StackRadar

CVE-2026-96641

Medium

Advisory

Published 21 Oct 2026In the index since 23 Oct 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
19th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
295
of 18,232 indexed, latest versions
Container images
279
deployed by those charts
Fix available
1 of 2
affected packages

Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

Carried by container images the latest versions of 295 of 18,232 indexed charts deploy, on 279 images.

Affected packageAffected versionsFixed inImages
pillowpypi2.6.1, 4.0.0, 4.3.0, 5.0.0+36 more13.0.0279
pillowdeb5.1.0-1, 5.1.0-1ubuntu0.6, 5.1.0-1ubuntu0.7, 7.0.0-4ubuntu0.5+7 moreno fix listed15
OSV records
DEBIAN-CVE-2026-96641GHSA-4rm8-3hmm-39fgUBUNTU-CVE-2026-96641
Trending
Rank 15 in indexed charts, since 24 Oct 2026. See the ranking →

Charts affected

295 by stars
ChartLatestAffected imagesRadar Score
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
pillow@12.3.0
13.0.0

Open the chart page →

8,783
psonoankra-chartsVerified publisher1.2.01 of 2See more

psono ankra-charts 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
psono/psono-server:5.0.03b974b43ea03
pillow@10.3.0
13.0.0

Open the chart page →

3,034
music-assistantbdclark-helm-chartsVerified publisher0.4.151 of 1See more

music-assistant bdclark-helm-charts 0.4.15

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
pillow@12.3.0
13.0.0

Open the chart page →

5,760
squestchristianhuthVerified publisher7.0.41 of 4See more

squest christianhuth 7.0.4

1 of the 4 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
pillow@10.3.0
13.0.0

Open the chart page →

5,373
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
pillow@10.2.0
13.0.0

Open the chart page →

14,069
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
pillow@10.4.0
13.0.0

Open the chart page →

17,068
rommcrystalnetVerified publisher0.2.201 of 3See more

romm crystalnet 0.2.20

1 of the 3 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
zurdi15/romm:2.3.12db88fe44c89
pillow@10.1.0
13.0.0

Open the chart page →

2,467
aibrixdanchevVerified publisher0.8.01 of 5See more

aibrix danchev 0.8.0

1 of the 5 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.8.058b915e3708d
pillow@12.3.0
13.0.0

Open the chart page →

7,030
data-fairdata354-helmVerified publisher1.1.21 of 12See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
apsl/thumbor:6.7.051e2de5c2c70
pillow@5.4.1
13.0.0

Open the chart page →

44,006
mealiedeimosfr-charts1.0.171 of 1See more

mealie deimosfr-charts 1.0.17

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.29.078eb28b8776d
pillow@12.3.0
13.0.0

Open the chart page →

4,362
weblatedeliveryheroVerified publisher0.3.21 of 3See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
pillow@7.2.0
13.0.0

Open the chart page →

11,294
archerydoubanVerified publisher0.4.31 of 6See more

archery douban 0.4.3

1 of the 6 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
hhyo/archery:v1.9.11aa41843419e
pillow@9.0.1
13.0.0

Open the chart page →

8,618
seafiledr300481Verified publisher0.12.11 of 1See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:11.0.12d0c66e4621bd
pillow@10.2.0
13.0.0

Open the chart page →

76,611
craftycontrollerdrewburr-labs-helm-chartsVerified publisher0.3.01 of 1See more

craftycontroller drewburr-labs-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
pillow@12.2.0
13.0.0

Open the chart page →

42,115
eoapieoapiOfficialVerified publisher0.17.31 of 7See more

eoapi eoapi 0.17.3

1 of the 7 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/stac-utils/pgstac-pypgstac:v0.9.12672faad776b5
pillow@11.3.0
13.0.0

Open the chart page →

5,915
copypartyernail-copyparty2.0.01 of 1See more

copyparty ernail-copyparty 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
copyparty/ac:1.19.200a0a8605062c
pillow@11.2.1
13.0.0

Open the chart page →

2,516
taigafermosit0.0.111 of 7See more

taiga fermosit 0.0.11

1 of the 7 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
pillow@12.0.0
13.0.0

Open the chart page →

10,735
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest33afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,855
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latest6acb4a5903eb
pillow@11.1.0
13.0.0

Open the chart page →

2,913
deepstackgeek-cookbookVerified publisher1.5.21 of 2See more

deepstack geek-cookbook 1.5.2

1 of the 2 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
robmarkcole/deepstack-ui:latest410275726459
pillow@8.3.2
13.0.0

Open the chart page →

7,473
esphomegeek-cookbookVerified publisher8.4.21 of 1See more

esphome geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
esphome/esphome:1.18.03f51ec10e823
pillow@5.4.1
13.0.0

Open the chart page →

4,778
lazylibrariangeek-cookbookVerified publisher7.4.21 of 1See more

lazylibrarian geek-cookbook 7.4.2

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
linuxserver/lazylibrarian:version-1152df82f93d2560e233
pillow@8.2.0
13.0.0

