StackRadarChart IndexLive demo

GHSA-78g4-xqwv-q3g8

High

Advisory

Published 22 Oct 2026In the index since 23 Oct 2026

Severity: High; worst across findings
CVSS: 8.1; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 158; of 18,232 indexed, latest versions
Container images: 136; deployed by those charts
Fix available: 1 of 1; affected package

Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()

Carried by container images the latest versions of 158 of 18,232 indexed charts deploy, on 136 images.

Affected package	Affected versions	Fixed in	Images
pillowpypi	11.1.0, 11.2.1, 11.3.0, 12.0.0+4 more	13.0.0	136

OSV records: GHSA-78g4-xqwv-q3g8

Charts affected

158 by stars

Chart

Latest

Affected images

Radar Score

1 of 1 See more

pgadmin4 runix 1.70.4

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :9.18	c332c5f6dfba	pillow@12.3.0	13.0.0

Open the chart page →

576

home-assistanthelm-hass

1 of 1 See more

home-assistant helm-hass 0.3.87

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.10.2	33afb0659d78	pillow@12.3.0	13.0.0

Open the chart page →

3,566

mlflowcommunity-charts

1 of 1 See more

mlflow community-charts 1.11.7

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
burakince/mlflow :3.16.0	ab4b566644b9	pillow@12.3.0	13.0.0

Open the chart page →

1,545

netboxnetbox

1 of 5 See more

netbox netbox 8.3.93

1 of the 5 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/netbox-community/netbox :v4.7.3	1d6e0b5fbd48	pillow@12.3.0	13.0.0

Open the chart page →

1,992

weblateweblate

1 of 3 See more

weblate weblate 0.5.44

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
weblate/weblate :2026.10.1.2	6663a7c8b444	pillow@12.3.0	13.0.0

Open the chart page →

7,767

difydify-helm

2 of 11 See more

dify dify-helm 0.39.0

2 of the 11 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
langgenius/dify-agent-backend :1.17.0	bdb2ed516bd3	pillow@12.3.0	13.0.0
langgenius/dify-api :1.17.0	52be6088dd84	pillow@12.3.0	13.0.0

Open the chart page →

64,010

nautobotnautobot

1 of 1 See more

nautobot nautobot 3.2.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
networktocode/nautobot :3.0-py3.13	ed484336b1ad	pillow@12.2.0	13.0.0

Open the chart page →

5,908

syftopenmined

1 of 6 See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
openmined/syft-backend :0.9.5	b72f74a68b32	pillow@11.1.0	13.0.0

Open the chart page →

22,143

paperless-ngxpaperless-ngx

1 of 3 See more

paperless-ngx paperless-ngx 0.3.25

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :3.3.3	dba0242c1df1	pillow@12.3.0	13.0.0

Open the chart page →

9,859

home-assistantalekc

1 of 1 See more

home-assistant alekc 2.12.2

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.10.2	33afb0659d78	pillow@12.3.0	13.0.0

Open the chart page →

3,566

home-assistantandrenarchy

1 of 1 See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.9.2	a1bc133af84e	pillow@12.3.0	13.0.0

Open the chart page →

4,128

baserowbaserow-chart

1 of 6 See more

baserow baserow-chart 1.1.1

1 of the 6 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
baserow/backend :2.4.1	497347d0ba74	pillow@12.3.0	13.0.0

Open the chart page →

19,619

1 of 1 See more

pgadmin cetic 0.1.12

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :latest	c332c5f6dfba	pillow@12.3.0	13.0.0

Open the chart page →

576

matrixzekker6

1 of 4 See more

matrix zekker6 3.33.0

1 of the 4 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
matrixdotorg/synapse :v1.163.0	e98ab72138d9	pillow@12.3.0	13.0.0

Open the chart page →

6,424

changedetectionalekc

1 of 1 See more

changedetection alekc 0.14.7

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.9	04eaae7915ba	pillow@12.3.0	13.0.0

