CVE-2026-10536

Critical

Advisory

Published 24 Jun 2026In the index since 5 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.009; 57th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,107; of 17,790 indexed, latest versions
Container images: 975; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,107 of 17,790 indexed charts deploy, on 975 images.

Affected package	Affected versions	Fixed in	Images
curldeb	1:8.14.1-2+deb13u3+e1, 7.88.1-10, 7.88.1-10+deb12u1, 7.88.1-10+deb12u4+33 more	8.5.0-2ubuntu10.11, 8.14.1-2+e19, 8.14.1-2ubuntu1.5, 8.18.0-1ubuntu2.3	765
curlapk	8.12.1-r0, 8.17.0-r1, 8.18.0-r0, 8.19.0-r0+2 more	8.21.0-r0, 8.22.0-r0	210

OSV records: ALPINE-CVE-2026-10536 DEBIAN-CVE-2026-10536 UBUNTU-CVE-2026-10536 ECHO-0d6f-7fbe-c7fa
Also known as: USN-8525-1

Charts affected

1,107 by stars

Chart

Latest

Affected images

Radar Score

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-10536.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	curl@8.20.0-r0	8.22.0-r0

Open the chart page →

1,042

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-10536.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	curl@7.88.1-10+deb12u5	no fix listed

Open the chart page →

7,685

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-10536.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	curl@7.88.1-10+deb12u7	no fix listed

Open the chart page →

13,197

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-10536.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

1,839

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-10536.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

1,839

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-10536.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	curl@8.17.0-r1	8.22.0-r0

Open the chart page →

1,571

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-10536.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

