StackRadar

CVE-2026-12064

High

Advisory

Published 24 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
34th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,013
of 17,787 indexed, latest versions
Container images
877
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,013 of 17,787 indexed charts deploy, on 877 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.88.1-10, 7.88.1-10+deb12u1, 7.88.1-10+deb12u4+24 more8.14.1-2+e22, 8.14.1-2ubuntu1.5, 8.18.0-1ubuntu2.3659
curlapk8.12.1-r0, 8.17.0-r1, 8.18.0-r0, 8.19.0-r0+2 more8.21.0-r0, 8.22.0-r0218
OSV records
ALPINE-CVE-2026-12064DEBIAN-CVE-2026-12064UBUNTU-CVE-2026-12064ECHO-2ea7-d2c8-d549
Also known as
USN-8525-1

Charts affected

1,013 by stars
ChartLatestAffected imagesRadar Score
entehelmforgeVerified publisher1.0.21 of 4See more

ente helmforge 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/ente/web:5ab0c5b4c7a89c4e470ef6f793600da33cebf35d3f4864eb7f11
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

4,227
fastmcp-serverhelmforgeVerified publisher1.7.41 of 1See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.11.2fcb7017327d6
curl@8.14.1-2+deb13u2
no fix listed

Open the chart page →

3,294
generichelmforgeVerified publisher3.1.51 of 1See more

generic helmforge 3.1.5

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:1.31.505b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
curl@8.14.1-2+deb13u3
no fix listed

Open the chart page →

11,080
jenkinshelmforgeVerified publisher1.0.91 of 1See more

jenkins helmforge 1.0.9

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
jenkins/jenkins:2.568.3-lts-jdk21c1e4c349365f
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

2,487
jupyterhubhelmforgeVerified publisher1.0.62 of 3See more

jupyterhub helmforge 1.0.6

2 of the 3 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
jupyterhub/configurable-http-proxy:5.3.069a7170eeeda
curl@8.19.0-r0
8.22.0-r0
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

5,350
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
curl@8.14.1-2+deb13u2
no fix listed

Open the chart page →

3,442
medikeephelmforgeVerified publisher2.0.01 of 3See more

medikeep helmforge 2.0.0

1 of the 3 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/afairgiant/medikeep:v0.69.0766699daa9ac
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

6,041
middlewarehelmforgeVerified publisher1.2.61 of 4See more

middleware helmforge 1.2.6

1 of the 4 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
middlewareeng/middleware:0.3.1747d880812f1
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

9,704
moodlehelmforgeVerified publisher1.1.01 of 2See more

moodle helmforge 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
moodlehq/moodle-php-apache:8.4-bookworm922af5166835
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

5,911
nextcloudhelmforgeVerified publisher1.0.01 of 3See more

nextcloud helmforge 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nextcloud:34.0.4-apachede4ad9389386
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

7,041
openreel-videohelmforgeVerified publisher1.0.31 of 1See more

openreel-video helmforge 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
helmforge/openreel-video:v0.5.07ba0d47b943f
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,086
phpmyadminhelmforgeVerified publisher2.0.11 of 1See more

phpmyadmin helmforge 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
phpmyadmin/phpmyadmin:5.2.342a200db07b4
curl@8.14.1-2
no fix listed

Open the chart page →

4,741
pimcorehelmforgeVerified publisher2.0.11 of 6See more

pimcore helmforge 2.0.1

1 of the 6 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
dunglas/mercure:v0.24.2916834e49961
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

3,200
poznotehelmforgeVerified publisher2.0.21 of 1See more

poznote helmforge 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/timothepoznanski/poznote:6.80.0045035db3a20
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

483
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

5,916
strava-statisticshelmforgeVerified publisher1.1.161 of 2See more

strava-statistics helmforge 1.1.16

1 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
robiningelbrecht/strava-statistics:v5.0.040842cdfd616
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

846
supersethelmforgeVerified publisher1.3.61 of 5See more

superset helmforge 1.3.6

1 of the 5 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

5,649
text-embeddings-inferencehelmforgeVerified publisher1.0.01 of 2See more

text-embeddings-inference helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/huggingface/text-embeddings-inference:cpu-1.9.3ad950d30878e
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

2,402
uptime-kumahelmforgeVerified publisher1.5.121 of 1See more

uptime-kuma helmforge 1.5.12

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.33e24e96c89ef
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

30,106
myapphelmingapp0.1.01 of 1See more

myapp helmingapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
muhammedgamal/fp23:latest74b4cd69b6fa
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

11,441
jellyfinhelm-l3st86Verified publisher0.1.81 of 1See more

jellyfin helm-l3st86 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
jellyfin/jellyfin:latestaefb67e6a7ff
curl@8.14.1-2+deb13u3
no fix listed

Open the chart page →

2,615
openaevhelm-openbasVerified publisher2.0.51 of 7See more

openaev helm-openbas 2.0.5

1 of the 7 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
bitnamilegacy/rabbitmq:4.1.2-debian-12-r1fac502149c40
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

7,502
openbashelm-openbasVerified publisher1.8.142 of 7See more

openbas helm-openbas 1.8.14

2 of the 7 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
bitnamilegacy/rabbitmq:4.1.2-debian-12-r1fac502149c40
curl@7.88.1-10+deb12u12
no fix listed
openbas/caldera-server:5.1.0a277796d9724
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

25,099
release-cleanerhelm-release-cleanerVerified publisher1.0.01 of 1See more

release-cleaner helm-release-cleaner 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
alpine/helm:4.1.0905a068da431
curl@8.18.0-r0
8.21.0-r0