Open the chart page →

2,863

simple-krr-dashboardhelm-simple-krr-dashboard

1 of 3 See more

simple-krr-dashboard helm-simple-krr-dashboard 1.6.2

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
robustadev/krr :v1.30.0	b8d782e568c7	pillow@12.3.0	13.0.0

Open the chart page →

3,526

home-assistanthome-assistant

1 of 3 See more

home-assistant home-assistant 0.5.14

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.10.2	33afb0659d78	pillow@12.3.0	13.0.0

Open the chart page →

3,799

calibre-webk8s-home-lab-repo

1 of 1 See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	pillow@12.3.0	13.0.0

Open the chart page →

7,283

home-assistantk8s-home-lab-repo

1 of 1 See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/home-operations/home-assistant :2026.3.1	067e54e2e107	pillow@12.1.1	13.0.0

Open the chart page →

6,688

mlflow-tracking-servermlflow-tracking-server

1 of 1 See more

mlflow-tracking-server mlflow-tracking-server 4.1.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/mlflow-oidc/mlflow-tracking-server :3.16.1-9.0.2-20261001	970ba1cc1e69	pillow@12.3.0	13.0.0

Open the chart page →

1,134

oesopsmx

1 of 25 See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
quay.io/opsmxpublic/ubi8-oes-datascience :isd-spin-2025.10.01-af26a30d4-202511261054	d8f66f4117fe	pillow@12.0.0	13.0.0

Open the chart page →

113,443

skypilotskypilot

1 of 3 See more

skypilot skypilot 0.14.1

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
berkeleyskypilot/skypilot :0.14.1	25577df35586	pillow@12.3.0	13.0.0

Open the chart page →

6,818

pretixtechwolf12

1 of 3 See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
pretix/standalone :2026.8.0	ec17c2f761f7	pillow@12.3.0	13.0.0

Open the chart page →

10,704

mealieth-charts

1 of 1 See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v3.7.0	bb2939094eed	pillow@12.0.0	13.0.0

Open the chart page →

5,293

wgerwger

1 of 7 See more

9,402

paperlesszekker6

1 of 1 See more

paperless zekker6 11.14.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :3.3.3	dba0242c1df1	pillow@12.3.0	13.0.0

Open the chart page →

5,853

paperless-ngxadnoctem

1 of 5 See more

paperless-ngx adnoctem 0.5.1

1 of the 5 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :3.3.2	d232cba37cc0	pillow@12.3.0	13.0.0

Open the chart page →

29,781

agentareaagentarea

1 of 17 See more

agentarea agentarea 0.0.29

1 of the 17 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
agentarea/agentarea-mcp-runner :0.1.1	066fa4a71695	pillow@12.3.0	13.0.0

Open the chart page →

12,660

paperless-ngxalexmorbo-paperless-ngx

1 of 2 See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	pillow@11.3.0	13.0.0

Open the chart page →

15,112

hermes-agentankra-charts

1 of 1 See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
nousresearch/hermes-agent :v2026.8.27	e0df6adebddf	pillow@12.3.0	13.0.0

Open the chart page →

8,258

music-assistantbdclark-helm-charts

1 of 1 See more

music-assistant bdclark-helm-charts 0.4.15

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/music-assistant/server :2.10.7	dce482dc3bf4	pillow@12.3.0	13.0.0

Open the chart page →

5,373

aibrixdanchev

1 of 5 See more

aibrix danchev 0.8.0

1 of the 5 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
aibrix/metadata-service :v0.8.0	58b915e3708d	pillow@12.3.0	13.0.0

Open the chart page →

6,831

mealiedeimosfr-charts

1 of 1 See more

mealie deimosfr-charts 1.0.17

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v3.29.0	78eb28b8776d	pillow@12.3.0	13.0.0

Open the chart page →

4,045

craftycontrollerdrewburr-labs-helm-charts

1 of 1 See more

craftycontroller drewburr-labs-helm-charts 0.3.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
registry.gitlab.com/crafty-controller/crafty-4 :latest	7b6e87514259	pillow@12.2.0	13.0.0

