StackRadar

CVE-2026-114112

High

Advisory

Published 8 Sept 2026In the index since 22 Oct 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
0.002
8th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
127
of 18,219 indexed, latest versions
Container images
126
deployed by those charts
Fix available
1 of 1
affected package

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

Carried by container images the latest versions of 127 of 18,219 indexed charts deploy, on 126 images.

Affected packageAffected versionsFixed inImages
sharpnpm0.23.4, 0.27.2, 0.28.1, 0.29.0+17 more0.35.4126
OSV records
GHSA-rgj7-g3m4-5g8c

Charts affected

127 by stars
ChartLatestAffected imagesRadar Score
rocketchatrocketchat-server7.1.01 of 12See more

rocketchat rocketchat-server 7.1.0

1 of the 12 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
sharp@0.33.5
0.35.4

Open the chart page →

17,042
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
sharp@0.34.4
0.35.4

Open the chart page →

83,728
difydify-helmVerified publisher0.39.01 of 11See more

dify dify-helm 0.39.0

1 of the 11 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
langgenius/dify-web:1.17.06a81fcdd82b5
sharp@0.35.3
0.35.4

Open the chart page →

63,621
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
sharp@0.33.5
0.35.4

Open the chart page →

8,230
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
sharp@0.34.5
0.35.4

Open the chart page →

6,739
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latest27602401178d
sharp@0.34.5
0.35.4

Open the chart page →

3,607
umamiwaldo-visionVerified publisher0.0.11 of 1See more

umami waldo-vision 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
sharp@0.30.7
0.35.4

Open the chart page →

1,327
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
sharp@0.30.3
0.35.4

Open the chart page →

5,685
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
sharp@0.32.6
0.35.4

Open the chart page →

3,471
cosmocosmo-platformOfficialVerified publisher0.22.11 of 10See more

cosmo cosmo-platform 0.22.1

1 of the 10 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
sharp@0.33.5
0.35.4

Open the chart page →

93,108
flyte-binaryflyte2.0.521 of 4See more

flyte-binary flyte 2.0.52

1 of the 4 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latest7e19bbdd2e7d
sharp@0.35.3
0.35.4

Open the chart page →

44,482
flyte-coreflyte2.0.521 of 3See more

flyte-core flyte 2.0.52

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latest7e19bbdd2e7d
sharp@0.35.3
0.35.4

Open the chart page →

929
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
sharp@0.29.0
0.35.4

Open the chart page →

100,710
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
sharp@0.33.4
0.35.4

Open the chart page →

5,642
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.4

Open the chart page →

192,164
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.4

Open the chart page →

192,144
seerrbdclark-helm-chartsVerified publisher0.1.61 of 1See more

seerr bdclark-helm-charts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.5.027602401178d
sharp@0.34.5
0.35.4

Open the chart page →

2,335
data-fairdata354-helmVerified publisher1.1.22 of 12See more

data-fair data354-helm 1.1.2

2 of the 12 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
sharp@0.32.6
0.35.4
ghcr.io/data-fair/portals:18b621866ceb2
sharp@0.31.3
0.35.4

Open the chart page →

43,739
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
sharp@0.34.5
0.35.4

Open the chart page →

9,931
joplin-serverdjjudas21Verified publisher6.0.01 of 1See more

joplin-server djjudas21 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
joplin/server:3.7.23f7b852959aa
sharp@0.34.5
0.35.4

Open the chart page →

2,983
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
sharp@0.29.3
0.35.4

Open the chart page →

4,997
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
sharp@0.34.5
0.35.4

Open the chart page →

3,462
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
langgenius/dify-web:0.6.11a2a294743634
sharp@0.33.2
0.35.4

Open the chart page →

22,866
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
sharp@0.34.5
0.35.4

Open the chart page →

1,623
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
sharp@0.34.5
0.35.4

Open the chart page →

841
chibisafel4gVerified publisher0.1.12 of 3See more

chibisafe l4g 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
chibisafe/chibisafe:latest534ba9902a37
sharp@0.33.3
0.35.4
chibisafe/chibisafe-server:latesta3a8606cd9b5
sharp@0.33.2
0.35.4

Open the chart page →

4,023
lakilakiOfficialVerified publisher1.11.01 of 2See more

laki laki 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
sharp@0.35.3
0.35.4

