StackRadar

CVE-2026-11564

Critical

Advisory

Published 24 Jun 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.004
30th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
248
of 17,781 indexed, latest versions
Container images
223
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 248 of 17,781 indexed charts deploy, on 223 images.

Affected packageAffected versionsFixed inImages
curlapk8.17.0-r1, 8.18.0-r0, 8.19.0-r0, 8.20.0-r0+1 more8.21.0-r0, 8.22.0-r0216
curldeb8.18.0-1ubuntu2.1, 8.18.0-1ubuntu2.28.18.0-1ubuntu2.37
OSV records
ALPINE-CVE-2026-11564UBUNTU-CVE-2026-11564
Also known as
USN-8525-1

Charts affected

248 by stars
ChartLatestAffected imagesRadar Score
easyhaproxybyjgVerified publisher2.0.41 of 1See more

easyhaproxy byjg 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
byjg/easy-haproxy:6.1.1230fdb7b00ae
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

933
openstack-manila-csicloud-provider-openstack2.36.31 of 5See more

openstack-manila-csi cloud-provider-openstack 2.36.3

1 of the 5 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
registry.k8s.io/provider-os/manila-csi-plugin:v1.36.0190976e2e2fe
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

3,749
enavenav-service-architectureVerified publisher0.0.71 of 10See more

enav enav-service-architecture 0.0.7

1 of the 10 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/gla-rad/enav-eureka:latest05002092c621
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

15,860
vulnz-nvd-mirroreugen1.0.01 of 1See more

vulnz-nvd-mirror eugen 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/jeremylong/open-vulnerability-data-mirror:v9.0.49a69aa14dc3e
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,675
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest612d76760b54
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

2,133
gluugluu-flexOfficialVerified publisher0.0.0-nightly1 of 9See more

gluu gluu-flex 0.0.0-nightly

1 of the 9 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/gluufederation/flex/persistence-loader:0.0.0-nightlyc26589258dec
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

1,507
bazarrhalkeye0.2.01 of 1See more

bazarr halkeye 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
linuxserver/bazarr:latesta20fb11a440d
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

614
haproxy-unified-gatewayhaproxytechVerified publisher1.2.01 of 1See more

haproxy-unified-gateway haproxytech 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
haproxytech/haproxy-unified-gateway:1.0.7b9bffe2d0fd1
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

674
cyberchefhv-helm-repo0.3.31 of 1See more

cyberchef hv-helm-repo 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/gchq/cyberchef:11.0.045082a0ac41d
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,109
odooimioVerified publisher3.0.21 of 3See more

odoo imio 3.0.2

1 of the 3 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
library/nginx:1.29.8-alpine5616878291a2
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

3,068
jupyterhub-outpostjupyter-jscVerified publisher2.4.11 of 1See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

1,678
qbittorrentk8s-chartsVerified publisher3.1.01 of 2See more

qbittorrent k8s-charts 3.1.0

1 of the 2 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/hotio/qbittorrent:release-5.2.007198d49e5b4
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,270
k8s-grafana-stackk8s-grafana-stackVerified publisher0.2.322 of 17See more

k8s-grafana-stack k8s-grafana-stack 0.2.32

2 of the 17 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
curl@8.17.0-r1
8.22.0-r0
nginxinc/nginx-unprivileged:1.29-alpine0c79d56aee56
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

15,418
radarrk8s-home-lab-repo17.6.11 of 1See more

radarr k8s-home-lab-repo 17.6.1

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/home-operations/radarr:6.2.1a566e7d364b9
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

752
sonarrk8s-home-lab-repo17.3.11 of 1See more

sonarr k8s-home-lab-repo 17.3.1

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/home-operations/sonarr:4.0.171989718e9fce
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

765
tautullik8s-home-lab-repo12.3.01 of 1See more

tautulli k8s-home-lab-repo 12.3.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/home-operations/tautulli:2.17.12183820d45a1
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,129
chibisafel4gVerified publisher0.1.11 of 3See more

chibisafe l4g 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
library/caddy:2-alpine5f5c8640aae0
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

5,654
lgtm-stacklgtm-stackVerified publisher0.1.31 of 8See more

lgtm-stack lgtm-stack 0.1.3

1 of the 8 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

5,576
medusamedusaVerified publisher1.3.81 of 1See more

medusa medusa 1.3.8

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
linuxserver/medusa:v1.0.26-ls2884477fb1ce3ca
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