Open the chart page →

40,227

eoapieoapi

1 of 7 See more

eoapi eoapi 0.17.3

1 of the 7 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/stac-utils/pgstac-pypgstac :v0.9.12	672faad776b5	pillow@11.3.0	13.0.0

Open the chart page →

5,738

copypartyernail-copyparty

1 of 1 See more

copyparty ernail-copyparty 2.0.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
copyparty/ac :1.19.20	0a0a8605062c	pillow@11.2.1	13.0.0

Open the chart page →

2,492

taigafermosit

1 of 7 See more

taiga fermosit 0.0.11

1 of the 7 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
taigaio/taiga-back :latest	4beed8f62c9f	pillow@12.0.0	13.0.0

Open the chart page →

10,610

home-assistantgabe565

1 of 1 See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :latest	33afb0659d78	pillow@12.3.0	13.0.0

Open the chart page →

3,566

obicogabe565

1 of 3 See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/gabe565/obico/web :latest	6acb4a5903eb	pillow@11.1.0	13.0.0

Open the chart page →

2,793

bazarrhalkeye

1 of 1 See more

bazarr halkeye 0.2.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
linuxserver/bazarr :latest	fb0437897eaa	pillow@12.3.0	13.0.0

Open the chart page →

648

hasher-matcher-actionerhasher-matcher-actioner

1 of 1 See more

hasher-matcher-actioner hasher-matcher-actioner 1.0.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/facebook/threatexchange/hma :1.0.17	84d09c6b75a7	pillow@11.2.1	13.0.0

Open the chart page →

1,588

immichimmich-helm

1 of 4 See more

immich immich-helm 0.5.1

1 of the 4 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/immich-app/immich-machine-learning :v3.3.4	1ab8674e7cec	pillow@12.3.0	13.0.0

Open the chart page →

10,033

iris-webappiris-webapp

1 of 2 See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/dfir-iris/iriswebapp_app :v2.4.26	e59ebde55709	pillow@11.3.0	13.0.0

Open the chart page →

13,976

langflow-idelangflow

1 of 2 See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
langflowai/langflow :latest	a0396e089eb9	pillow@12.3.0	13.0.0

Open the chart page →

4,976

langflow-runtimelangflow

1 of 1 See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
langflowai/langflow :latest	a0396e089eb9	pillow@12.3.0	13.0.0

Open the chart page →

765

music-assistant-serverlmatfy

1 of 1 See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/music-assistant/server :2.7.5	3522e8a7a8f0	pillow@11.3.0	13.0.0

Open the chart page →

8,628

home-assistantloeken-at-home

1 of 1 See more

home-assistant loeken-at-home 2026.9.2

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
loeken/home-assistant :2026.9.2	b1dff5b4c593	pillow@12.3.0	13.0.0

Open the chart page →

2,936

opentelemetry-demoopentelemetry-helm

1 of 34 See more

opentelemetry-demo opentelemetry-helm 0.42.6

1 of the 34 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/open-telemetry/demo :3.1.0-chatbot	604b1f493c92	pillow@12.3.0	13.0.0

Open the chart page →

28,074

openvaultopenvault

1 of 2 See more

openvault openvault 0.9.0

1 of the 2 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/wgbh-mla/ov-wag :v1.1.0	6df27f944fe8	pillow@11.2.1	13.0.0

Open the chart page →

61,729

paperless-ngxpaperless

1 of 3 See more

paperless-ngx paperless 0.4.0

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngxdigest-pinned	aa810a36942c	pillow@12.3.0	13.0.0

