# DooPlex (homelab) — what to update, from the security watch (R-1328)

Read only: Felhom changes nothing on DooPlex. Source: the watch's run of 2026-10-27 night over
`documentation/security-watch/dooplex-workloads.txt` (homelab-manifests `image:` lines; Helm-chart images are NOT
in it). „Catalog ahead" = the Felhom catalog already ships a different (walked) tag of the same image.

| Image | DooPlex tag | Where | What is bad (fixed in) | Catalog ahead |
|---|---|---|---|---|
| `actualbudget/actual-server` | `26.10.0` | actualbudget-system/actualbudget.yaml | CVE-2026-111497 — Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | `26.9.0` |
| `advplyr/audiobookshelf` | `2.37.1` | audiobookshelf-system/audiobookshelf.yaml | CVE-2026-111497 — Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | — |
| `codewithcj/sparkyfitness_server` | `v1.9.0` | workout-system/sparkyfitness.yaml | CVE-2026-111497 — Node.js 24.22.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | `v0.17.3` |
| `crocodilestick/calibre-web-automated` | `dev` | calibre-system/cwa.yaml | CVE-2026-111497 — Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322 (fixed: 1.2.1) | `v4.0.8` |
| `docker.io/calcom/cal.com` | `v6.2.0` | booking-system/booking.yaml | CVE-2026-111497 — Node.js 20.20.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 22.23.4, 24.22.1, 26.12.1) | — |
| `flomp/wanderer-db` | `v0.21.0` | wanderer-system/wanderer.yaml | GHSA-vprp-gr6m-j375 — ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources (fixed: v0.21.2); GHSA-3xp7-7492-j2q6 — ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources (fixed: v0.21.2); GHSA-j9m4-8qwf-jvx6 — SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources (fixed: v0.21.2) | `v0.20.0` |
| `flomp/wanderer-web` | `v0.21.0` | wanderer-system/wanderer.yaml | GHSA-vprp-gr6m-j375 — ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources (fixed: v0.21.2); GHSA-3xp7-7492-j2q6 — ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources (fixed: v0.21.2); GHSA-j9m4-8qwf-jvx6 — SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources (fixed: v0.21.2) | `v0.20.0` |
| `ghcr.io/gethomepage/homepage` | `v1.13.2` | homepage-system/homepage-orsi.yaml, homepage-system/homepage.yaml | GHSA-669x-4pg4-w24r — Homepage service proxy allows client-controlled methods and bodies to configured widget endpoints (fixed: 2.2.0); CVE-2026-111497 — Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 22.23.4) | — |
| `ghcr.io/immich-app/immich-machine-learning` | `v2.7.5` | immich-system/immich.yaml | GHSA-q89f-h332-8q2h — Authenticated SVG upload reaches ImageMagick coders and enables RCE (fixed: v3.2.4); GHSA-h5w4-vjv4-9r5q — Incorrect sanitization of continue URL on the /maintenance endpoint (fixed: a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 — A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API (fixed: v3.2.0) | `v3.2.4` |
| `ghcr.io/immich-app/immich-server` | `v2.7.5` | immich-system/immich.yaml | GHSA-q89f-h332-8q2h — Authenticated SVG upload reaches ImageMagick coders and enables RCE (fixed: v3.2.4); GHSA-h5w4-vjv4-9r5q — Incorrect sanitization of continue URL on the /maintenance endpoint (fixed: a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 — A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API (fixed: v3.2.0) | `v3.2.4` |
| `ghcr.io/lukegus/termix` | `release-2.9.2` | termix-system/termix.yaml | CVE-2026-111497 — Node.js 26.10.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 26.12.1) | `2.8.0` |
| `ghcr.io/paperless-ngx/paperless-ngx` | `3.3.4` | paperless-system/paperless.yaml | CVE-2026-111497 — Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322 (fixed: 1.2.1) | `2.20.15` |
| `gitea/gitea` | `1.26.2` | gitea-system/gitea.yaml | GHSA-wx44-9m3m-rjqx — Locked issues and comments still accept reactions through the web UI (fixed: 28.2.0); GHSA-4jmf-h2cm-hg7w — Cross-Site Request Forgery on `POST /{owner}/{repo}/topics` (fixed: 28.2.0); GHSA-8j56-f865-gqq2 — Draft releases include attachment metadata from other repositories (fixed: 28.2.0) | `1.27.3` |
| `grafana/grafana` | `13.2.4` | mon-system/monitoring.yaml | GHSA-8xmm-x63g-f6xv — Stored XSS in ResourcePicker component  (fixed: no fixed version named yet); GHSA-4724-7jwc-3fpw — Spoofing originalUrl of snapshots (fixed: the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 — Email addresses and usernames can not be trusted (fixed: the range is unreadable — check by hand) | — |
| `louislam/uptime-kuma` | `2.5.6` | uptimekuma-system/uptimekuma.yaml | GHSA-qjxc-h5jf-c7rj — GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extra (fixed: the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 — ⬆️ Security Fixes (fixed: 2.5.8); release:louislam/uptime-kuma@2.5.7 — ⬆️ Security Fixes (fixed: 2.5.7) | `2.5.7` |
| `outlinewiki/outline` | `1.11.0` | outline-system/outline.yaml | GHSA-x4w3-9p9j-cprh — users.update_role reveals whether a user id from another team exists and which role it has (fixed: 1.12.0); GHSA-rq53-m97j-f2pg — Unpublished documents remain publicly accessible and their shares cannot be revoked (fixed: 1.12.0); GHSA-h6ff-rw9x-5mq2 — Authenticated members can publish documents into private collections through a retained parent link (fixed: 1.12.0) | `1.12.0` |
| `redis` | `8.10.2` | plantit-system/plantit.yaml | GHSA-c8h9-259x-jff4 — Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution (fixed: the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 — Lua Use-After-Free may lead to remote code execution (fixed: no fixed version named yet); GHSA-93m2-935m-8rj3 — Use-After-Free in unblock client flow may lead to remote code execution (fixed: no fixed version named yet) | `7.4-alpine` |
| `rommapp/romm` | `5.4.0` | arcade-system/romm.yaml | release:rommapp/romm@5.4.1 — While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible (fixed: 5.4.1); CVE-2026-111497 — Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | `5.4.1` |
| `vabene1111/recipes` | `2.6.15` | tandoor-system/tandoor.yaml | CVE-2026-111497 — Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | — |

**19 images to update.**

## NOT CHECKED (the watch could not read them)

- `advplyr/audiobookshelf:2.37.1` — https://hub.docker.com/v2/repositories/advplyr/audiobookshelf/tags: The read operation timed out
- `gitea.dooplex.hu/admin/felhom-act-runner:0.1.0` — registry gitea.dooplex.hu: no anonymous token route
- `gitea.dooplex.hu/admin/jarr:latest` — registry gitea.dooplex.hu: no anonymous token route
- `gitea.dooplex.hu/admin/recipe-importer:latest` — registry gitea.dooplex.hu: no anonymous token route
- `gitea.dooplex.hu/admin/revfulop-calendar:1.6.2` — registry gitea.dooplex.hu: no anonymous token route
- `gitea.dooplex.hu/admin/sparkyfitness-export:0.3.0` — registry gitea.dooplex.hu: no anonymous token route
- `gitea.dooplex.hu/admin/wan-probe:0.1.0` — registry gitea.dooplex.hu: no anonymous token route
- `minio/minio:latest` — Docker registry tags of minio/minio: HTTP 401; manifest minio/minio:latest: HTTP 401