Open the chart page →

12,749
paperlessgeek-cookbookVerified publisher9.2.01 of 1See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
pillow@9.2.0
13.0.0

Open the chart page →

5,317
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
pillow@9.0.0
13.0.0

Open the chart page →

9,201
bazarrhalkeye0.2.01 of 1See more

bazarr halkeye 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
linuxserver/bazarr:latestfb0437897eaa
pillow@12.3.0
13.0.0

Open the chart page →

688
hasher-matcher-actionerhasher-matcher-actioner1.0.01 of 1See more

hasher-matcher-actioner hasher-matcher-actioner 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/facebook/threatexchange/hma:1.0.1784d09c6b75a7
pillow@11.2.1
13.0.0

Open the chart page →

1,612
helmuphelmupVerified publisher0.1.02 of 3See more

helmup helmup 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
pillow@10.4.0
13.0.0
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
pillow@10.3.0
13.0.0

Open the chart page →

20,188
immichimmich-helmVerified publisher0.5.11 of 4See more

immich immich-helm 0.5.1

1 of the 4 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v3.3.41ab8674e7cec
pillow@12.3.0
13.0.0

Open the chart page →

10,531
supersetinseefrlab1.4.01 of 4See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
pillow@9.1.0
13.0.0

Open the chart page →

9,838
iris-webappiris-webapp0.2.41 of 2See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
pillow@11.3.0
13.0.0

Open the chart page →

14,478
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
pillow@10.3.0
13.0.0

Open the chart page →

23,769
langflow-idelangflow0.1.21 of 2See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
langflowai/langflow:latesta0396e089eb9
pillow@12.3.0
13.0.0

Open the chart page →

5,289
langflow-runtimelangflow0.1.11 of 1See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
langflowai/langflow:latesta0396e089eb9
pillow@12.3.0
13.0.0

Open the chart page →

861
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
pillow@11.0.0
13.0.0

Open the chart page →

5,378
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
pillow@11.3.0
13.0.0

Open the chart page →

9,005
home-assistantloeken-at-homeVerified publisher2026.9.21 of 1See more

home-assistant loeken-at-home 2026.9.2

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
loeken/home-assistant:2026.9.2b1dff5b4c593
pillow@12.3.0
13.0.0

Open the chart page →

3,201
mlflow-controllermlflow-deployment-controller0.1.81 of 2See more

mlflow-controller mlflow-deployment-controller 0.1.8

1 of the 2 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
pillow@9.4.0
13.0.0

Open the chart page →

10,680
mlflow-servermlflowserver0.1.91 of 3See more

mlflow-server mlflowserver 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
buntha/mlflow:2.1.1154542cc3083
pillow@9.3.0
13.0.0

Open the chart page →

7,839
helm-taigamvitale1989-helm-taigaVerified publisher0.2.51 of 2See more

helm-taiga mvitale1989-helm-taiga 0.2.5

1 of the 2 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
mvitale1989/docker-taiga:20191031-4.2.141504ccda06df
pillow@4.3.0
13.0.0

Open the chart page →

6,677
odoonicholaswildeVerified publisher1.0.01 of 1See more

odoo nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/odoo:version-14.07cff9672ce07
pillow@5.4.1
13.0.0

Open the chart page →

7,852
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.61 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.6

1 of the 34 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-chatbot604b1f493c92
pillow@12.3.0
13.0.0

Open the chart page →

29,432
openvaultopenvaultVerified publisher0.9.01 of 2See more

openvault openvault 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
pillow@11.2.1
13.0.0

Open the chart page →

62,631
home-assistantpree-helm-chartsVerified publisher1.86.01 of 1See more

home-assistant pree-helm-charts 1.86.0

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.3407b89cd11a8
pillow@12.3.0
13.0.0

Open the chart page →

1,797
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
pillow@12.2.0
13.0.0

Open the chart page →

51,238
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
pillow@11.3.0
13.0.0

Open the chart page →

5,396
delugerubxkubeVerified publisher1.2.11 of 1See more

deluge rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
linuxserver/deluge:18.04.10ac871624394
pillow@5.1.0
pillow@5.1.0-1ubuntu0.6
13.0.0
no fix listed

Open the chart page →

14,847
sceptresceptreai0.1.122 of 5See more

sceptre sceptreai 0.1.12

2 of the 5 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
maponyacharles/sceptreai:mlflow-0.1.1242d418654ebd
pillow@12.3.0
13.0.0
maponyacharles/sceptreai:api-0.1.127b37b092130a
pillow@12.3.0
13.0.0

Open the chart page →

7,183
securosecuroVerified publisher0.16.51 of 4See more

securo securo 0.16.5

1 of the 4 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/securo-finance/securo-backend:0.16.50e40c6858fb3
pillow@12.3.0
13.0.0

Open the chart page →

4,488
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
pillow@12.2.0
13.0.0

Open the chart page →

55,145
slo-reportingslo-reportingVerified publisher0.3.341 of 2See more

slo-reporting slo-reporting 0.3.34

1 of the 2 container images this version deploys carry CVE-2026-96641.