Open the chart page →

2,001
steampipehelm-steampipeVerified publisher2.4.11 of 1See more

steampipe helm-steampipe 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/steampipe:v2.4.1a982103d91d3
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

3,025
my-nginxhelmtaiwo0.1.01 of 1See more

my-nginx helmtaiwo 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
samplehelmapphelmtraining3.0.01 of 1See more

samplehelmapp helmtraining 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
praravind1801/helmimages:3.0.0f29d637b9ce1
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

5,114
home-ha-mockhome-ha-mockVerified publisher2.0.51 of 1See more

home-ha-mock home-ha-mock 2.0.5

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/smarter-project/home-ha-mock:main95ee018cf558
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

3,054
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
curl@7.88.1-10+deb12u4
no fix listed

Open the chart page →

14,629
home-security-demohome-security-demoVerified publisher2.0.121 of 3See more

home-security-demo home-security-demo 2.0.12

1 of the 3 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/smarter-project/home-ha-mock:main95ee018cf558
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

3,137
webserverhongshaoyangVerified publisher0.1.31 of 1See more

webserver hongshaoyang 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/httpd:alpine1b766f17b840
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

902
paperlesshpVerified publisher0.1.12 of 5See more

paperless hp 0.1.1

2 of the 5 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.3467097317623a
curl@8.20.0-5~bpo13+1
no fix listed
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

26,579
hydrahydraVerified publisher0.9.51 of 2See more

hydra hydra 0.9.5

1 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/smarter-project/hydra/isolated-vm:main4457b79b24cd
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

9,038
isolated-vmhydraVerified publisher0.9.41 of 1See more

isolated-vm hydra 0.9.4

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/smarter-project/hydra/isolated-vm:main4457b79b24cd
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

7,749
nginx-charthyomin-nginx0.1.01 of 1See more

nginx-chart hyomin-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
nginx-charthyun-nginx0.1.01 of 1See more

nginx-chart hyun-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
ibexaibexaVerified publisher3.11.11 of 10See more

ibexa ibexa 3.11.1

1 of the 10 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
boky/postfix:4.4.0f3f247fd4252
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

5,770
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

57,728
ibm-ucv-prodibm-helm5.2.61 of 16See more

ibm-ucv-prod ibm-helm 5.2.6

1 of the 16 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
bitnamilegacy/rabbitmq:4.1.2fac502149c40
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

11,975
nextjsicoretechVerified publisher1.2.01 of 1See more

nextjs icoretech 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

11,838
web-chartimcherry57780.1.01 of 1See more

web-chart imcherry5778 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
onechartimioVerified publisher0.76.01 of 1See more

onechart imio 0.76.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
infisical/infisical:latest02082bf13163
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

2,954
influxdb-enterpriseinfluxdata0.2.12 of 2See more

influxdb-enterprise influxdata 0.2.1

2 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/influxdb:1.12.3-meta8812029260b5
curl@7.88.1-10+deb12u14
no fix listed
library/influxdb:1.12.3-datab0f9fc41ed79
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

5,736
influxdbinfluxdb20.1.01 of 1See more

influxdb influxdb2 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/influxdb:latestf75e48af0598
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

2,237
op-stackinfradao0.0.11 of 1See more

op-stack infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
label-studioinseefrlab2.3.11 of 3See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
heartexlabs/label-studio:latestaa461572e8f9
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

3,157
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
nocodb/nocodb:latest4b760f0d2547
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

781

Container images carrying it

877 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
public.ecr.aws/jtekt-corporation/shinsei-manager-front:v1.5.5f8fb4eea4071
curl@7.88.1-10+deb12u5
no fix listed
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
curl@7.88.1-10+deb12u4
no fix listed
1
public.ecr.aws/k2x0t8t6/kubeadapt/app/kubeadapt-k8s-pulse:v3.0.1dc5a516c2333
curl@7.88.1-10+deb12u14
no fix listed
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
curl@7.88.1-10+deb12u8
no fix listed
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
curl@7.88.1-10+deb12u5
no fix listed
1
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
curl@8.19.0-r0
8.22.0-r0
1
quay.io/argoprojlabs/gitops-promoter:v0.38.19c8a510dc25e
curl@8.14.1-2+deb13u4
no fix listed
1
quay.io/deployhub/ms-nginx:svccat-v11.0.815-g717581d2d3400664e8
curl@8.17.0-r1
8.22.0-r0
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
curl@8.14.1-2+deb13u4
no fix listed
1
quay.io/groundcover/tools:20260719b705e0cbe171
curl@1:8.14.1-2+deb13u3+e1
8.14.1-2+e22
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
curl@7.88.1-10+deb12u15
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
curl@7.88.1-10+deb12u14
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
curl@7.88.1-10+deb12u14
no fix listed
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
curl@7.88.1-10+deb12u15
no fix listed
1
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
curl@8.14.1-2+deb13u2
no fix listed
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
curl@7.88.1-10+deb12u1
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
curl@8.14.1-2+deb13u2
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
curl@7.88.1-10+deb12u14
no fix listed
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.5.5-gitlab25b7636dfba3f
curl@8.14.1-2+deb13u4
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
curl@7.88.1-10+deb12u14
no fix listed
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
curl@8.20.0-r0
8.22.0-r0
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
curl@8.14.1-2
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.1.0fd9722fd02e3
curl@7.88.1-10+deb12u4
no fix listed
1
registry.k8s.io/provider-os/manila-csi-plugin:v1.36.0190976e2e2fe
curl@8.17.0-r1
8.22.0-r0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.