StackRadar

CVE-2026-11856

Critical

Advisory

Published 24 Jun 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.007
51st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,701
of 17,797 indexed, latest versions
Container images
1,518
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,701 of 17,797 indexed charts deploy, on 1,518 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.35.0-1ubuntu2.1, 7.35.0-1ubuntu2.3, 7.35.0-1ubuntu2.16+109 more7.35.0-1ubuntu2.20+esm22, 7.47.0-1ubuntu2.19+esm18, 7.58.0-2ubuntu3.24+esm11, 7.68.0-1ubuntu2.25+esm6+4 more1,306
curlapk8.12.1-r0, 8.17.0-r1, 8.18.0-r0, 8.19.0-r0+2 more8.21.0-r0, 8.22.0-r0212
OSV records
ALPINE-CVE-2026-11856DEBIAN-CVE-2026-11856UBUNTU-CVE-2026-11856ECHO-895d-0fcf-45bd
Also known as
USN-8651-1

Charts affected

1,701 by stars
ChartLatestAffected imagesRadar Score
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-11856.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
curl@7.81.0-1ubuntu1.25
7.81.0-1ubuntu1.26

Open the chart page →

7,936

Container images carrying it

1,518 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
supabase/postgres:17.6.1.136f371b5f3f2ac
curl@8.19.0-r0
8.22.0-r0
1
supabase/realtime:v2.102.3aa1c92c0cf32
curl@7.88.1-10+deb12u14
no fix listed
1
supabase/realtime:v2.33.8d207e6e23ad3
curl@7.88.1-10+deb12u7
no fix listed
1
supabase/realtime:latestd3aa0c86c7b3
curl@8.14.1-2+deb13u4
no fix listed
1
supabase/studio:20241021-9f9b08326d8070c55e9
curl@7.88.1-10+deb12u7
no fix listed
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
curl@7.88.1-10+deb12u15
no fix listed
1
supabase/studio:latest94a2a9d2906e
curl@7.88.1-10+deb12u15
no fix listed
1
svtechnmaa/svtech_debuger:v1.0.3a934ffd63d25
curl@7.81.0-1ubuntu1.16
7.81.0-1ubuntu1.26
1
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
curl@7.68.0-1ubuntu2.18
7.68.0-1ubuntu2.25+esm6
1
svtechnmaa/svtech_maxscale:v1.0.3410a25b51f9f
curl@7.81.0-1ubuntu1.15
7.81.0-1ubuntu1.26
1
svtechnmaa/svtech_nagvis:v1.2.118394b08e6c3
curl@7.88.1-10+deb12u5
no fix listed
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
curl@7.68.0-1ubuntu2.18
7.68.0-1ubuntu2.25+esm6
1
syncthing/syncthing:2.1.07c60eb0ec887
curl@8.17.0-r1
8.22.0-r0
1
sysnet4admin/colosseum-cms:loge74b43c7f492
curl@7.88.1-10+deb12u12
no fix listed
1
sysnet4admin/colosseum-prm:log5802bfcd7fed
curl@7.88.1-10+deb12u12
no fix listed
1
tautulli/tautulli:latest670e68dd9efc
curl@8.14.1-2+deb13u4
no fix listed
1
tchiotludo/akhq:0.28.0c2824dc2ae44
curl@8.18.0-1ubuntu2.3
8.18.0-1ubuntu2.4
1
teknas09/bird-pod:latest12a1fa85c4aa
curl@7.88.1-10+deb12u5
no fix listed
1
temporalio/admin-tools:1.28cfde8170c92f
curl@8.17.0-r1
8.22.0-r0
1
tensorflow/tensorflow:1.6.0-devel1e3172090703
curl@7.47.0-1ubuntu2.6
7.47.0-1ubuntu2.19+esm18
1
tenureai/tenure:v1.0.285f5b222df9a5
curl@8.14.1-2+deb13u3+dhi3
no fix listed
1
theradius/loggia:0.463ba348546ec
curl@7.88.1-10+deb12u5
no fix listed
1
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
curl@8.14.1-2+deb13u2
no fix listed
1
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
curl@8.14.1-2+deb13u2
no fix listed
1
thingsboard/tbmq-integration-executor:2.4.0b5a9c1addf80
curl@8.14.1-2+deb13u4
no fix listed
1
thingsboard/tbmq-node:2.4.070661025dba5
curl@8.14.1-2+deb13u4
no fix listed
1
thmmniii/fbs-core:v1.27.15438517d9fc2
curl@7.81.0-1ubuntu1.20
7.81.0-1ubuntu1.26
1
thongngo3301/stakefish:latesta341af5976e3
curl@7.88.1-10+deb12u1
no fix listed
1
timescale/timescaledb-ha:pg15-latesta8e3322e1cf9
curl@7.81.0-1ubuntu1.10
7.81.0-1ubuntu1.26
1
timescale/timescaledb-ha:pg14.6-ts2.9.1-p1cdb9ae118899
curl@7.81.0-1ubuntu1.7
7.81.0-1ubuntu1.26
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
curl@7.81.0-1ubuntu1.20
7.81.0-1ubuntu1.26
1
timescale/timescaledb-ha:pg14-ts2.6-latested719c0cd19d
curl@7.81.0-1ubuntu1.2
7.81.0-1ubuntu1.26
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
curl@7.47.0-1ubuntu2.5
7.47.0-1ubuntu2.19+esm18
1
tinymediamanager/tinymediamanager:5.3.22b34dc85099e
curl@8.14.1-2+deb13u2
no fix listed
1
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
curl@8.14.1-2+deb13u2
no fix listed
1
tombursch/kitchenowl-web:v0.7.8517f808eee66
curl@8.17.0-r1
8.22.0-r0
1
tomsquest/docker-radicale:3.6.1.0a594c624c5a6
curl@8.17.0-r1
8.22.0-r0
1
tpdock/freeradius:2.2.93da600c95a49
curl@7.47.0-1ubuntu2.5
7.47.0-1ubuntu2.19+esm18
1
treskon/portrait:DEV-latest88e813f22347
curl@8.18.0-1ubuntu2.3
8.18.0-1ubuntu2.4
1
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
curl@7.88.1-10+deb12u8
no fix listed
1
trinodb/trino:405ee80ab5eeab2
curl@7.81.0-1ubuntu1.6
7.81.0-1ubuntu1.26
1
trueosiris/vrising:latest9356f98ad561
curl@7.81.0-1ubuntu1.23
7.81.0-1ubuntu1.26
1
twentycrm/twenty:v2.40.06e3b2e68ad78
curl@8.20.0-r0
8.22.0-r0
1
twentycrm/twenty:v2.22.0e7d9948bf284
curl@8.19.0-r0
8.22.0-r0
1
twentycrm/twenty-postgres-spilo:latest2f78405a78be
curl@7.81.0-1ubuntu1.15
7.81.0-1ubuntu1.26
1
udhos/eks-auto-pod-id-assoc:0.6.0196ef68af380
curl@8.19.0-r0
8.22.0-r0
1
udhos/k8s-mutating-admission-webhook:1.15.1e588db500edf
curl@8.19.0-r0
8.22.0-r0
1
udhos/redis-enforce-expire:1.0.0615b6a7d742e
curl@8.17.0-r1
8.22.0-r0
1
udhos/sqs-to-sns:2.0.15cf7979da82e1
curl@8.19.0-r0
8.22.0-r0
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
curl@7.88.1-10+deb12u12
no fix listed
1

syft 1.42.1 · advisories as of 17 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.