Open the chart page →

778
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
sharp@0.29.3
0.35.4

Open the chart page →

69,868
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
sharp@0.34.5
0.35.4

Open the chart page →

8,566
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
sharp@0.33.5
0.35.4

Open the chart page →

50,051
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
sharp@0.33.4
0.35.4

Open the chart page →

3,337
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
sharp@0.34.3
0.35.4

Open the chart page →

6,346
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
sharp@0.33.5
0.35.4

Open the chart page →

13,731
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-server:2.26.379f14a2bf931
sharp@0.34.4
0.35.4

Open the chart page →

11,427
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
sharp@0.34.5
0.35.4

Open the chart page →

55,054
u-storeunifieVerified publisher1.2.01 of 1See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
sharp@0.33.5
0.35.4

Open the chart page →

86,409
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
sharp@0.33.4
0.35.4

Open the chart page →

6,272
wachdwachdVerified publisher0.4.371 of 1See more

wachd wachd 0.4.37

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/wachd/wachd:0.4.1805b05c56da94
sharp@0.34.5
0.35.4

Open the chart page →

1,649
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
sharp@0.34.5
0.35.4

Open the chart page →

4,985
akto-source-code-analyserakto0.1.51 of 3See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
sharp@0.33.5
0.35.4

Open the chart page →

6,567
cliproxyapi-dashboardalekcVerified publisher0.1.21 of 1See more

cliproxyapi-dashboard alekc 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/itsmylife44/cliproxyapi-dashboard/dashboard:0.1.9088f02aa3034e
sharp@0.34.5
0.35.4

Open the chart page →

550
jellyseerralexmorbo-jellyseerrVerified publisher1.0.31 of 1See more

jellyseerr alexmorbo-jellyseerr 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:2.2.3a324fa4d81cc
sharp@0.33.4
0.35.4

Open the chart page →

3,692
dltkvassist-iot-data-integrity-verification0.2.01 of 9See more

dltkv assist-iot-data-integrity-verification 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.4

Open the chart page →

192,164
dltflassist-iot-dlt-based-fl0.2.01 of 9See more

dltfl assist-iot-dlt-based-fl 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.1.0c8a170683be7
sharp@0.27.2
0.35.4

Open the chart page →

192,164
immichbear0.1.11 of 2See more

immich bear 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
sharp@0.34.5
0.35.4

Open the chart page →

8,075
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
sharp@0.30.7
0.35.4

Open the chart page →

5,422
kamaji-consoleclastixVerified publisher0.1.31 of 1See more

kamaji-console clastix 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
sharp@0.33.5
0.35.4

Open the chart page →

3,463
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
sharp@0.32.0
0.35.4

Open the chart page →

6,183
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
sharp@0.32.0
0.35.4

Open the chart page →

6,183
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
sharp@0.32.0
0.35.4

Open the chart page →

6,141

Container images carrying it

126 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/itsmylife44/cliproxyapi-dashboard/dashboard:0.1.9088f02aa3034e
sharp@0.34.5
0.35.4
1
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
sharp@0.34.5
0.35.4
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
sharp@0.34.3
0.35.4
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
sharp@0.33.3
0.35.4
1
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
sharp@0.34.5
0.35.4
1
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
sharp@0.35.3
0.35.4
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
sharp@0.34.5
0.35.4
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
sharp@0.34.5
0.35.4
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
sharp@0.34.5
0.35.4
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
sharp@0.33.4
0.35.4
1
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
sharp@0.34.4
0.35.4
1
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
sharp@0.34.5
0.35.4
1
ghcr.io/seerr-team/seerr:v3.5.1d8fab675b55a
sharp@0.34.5
0.35.4
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
sharp@0.33.5
0.35.4
1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
sharp@0.33.5
0.35.4
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
sharp@0.33.5
0.35.4
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
sharp@0.34.3
0.35.4
1
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
sharp@0.30.7
0.35.4
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
sharp@0.34.5
0.35.4
1
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
sharp@0.32.0
0.35.4
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
sharp@0.34.5
0.35.4
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
sharp@0.33.5
0.35.4
1
ghcr.io/xmv-solutions-gmbh/strapi:latest5ffcc95d11e8
sharp@0.33.5
0.35.4
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
sharp@0.33.5
0.35.4
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
sharp@0.28.1
0.35.4
1
quay.io/kuberay/dashboard:v1.7.149b50dcc8d53
sharp@0.34.5
0.35.4
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.