1,839

Container images carrying it

975 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
yetiplatform/yeti :latest	9c3006cedcca	curl@8.14.1-2+deb13u4	no fix listed	1
yetiplatform/yeti-frontend :latest	709064278c7e	curl@8.14.1-2+deb13u4	no fix listed	1
yetiplatform/yeti-frontend :2.9.0	873ef15d267b	curl@8.14.1-2+deb13u4	no fix listed	1
zabbix/zabbix-agent2 :ubuntu-7.0.23	7322a94c5d7a	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.11	1
zabbix/zabbix-server-mysql :ubuntu-6.4-latest	55d074b6b031	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.11	1
zabbix/zabbix-server-pgsql :ubuntu-7.0.23	7e8c8e059533	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.11	1
zabbix/zabbix-web-nginx-mysql :ubuntu-6.4-latest	0e5f69c4c54e	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.11	1
zabbix/zabbix-web-nginx-pgsql :ubuntu-7.0.23	7d4d58086515	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.11	1
zabbix/zabbix-web-service :ubuntu-7.0.23	915b3183e054	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.11	1
zepai/knowledge-graph-mcp :v0.2.1	6ab0ee79926b	curl@7.88.1-10+deb12u12	no fix listed	1
zimengxiong/excalidash-frontend :0.4.27	242629350b06	curl@8.17.0-r1	8.22.0-r0	1
gcr.io/datadoghq/cluster-agent :7.61.0	6efe04ba4e06	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.11	1
gcr.io/datadoghq/private-action-runner :v1.21.0	5f5918f843a4	curl@8.5.0-2ubuntu10.8	8.5.0-2ubuntu10.11	1
gcr.io/google.com/cloudsdktool/google-cloud-cli :alpine	6d35276c2562	curl@8.20.0-r0	8.22.0-r0	1
gcr.io/istio-testing/operator :latest	8d4576f7b98f	curl@8.5.0-2ubuntu10.1	8.5.0-2ubuntu10.11	1
gcr.io/ml-pipeline/metadata-writer :2.3.0	9bcfd2abc361	curl@7.88.1-10+deb12u7	no fix listed	1
ghcr.io/aardbol/opencode-server :v1.18.23-alpine	7930061993f7	curl@8.20.0-r0	8.22.0-r0	1
ghcr.io/aeharding/voyager :latest	779759172676	curl@8.14.1-2+deb13u4	no fix listed	1
ghcr.io/alekc/samba-docker :v1.1.0	cc9a028d9c43	curl@8.20.0-r0	8.22.0-r0	1
ghcr.io/alexmorbo/dell_idrac_fan_controller :v0.1.6-1	d110504d551d	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.11	1
ghcr.io/analogj/scrutiny :master-omnibus	18689773150d	curl@7.88.1-10+deb12u14	no fix listed	1
ghcr.io/analogj/scrutiny :v0.9.2-web	71be54e99608	curl@8.14.1-2+deb13u2	no fix listed	1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets :0.0.0-main	13e267ad7d94	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.11	1
ghcr.io/apache/ats-ingress :latest	2d4d776f6362	curl@8.20.0-r0	8.22.0-r0	1
ghcr.io/appscode/gotenberg :8.25	f9104080d9a7	curl@8.16.0-4~bpo13+1	no fix listed	1
ghcr.io/appscode/trivydb :0.0.3	67ffb0309acb	curl@8.17.0-r1	8.22.0-r0	1
ghcr.io/argonix-io/argonix-api :1.0.0	cb5f24732197	curl@8.14.1-2+deb13u5	no fix listed	1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend :2.0.0	fcbab3a24880	curl@8.17.0-r1	8.22.0-r0	1
ghcr.io/astriaorg/astrotrek :0.1.0	5889bea38e56	curl@7.88.1-10+deb12u7	no fix listed	1
ghcr.io/autobrr/qui :v1.14.1	10b7945d4f09	curl@8.17.0-r1	8.22.0-r0	1
ghcr.io/avistotelecom/docker-wazuh-agent :4.12.0	8766ba08bf1a	curl@7.88.1-10+deb12u12	no fix listed	1
ghcr.io/base/node-reth :v1.1.1	8eb6e492fe3c	curl@8.5.0-2ubuntu10.9	8.5.0-2ubuntu10.11	1
ghcr.io/beslovas/duckdb-ui :1.3.2	72f35584026d	curl@7.88.1-10+deb12u14	no fix listed	1
ghcr.io/biru-scop/tenzu-front :latest	16759fa523f8	curl@8.19.0-r0	8.22.0-r0	1
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	curl@8.5.0-2ubuntu10.8	8.5.0-2ubuntu10.11	1
ghcr.io/buanet/iobroker :v9.1.2	ca7dc7362968	curl@7.88.1-10+deb12u6	no fix listed	1
ghcr.io/camptocamp/tetragon-policy-builder :master	0e99f12bb040	curl@7.88.1-10+deb12u8	no fix listed	1
ghcr.io/caninehq/canine :latest	a058034ca006	curl@7.88.1-10+deb12u15	no fix listed	1
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	curl@8.20.0-r0	8.22.0-r0	1
ghcr.io/cfi2017/opencve-scheduler :3.0.0	8d943799621b	curl@7.88.1-10+deb12u15	no fix listed	1
ghcr.io/cjmalloy/jasper :v1.3.282	726a947bb65b	curl@7.88.1-10+deb12u15	no fix listed	1
ghcr.io/cjmalloy/jasper-ui :v1.3.623	246dc2160efe	curl@8.14.1-2+deb13u4	no fix listed	1
ghcr.io/cloudscript-technology/dumpscript :v0.0.42-alpine-edge	fce5b6fd161c	curl@8.19.0-r0	8.21.0-r0	1
ghcr.io/cohdi/composable-dra-driver :v0.2.2	8c05f7366981	curl@8.14.1-2+deb13u3	no fix listed	1
ghcr.io/cosmicrocks/datum :v0.4.0beta	76771c3cc8c3	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.11	1
ghcr.io/cosmo-tech/cosmotech-copilot-api :latest	a2be95de450c	curl@8.14.1-2+deb13u2	no fix listed	1
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	curl@7.88.1-10+deb12u12	no fix listed	1
ghcr.io/cross-seed/cross-seed :6.13.7	a1fed512261f	curl@8.17.0-r1	8.22.0-r0	1
ghcr.io/dakera-ai/dakera :0.11.101	af610992a416	curl@8.14.1-2+deb13u4	no fix listed	1
ghcr.io/dakera-ai/dakera-dashboard :0.3.29	2e059589f7f7	curl@8.17.0-r1	8.22.0-r0	1