977
metrics-server-exportermetrics-server-exporterVerified publisher2.4.01 of 1See more

metrics-server-exporter metrics-server-exporter 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
mrnim94/metrics-server-exporter:v2.4.086c4807a4bca
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,272
opentelemetry-demoopentelemetry-helmVerified publisher0.41.12 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

2 of the 34 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
curl@8.20.0-r1
8.21.0-r0
ghcr.io/open-telemetry/demo:3.0.0-telemetry-docs3519858704e7
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

22,420
opikopikOfficialVerified publisher2.2.593 of 13See more

opik opik 2.2.59

3 of the 13 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
alpine/kubectl:1.35.0862d86046bbc
curl@8.17.0-r1
8.22.0-r0
ghcr.io/comet-ml/opik/opik-frontend:2.2.59bc2f49e9bb3e
curl@8.19.0-r0
8.22.0-r0
ghcr.io/comet-ml/opik/opik-python-backend:2.2.59269d0e55ea97
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

14,334
prowlarrpanzer1119Verified publisher0.4.181 of 2See more

prowlarr panzer1119 0.4.18

1 of the 2 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
linuxserver/prowlarr:2.4.0.5397-ls149a46d0ce0a823
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,001
home-assistantpree-helm-chartsVerified publisher1.80.01 of 1See more

home-assistant pree-helm-charts 1.80.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

2,133
reportportalreportportal-ioOfficialVerified publisher26.8.121 of 15See more

reportportal reportportal-io 26.8.12

1 of the 15 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
reportportal/k8s-wait-for:latest06cdf299b397
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

11,869
sceptresceptreai0.1.122 of 5See more

sceptre sceptreai 0.1.12

2 of the 5 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
maponyacharles/sceptreai:seaweedfs-0.1.127c8a525f08e9
curl@8.20.0-r0
8.22.0-r0
maponyacharles/sceptreai:ui-0.1.127cd0f11c5e55
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

4,369
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
library/nginx:1.31.0-alpine2f07d83bf561
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

16,449
querysiakhooiVerified publisher1.0.01 of 1See more

query siakhooi 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
siakhooi/query:1.0.0f1f4b5b1b870
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,792
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
supabase/postgres:17.6.1.136f371b5f3f2ac
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

18,075
ipsec-vpn-servertaskmediaVerified publisher2.2.01 of 2See more

ipsec-vpn-server taskmedia 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
hwdsl2/ipsec-vpn-server:latest2e939ffe5913
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

770
espocrmtwenty20-helm-chartsVerified publisher2.0.51 of 2See more

espocrm twenty20-helm-charts 2.0.5

1 of the 2 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
espocrm/espocrm:10.0.8-fpm-alpine4bd92daf5f0c
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

493
vite-react-app-helm-chartsvite-react-app-helm-charts1.0.01 of 1See more

vite-react-app-helm-charts vite-react-app-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/marcuwynu23/vite-app-sample:latest21247f2b97c4
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,085
ingress-nginxwenerme4.15.11 of 2See more

ingress-nginx wenerme 4.15.1

1 of the 2 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.15.1594ceea76b01
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,547
natswenerme2.14.61 of 3See more

nats wenerme 2.14.6

1 of the 3 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
natsio/nats-box:0.19.7ffce8bd10338
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

2,313
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

3,833
aeneabotygdrassilOfficialVerified publisher0.2.01 of 2See more

aeneabot ygdrassil 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
elautoestopista/aeneabot:4.2.1125ba620d528
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,697
opencode-serveraardbol-opencode-serverVerified publisher1.5.01 of 1See more

opencode-server aardbol-opencode-server 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/aardbol/opencode-server:v1.18.23-alpine7930061993f7
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

723
akto-ai-guardrails-v2akto0.3.01 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

1 of the 6 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.4.946ed5bcb04b2
curl@8.18.0-1ubuntu2.2
8.18.0-1ubuntu2.3

Open the chart page →

9,321
akto-regional-setupakto1.3.11 of 9See more

akto-regional-setup akto 1.3.1

1 of the 9 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.5.35d4eab1c36b9
curl@8.18.0-1ubuntu2.2
8.18.0-1ubuntu2.3

Open the chart page →

7,603
cross-seedalekcVerified publisher7.19.01 of 1See more

cross-seed alekc 7.19.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/cross-seed/cross-seed:6.13.7a1fed512261f
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,384
sambaalekcVerified publisher1.1.01 of 1See more

samba alekc 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/alekc/samba-docker:v1.1.0cc9a028d9c43
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

