CVE-2026-114113: Sharp
- Severity
- 8.4 (HIGH)
- Affected versions
- Before 0.35.0
- Fixed version
- 0.35.0
- Patch status
- Patched
- Published
- 2026-10-21T01:17:37.510
Why it matters
High-severity vulnerability requiring prioritized review.
Recommended admin actions
- Review and patch based on exposure, asset criticality, and business impact.
- Compare installed versions against the affected version range in the advisory.
Technical summary
Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to process untrusted input, triggering these libvips flaws.
View the official NVD record for CVE-2026-114113
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
380 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-102785 |
YOOtheme Pro extension for Joomla
Reporter: SECURITY
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79844 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79846 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79847 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79848 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79849 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79850 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-79851 |
Unknown product
Reporter: SECURITY-ALERT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-110063 |
VM Inspector for Azure Virtual Machines
Reporter: SECURE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-83938 |
Azure Kubernetes Configuration Service
Reporter: SECURE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-97785 |
Microsoft Entra application proxy
Reporter: SECURE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-114612 |
litellm PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-112241 |
SureCart PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-112832 |
Rootblox PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79852 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79853 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79854 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79855 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79856 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79857 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79858 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79859 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79860 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79861 |
Unknown product
Reporter: SECURITY-ALERT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-79862 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79863 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79864 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79865 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79866 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79867 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79868 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79869 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79870 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-79871 |
Unknown product
Reporter: SECURITY-ALERT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-54630 |
Part-DB-server PATCH
Reporter: SECURITY-ADVISORIES
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-55981 |
Creative Sound Blaster Katana V2, V2X, SE
Reporter: 5F57B9BF-260D-4433-BF07-B6A79E9BB7D4
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-97631 |
EDK2
Reporter: INFOSEC
|
9.5
CRITICAL
|
VIEW RECORD |
| CVE-2026-115375 |
Incus 7.0.0 PATCH
Reporter: DISCLOSURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-115377 |
incus PATCH
Reporter: DISCLOSURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-115384 |
Wasmtime 39.0.0 PATCH
Reporter: DISCLOSURE
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-79872 |
Unknown product
Reporter: SECURITY-ALERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-114625 |
VeloCloud Orchestrator
Reporter: PSIRT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-109122 |
E3 Firmware PATCH
Reporter: ICS-CERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-107861 |
DHS
Reporter: ICS-CERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-110243 |
DHS
Reporter: ICS-CERT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-112327 |
Amelia PATCH
Reporter: AUDIT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2021-48014 |
FineReport 9.0
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2021-48016 |
DedeCMS
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2022-51026 |
Bytebase 0.12.0 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-79873 |
HPE
Reporter: SECURITY-ALERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-79874 |
HPE
Reporter: SECURITY-ALERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-79875 |
HPE
Reporter: SECURITY-ALERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-79876 |
HPE
Reporter: SECURITY-ALERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-19677 |
onPhase Forms
Reporter: 9C1820AE-FB77-4810-A8AA-CA46E7474D2F
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-115324 |
mem0 0.1.117 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-111497 |
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli
Reporter: CVE-COORDINATION
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-115353 |
Mistune PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-111594 |
InterSystems IRIS for Health
Reporter: ICS-CERT
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-114607 |
better-auth PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-114611 |
OCO-Server PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-105014 |
a command ('command injection') in Azure Pipelines
Reporter: SECURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-115547 |
An input validation issue in the Okta Access Gateway (OAG) Admin Console
Reporter: PSIRT
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-115372 |
Incus from 7.3.0 PATCH
Reporter: DISCLOSURE
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-112242 |
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2019-25778 |
SeaCMS
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2022-51021 |
NotificationX PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2022-51022 |
YiShaAdmin 2.2 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2022-51023 |
PHPOK 4.5.000 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2024-58393 |
Readymade Unilevel Ecommerce MLM
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2025-71434 |
Weaver E-cology 8.0, 9.0, and 10.0 PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-108357 |
PhpSpreadsheet PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-108358 |
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-115392 |
Wasmtime PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-79877 |
HPE
Reporter: SECURITY-ALERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-79878 |
HPE
Reporter: SECURITY-ALERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-79879 |
HPE
Reporter: SECURITY-ALERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-93471 |
esaml
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2017-20287 |
Javo Spot PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2018-25438 |
Intermesh Group-Office 3.3.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2018-25439 |
MetInfo CMS 6.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2019-25779 |
WooThemes Diarise
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48013 |
Weaver E-cology 8.0
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48015 |
JeeWMS
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2021-48017 |
OrbiTeam BSCW Server 5.x PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2022-51024 |
Kavita 0.5.2 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2024-58396 |
CPAS Audit Management System
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115325 |
Netmaker
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115328 |
JSON-SCADA PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115330 |
Lotus
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115331 |
Lotus
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115332 |
Lotus
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-113582 |
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera
Reporter: SECURITY
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-108359 |
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-113873 |
HAPI FHIR
Reporter: 9119A7D8-5EAB-497F-8521-727C672E3725
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115347 |
Mistune PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115348 |
Mistune from 3.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115349 |
Mistune from 3.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115352 |
Mistune PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115355 |
Mistune PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-79880 |
HPE
Reporter: SECURITY-ALERT
|
8.7
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.