Open the chart page →

11,648

Container images carrying it

136 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pillow@12.0.0	13.0.0	1
ghcr.io/home-assistant/home-assistant :2026.9.2	a1bc133af84e	pillow@12.3.0	13.0.0	1
ghcr.io/home-operations/bazarr :1.6.2	17dc1cff22e9	pillow@12.3.0	13.0.0	1
ghcr.io/home-operations/bazarr :1.5.6	80cb090162b4	pillow@12.2.0	13.0.0	1
ghcr.io/home-operations/beets :2.3.1	cc4975f1a0be	pillow@11.2.1	13.0.0	1
ghcr.io/home-operations/home-assistant :2026.3.1	067e54e2e107	pillow@12.1.1	13.0.0	1
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	pillow@12.1.1	13.0.0	1
ghcr.io/immich-app/immich-machine-learning :v3.3.4	1ab8674e7cec	pillow@12.3.0	13.0.0	1
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	pillow@12.3.0	13.0.0	1
ghcr.io/liturgical-app/calendar-api :0.0.9	688a685e2bde	pillow@11.3.0	13.0.0	1
ghcr.io/liturgical-app/liturgical-api :1.0.12	637bdcebdd8d	pillow@12.1.1	13.0.0	1
ghcr.io/mealie-recipes/mealie :v3.2.1	322369a5b748	pillow@11.3.0	13.0.0	1
ghcr.io/mealie-recipes/mealie :v3.7.0	bb2939094eed	pillow@12.0.0	13.0.0	1
ghcr.io/mlflow-oidc/mlflow-tracking-server :3.16.1-9.0.2-20261001	970ba1cc1e69	pillow@12.3.0	13.0.0	1
ghcr.io/music-assistant/server :2.7.5	3522e8a7a8f0	pillow@11.3.0	13.0.0	1
ghcr.io/music-assistant/server :2.10.6	45fdb050e069	pillow@12.3.0	13.0.0	1
ghcr.io/music-assistant/server :2.8.7	eef3ee7810d0	pillow@12.1.1	13.0.0	1
ghcr.io/netbox-community/netbox :v4.7.3	1d6e0b5fbd48	pillow@12.3.0	13.0.0	1
ghcr.io/opendatacube/ows :1.9.17	de29324e9801	pillow@12.3.0	13.0.0	1
ghcr.io/open-telemetry/demo :3.1.0-chatbot	604b1f493c92	pillow@12.3.0	13.0.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	pillow@11.3.0	13.0.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.3	57ad9565bff3	pillow@11.3.0	13.0.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	pillow@11.3.0	13.0.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	pillow@11.3.0	13.0.0	1
ghcr.io/seanmorley15/adventurelog-backend :v0.13.0	0250d9cb0d74	pillow@12.3.0	13.0.0	1
ghcr.io/securo-finance/securo-backend :0.16.5	0e40c6858fb3	pillow@12.3.0	13.0.0	1
ghcr.io/stac-utils/pgstac-pypgstac :v0.9.12	672faad776b5	pillow@11.3.0	13.0.0	1
ghcr.io/unique-ag/ai/search-proxy :2026.42.3	2f87faa4af66	pillow@12.2.0	13.0.0	1
ghcr.io/wgbh-mla/ov-wag :v1.1.0	6df27f944fe8	pillow@11.2.1	13.0.0	1
ghcr.io/wittdennis/calibre-web :1.1.3	1086aac67a05	pillow@12.3.0	13.0.0	1
quay.io/galaxyproject/galaxy-min :26.1.1	2c324c9789f5	pillow@12.2.0	13.0.0	1
quay.io/maximilianopizarro/neuroface-backend :v1.4.1	3194d46df0f9	pillow@11.1.0	13.0.0	1
quay.io/maximilianopizarro/neuroface-backend :latest	cba71dc08c8a	pillow@11.1.0	13.0.0	1
quay.io/opsmxpublic/ubi8-oes-datascience :isd-spin-2025.10.01-af26a30d4-202511261054	d8f66f4117fe	pillow@12.0.0	13.0.0	1
quay.io/ortelius/ms-sbom-export :main-v10.0.933-g2e222e	f43bdaa51598	pillow@12.0.0	13.0.0	1
registry.gitlab.com/crafty-controller/crafty-4 :latest	7b6e87514259	pillow@12.2.0	13.0.0	1