StackRadar

CVE-2026-114112

High

Advisory

Published 8 Sept 2026In the index since 22 Oct 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
0.002
8th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
127
of 18,219 indexed, latest versions
Container images
126
deployed by those charts
Fix available
1 of 1
affected package

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

Carried by container images the latest versions of 127 of 18,219 indexed charts deploy, on 126 images.

Affected packageAffected versionsFixed inImages
sharpnpm0.23.4, 0.27.2, 0.28.1, 0.29.0+17 more0.35.4126
OSV records
GHSA-rgj7-g3m4-5g8c

Charts affected

127 by stars
ChartLatestAffected imagesRadar Score
podscopepodscope0.2.31 of 1See more

podscope podscope 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
sharp@0.34.5
0.35.4

Open the chart page →

1,609
radar-self-enrolment-uiradar-baseVerified publisher0.4.21 of 1See more

radar-self-enrolment-ui radar-base 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
sharp@0.34.4
0.35.4

Open the chart page →

1,627
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
sharp@0.33.3
0.35.4

Open the chart page →

6,444
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
sharp@0.33.3
0.35.4

Open the chart page →

8,175
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
sharp@0.34.5
0.35.4

Open the chart page →

9,153
unifi-protectschichtelVerified publisher0.10.11 of 1See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
sharp@0.30.7
0.35.4

Open the chart page →

7,256
joplin-serverschoenwald1.0.31 of 1See more

joplin-server schoenwald 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
joplin/server:3.7.23f7b852959aa
sharp@0.34.5
0.35.4

Open the chart page →

2,983
seerr-chartseerr-chartVerified publisher3.10.11 of 1See more

seerr-chart seerr-chart 3.10.1

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.5.1d8fab675b55a
sharp@0.34.5
0.35.4

Open the chart page →

2,177
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e12 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
sharp@0.32.6
0.35.4
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
sharp@0.32.6
0.35.4

Open the chart page →

17,745
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb2 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
sharp@0.32.6
0.35.4
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
sharp@0.32.6
0.35.4

Open the chart page →

17,830
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f82 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
sharp@0.32.6
0.35.4
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
sharp@0.32.6
0.35.4

Open the chart page →

15,935
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091142 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
sharp@0.32.6
0.35.4
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
sharp@0.32.6
0.35.4

Open the chart page →

17,830
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4692 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d4694bd113093583
sharp@0.32.6
0.35.4
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
sharp@0.32.6
0.35.4

Open the chart page →

15,538
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3412 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.12-branch.testing3.88744-f55b3414bd113093583
sharp@0.32.6
0.35.4
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
sharp@0.32.6
0.35.4

Open the chart page →

15,538
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b22 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

2 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
sharp@0.32.6
0.35.4
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
sharp@0.32.6
0.35.4

Open the chart page →

17,398
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef3 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

3 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
sharp@0.32.6
0.35.4
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
sharp@0.32.6
0.35.4
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
sharp@0.32.6
0.35.4

Open the chart page →

17,065
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
sharp@0.34.3
0.35.4

Open the chart page →

12,159
strapistrapi-xmv0.1.21 of 1See more

strapi strapi-xmv 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latest5ffcc95d11e8
sharp@0.33.5
0.35.4

Open the chart page →

754
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
sharp@0.34.5
0.35.4

Open the chart page →

6,283
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
sharp@0.33.5
0.35.4
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
sharp@0.33.5
0.35.4
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
sharp@0.33.5
0.35.4

Open the chart page →

9,588
homepageunknowniq1.8.81 of 2See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.2.0753eeb0cc22a
sharp@0.35.3
0.35.4

Open the chart page →

751
kenerunxwaresVerified publisher2026.10.11 of 2See more

kener unxwares 2026.10.1

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
rajnandan1/kener:4.1.7-alpined920a2b71c20
sharp@0.34.5
0.35.4

Open the chart page →

1,971
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
sharp@0.34.5
0.35.4

Open the chart page →

5,137
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
sharp@0.34.5
0.35.4

Open the chart page →

3,033
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
sharp@0.33.5
0.35.4

Open the chart page →

8,030
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
sharp@0.32.0
0.35.4

Open the chart page →

4,295
welcome-clientwelcome-client26.0.01 of 1See more

welcome-client welcome-client 26.0.0

1 of the 1 container images this version deploys carry CVE-2026-114112.

Container imageDigestPackageFixed in
lucassandin/welcome-client:latest48468b1ccd16
sharp@0.33.3
0.35.4

Open the chart page →

1,664

Container images carrying it

126 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/itsmylife44/cliproxyapi-dashboard/dashboard:0.1.9088f02aa3034e
sharp@0.34.5
0.35.4
1
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
sharp@0.34.5
0.35.4
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
sharp@0.34.3
0.35.4
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
sharp@0.33.3
0.35.4
1
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
sharp@0.34.5
0.35.4
1
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
sharp@0.35.3
0.35.4
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
sharp@0.34.5
0.35.4
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
sharp@0.34.5
0.35.4
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
sharp@0.34.5
0.35.4
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
sharp@0.33.4
0.35.4
1
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
sharp@0.34.4
0.35.4
1
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
sharp@0.34.5
0.35.4
1
ghcr.io/seerr-team/seerr:v3.5.1d8fab675b55a
sharp@0.34.5
0.35.4
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
sharp@0.33.5
0.35.4
1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
sharp@0.33.5
0.35.4
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
sharp@0.33.5
0.35.4
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
sharp@0.34.3
0.35.4
1
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
sharp@0.30.7
0.35.4
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
sharp@0.34.5
0.35.4
1
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
sharp@0.32.0
0.35.4
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
sharp@0.34.5
0.35.4
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
sharp@0.33.5
0.35.4
1
ghcr.io/xmv-solutions-gmbh/strapi:latest5ffcc95d11e8
sharp@0.33.5
0.35.4
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
sharp@0.33.5
0.35.4
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
sharp@0.28.1
0.35.4
1
quay.io/kuberay/dashboard:v1.7.149b50dcc8d53
sharp@0.34.5
0.35.4
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.