c40e
sharp@0.33.5
0.35.4
1
nocodb/nocodb:0.258.06779a4ddedf2
sharp@0.33.5
0.35.4
1
nocodb/nocodb:0.301.5d9516f0bf546
sharp@0.33.4
0.35.4
1
prowlercloud/prowler-ui:5.31.179ee83c8e702
sharp@0.33.5
0.35.4
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
sharp@0.33.5
0.35.4
1
rajnandan1/kener:4.1.7-alpined920a2b71c20
sharp@0.34.5
0.35.4
1
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
sharp@0.33.5
0.35.4
1
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
sharp@0.32.6
0.35.4
1
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
sharp@0.32.6
0.35.4
1
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
sharp@0.32.6
0.35.4
1
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
sharp@0.32.6
0.35.4
1
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
sharp@0.32.6
0.35.4
1
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
sharp@0.32.6
0.35.4
1
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
sharp@0.32.6
0.35.4
1
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
sharp@0.32.6
0.35.4
1
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
sharp@0.32.6
0.35.4
1
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
sharp@0.32.6
0.35.4
1
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
sharp@0.32.6
0.35.4
1
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
sharp@0.34.3
0.35.4
1
speckle/speckle-server:2.26.379f14a2bf931
sharp@0.34.4
0.35.4
1
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
sharp@0.32.6
0.35.4
1
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
sharp@0.32.6
0.35.4
1
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
sharp@0.32.6
0.35.4
1
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
sharp@0.32.6
0.35.4
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
sharp@0.34.5
0.35.4
1
veecode/devportal-admin-ui:0.4.30c69fd286b489
sharp@0.33.4
0.35.4
1
visualregressiontracker/api:5.0.11941aeb8c8bf9
sharp@0.32.6
0.35.4
1
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
sharp@0.34.2
0.35.4
1
ghcr.io/akash-network/deploy-web:2.46.0ac540172c120
sharp@0.30.7
0.35.4
1
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
sharp@0.33.5
0.35.4
1
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
sharp@0.34.5
0.35.4
1
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
sharp@0.33.5
0.35.4
1
ghcr.io/colanode/server:latest7006cac874fd
sharp@0.34.5
0.35.4
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
sharp@0.33.5
0.35.4
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
sharp@0.32.6
0.35.4
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
sharp@0.32.6
0.35.4
1
ghcr.io/data-fair/portals:18b621866ceb2
sharp@0.31.3
0.35.4
1
ghcr.io/devops-dojo7/fauxgpu/web:0.2.4691dd15d6bca
sharp@0.35.3
0.35.4
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
sharp@0.33.4
0.35.4
1
ghcr.io/fluxerapp/fluxer-api:2026.820.164808f683541d5374
sharp@0.34.5
0.35.4
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
sharp@0.35.3
0.35.4
1
ghcr.io/gethomepage/homepage:v1.13.2a0b71c8e7572
sharp@0.34.5
0.35.4
1
ghcr.io/gethomepage/homepage:v1.11.0b129cb0f674b
sharp@0.34.5
0.35.4
1
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
sharp@0.34.5
0.35.4
1
ghcr.io/harish2k01/portfolio-tracker:0.7.043be1d6b454e
sharp@0.34.5
0.35.4
1
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
sharp@0.35.3
0.35.4
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.