1,141
lidarralexmorbo-lidarrVerified publisher0.1.21 of 1See more

lidarr alexmorbo-lidarr 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/home-operations/lidarr:3.1.2.4902dab0e07502a3
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,870
quialexmorbo-quiVerified publisher0.1.01 of 1See more

qui alexmorbo-qui 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/autobrr/qui:v1.14.110b7945d4f09
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,623
alluredeckalluredeckVerified publisher0.24.01 of 2See more

alluredeck alluredeck 0.24.0

1 of the 2 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
ghcr.io/mkutlak/alluredeck-ui:0.41.0c19509b1b336
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,273
buildkit-serviceandrcunsVerified publisher1.8.01 of 1See more

buildkit-service andrcuns 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
moby/buildkit:v0.31.0a095b3d11ce1
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,285
ansible-playbook-operatoransible-playbook-operatorVerified publisher0.1.71 of 1See more

ansible-playbook-operator ansible-playbook-operator 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
kenchrcum/ansible-playbook-operator:0.1.712fb213debf1
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,339
antigenic-docuseal-helm-chartantigenic-docuseal-helm-chartVerified publisher0.2.01 of 1See more

antigenic-docuseal-helm-chart antigenic-docuseal-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
docuseal/docuseal:2.4.17493fd7f6728
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

2,766
appwriteappwrite-helmVerified publisher1.3.22 of 8See more

appwrite appwrite-helm 1.3.2

2 of the 8 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.01aaa70127114
curl@8.17.0-r1
8.22.0-r0
clamav/clamav:1.0dd0d9cc746af
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

9,847
arlas-aiasarlas-stackVerified publisher28.8.04 of 22See more

arlas-aias arlas-stack 28.8.0

4 of the 22 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
gisaia/arlas-fam-wui:0.18.13700dcaf7a75
curl@8.20.0-r0
8.22.0-r0
gisaia/arlas-wui:28.0.3b83b3e067173
curl@8.19.0-r0
8.22.0-r0
gisaia/arlas-wui-builder:28.0.1a35977a5bb7d
curl@8.19.0-r0
8.22.0-r0
gisaia/arlas-wui-hub:28.0.21a3cc43d822f
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

40,238
arlas-uisarlas-stackVerified publisher28.8.04 of 4See more

arlas-uis arlas-stack 28.8.0

4 of the 4 container images this version deploys carry CVE-2026-11564.

Container imageDigestPackageFixed in
gisaia/arlas-fam-wui:0.18.13700dcaf7a75
curl@8.20.0-r0
8.22.0-r0
gisaia/arlas-wui:28.0.3b83b3e067173
curl@8.19.0-r0
8.22.0-r0
gisaia/arlas-wui-builder:28.0.1a35977a5bb7d
curl@8.19.0-r0
8.22.0-r0
gisaia/arlas-wui-hub:28.0.21a3cc43d822f
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

2,985

Container images carrying it

223 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/okteto/buildkit:0.0.0-2026-08-0314527ca5d2a9
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/openrelik/openrelik-ui:latest7f91594d5eb3
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/open-telemetry/demo:3.0.0-telemetry-docs3519858704e7
curl@8.19.0-r0
8.22.0-r0
1
ghcr.io/pixelfederation/unbound:1.24.2_0fce820a03964
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/pocket-id/pocket-id:v2.7.045bdeaf3fcd6
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/ptrvsrg/csi-driver-ipfs:latest97d2d9ccd7a5
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
curl@8.18.0-1ubuntu2.1
8.18.0-1ubuntu2.3
1
ghcr.io/reiche-world/traefik-secrets-exporter:0.0.21485ff93cbf9
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/sergelogvinov/ipsec:5.236f4e651d1fe
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/teq-cloud/iteq-web:0.3.3-beta0acbe2f2e1ea
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/theconnman/docker-hub-rss:0.6.238eba84b2be8
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/timothepoznanski/poznote:6.80.0045035db3a20
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
curl@8.17.0-r1
8.22.0-r0
1
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
curl@8.19.0-r0
8.22.0-r0
1
quay.io/deployhub/ms-nginx:svccat-v11.0.815-g717581d2d3400664e8
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
curl@8.20.0-r0
8.22.0-r0
1
registry.k8s.io/provider-os/manila-csi-plugin:v1.36.0190976e2e2fe
curl@8.17.0-r1
8.22.0-r0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.