Container imageDigestPackageFixed in
ghcr.io/colenio/slo-reporting:0.3.316b64d194a27d
pillow@11.0.0
13.0.0

Open the chart page →

3,902

Container images carrying it

279 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
opea/tts:1.0257ae94709e9
pillow@10.2.0
13.0.0
1
opea/web-retriever-chroma:1.0fe08165d7770
pillow@10.4.0
13.0.0
1
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
pillow@11.2.1
13.0.0
1
opencsghq/csgbot:v0.6.9-ee7d0271e26521
pillow@12.1.0
13.0.0
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
pillow@11.3.0
13.0.0
1
opendatacube/ows:latest668cbb41473c
pillow@10.2.0
pillow@10.2.0-1ubuntu1
13.0.0
no fix listed
1
opendatacube/wms:latest1b90cdf68831
pillow@5.1.0
pillow@5.1.0-1
13.0.0
no fix listed
1
opendatacube/wps:latest80df355a660b
pillow@9.0.1
pillow@9.0.1-1ubuntu0.3
13.0.0
no fix listed
1
opendronemap/nodeodm:3.6.2fcd99eb23d8d
pillow@11.3.0
13.0.0
1
openmined/syft-backend:0.9.5b72f74a68b32
pillow@11.1.0
13.0.0
1
opennode/waldur-mastermind:8.1.382e8f276c5ed
pillow@12.3.0
13.0.0
1
pangeo/base-notebook:2024.01.155fbe688a4f80
pillow@10.2.0
13.0.0
1
pretix/standalone:2026.8.0ec17c2f761f7
pillow@12.3.0
13.0.0
1
prowlercloud/prowler-api:5.31.14f252d579be2
pillow@12.2.0
13.0.0
1
pschiffe/pdns-admin:0.4.137ebba8c2b8f
pillow@11.3.0
13.0.0
1
psono/psono-server:5.0.03b974b43ea03
pillow@10.3.0
13.0.0
1
rdavidoff/twitch-channel-points-miner-v2:1.8.67ae4c5135771
pillow@10.0.0
13.0.0
1
reallibrephotos/librephotos:1.4.011418bf5d617
pillow@12.3.0
13.0.0
1
redimp/otterwiki:2b7ece5b8d7cc
pillow@12.3.0
13.0.0
1
robmarkcole/deepstack-ui:latest410275726459
pillow@8.3.2
13.0.0
1
robustadev/krr:v1.30.0b8d782e568c7
pillow@12.3.0
13.0.0
1
rommapp/romm:5.2.03512f2ca4557
pillow@12.3.0
13.0.0
1
rommapp/romm:4.4.1b909e95d1aab
pillow@10.4.0
13.0.0
1
saidsef/scapy-containerised:v2025.02f17f7c435891
pillow@11.1.0
13.0.0
1
schmitzis/monorepo:seafile-13.0-latestc583f1be2af2
pillow@11.3.0
13.0.0
1
scrapinghub/splash:3.4.1a5f89bc84606
pillow@5.4.1
13.0.0
1
seafileltd/seafile-mc:9.0.106693911bcc40
pillow@9.3.0
13.0.0
1
seafileltd/seafile-mc:10.0.170628f29c663
pillow@9.3.0
13.0.0
1
seafileltd/seafile-mc:9.0.97ac833196f60
pillow@9.2.0
13.0.0
1
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
pillow@8.3.1
13.0.0
1
signalen/backend:2.50.1826bb090bc4e4
pillow@12.3.0
13.0.0
1
sirrend/helmup-engine:0.1.13699e79e3d4e2
pillow@10.4.0
13.0.0
1
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
pillow@10.3.0
13.0.0
1
sruthitanneru/pi-sample:ui-lateste565ea454ffd
pillow@11.0.0
13.0.0
1
szurubooru/server:2.5accf2ad9fbc3
pillow@11.2.1
13.0.0
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
pillow@9.4.0
13.0.0
1
taigaio/taiga-back:latest4beed8f62c9f
pillow@12.0.0
13.0.0
1
taigaio/taiga-back:6.4.29f97323cc150
pillow@8.2.0
13.0.0
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
pillow@11.1.0
13.0.0
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
pillow@5.0.0
13.0.0
1
timothyclarke/wptserver:2018-03-0840a80ced8031
pillow@2.6.1
13.0.0
1
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
pillow@12.3.0
13.0.0
1
upstreamyard/nemo-guardrails:0.24.19f673183cfc0
pillow@12.3.0
13.0.0
1
vabene1111/recipes:2.3.50f8d061895e9
pillow@11.3.0
13.0.0
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
pillow@9.0.0
13.0.0
1
weblate/weblate:2026.10.1.26663a7c8b444
pillow@12.3.0
13.0.0
1
weblate/weblate:3.11.3-182848df56ecd
pillow@5.4.1
13.0.0
1
wger/server:2.71c5789b93bfe
pillow@12.3.0
13.0.0
1
yuzutech/kroki-blockdiag:0.16.07c1917c66d96
pillow@8.4.0
13.0.0
1
zurdi15/romm:2.3.12db88fe44c89
pillow@10.1.0
13.0.0
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.