StackRadar

CVE-2026-13608

High

Advisory

Published 2 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.006
49th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,391
of 17,797 indexed, latest versions
Container images
1,250
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,391 of 17,797 indexed charts deploy, on 1,250 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.88.1-10, 7.88.1-10+deb12u1, 7.88.1-10+deb12u4+36 more1:8.14.1-2+deb13u3+e4899
curlapk8.10.1-r0, 8.10.1-r1, 8.12.0-r1, 8.12.1-r0+10 more8.22.0-r0351
OSV records
ALPINE-CVE-2026-13608CGA-wfwx-52wx-xm5jDEBIAN-CVE-2026-13608UBUNTU-CVE-2026-13608ECHO-f292-4a07-579c
Also known as
CGA-x99g-hxrw-x4jm

Charts affected

1,391 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

1,250 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
speckle/speckle-preview-service:2.23.14-branch.testing6.334655-b4e04ee6dee853ba74a
curl@7.88.1-10+deb12u12
no fix listed
1
speckle/speckle-preview-service:2.25.10-branch.testing6.645-b125c1e787adcb20a3a
curl@7.88.1-10+deb12u12
no fix listed
1
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
curl@7.88.1-10+deb12u6
no fix listed
1
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
curl@7.88.1-10+deb12u5
no fix listed
1
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
curl@7.88.1-10+deb12u6
no fix listed
1
sslhep/servicex_app:v1.8.51d12f943cec5
curl@8.14.1-2+deb13u4
no fix listed
1
sslhep/servicex_code_gen_atlas_xaod:v1.8.5e7aff7f97b89
curl@8.14.1-2+deb13u4
no fix listed
1
sslhep/servicex_code_gen_func_adl_uproot:v1.8.5b01b8ee966ed
curl@8.14.1-2+deb13u4
no fix listed
1
sslhep/servicex_code_gen_python:v1.8.50e4175a4e1eb
curl@8.14.1-2+deb13u4
no fix listed
1
sslhep/servicex_code_gen_raw_uproot:v1.8.5671980005c57
curl@8.14.1-2+deb13u4
no fix listed
1
sslhep/servicex_code_gen_topcp:v1.8.5596db2abdd09
curl@8.14.1-2+deb13u4
no fix listed
1
sslhep/servicex-did-finder-atlasopenmagic:v1.8.554aaf1721d03
curl@8.14.1-2+deb13u4
no fix listed
1
sslhep/servicex-did-finder-cernopendata:v1.8.52cb88ceab5bb
curl@8.14.1-2+deb13u4
no fix listed
1
sslhep/servicex-did-finder-xrootd:v1.8.5c284442b44e3
curl@8.14.1-2+deb13u4
no fix listed
1
stalwartlabs/stalwart:v0.16.1425001929f36a
curl@8.14.1-2+deb13u4
no fix listed
1
stalwartlabs/stalwart:v0.16.22388dcb75a707
curl@8.14.1-2+deb13u5
no fix listed
1
stalwartlabs/stalwart:v0.16.2074ca4f7f6885
curl@8.14.1-2+deb13u4
no fix listed
1
stardog/stardog:latest2714e5c4b3c1
curl@8.21.0-r3
8.22.0-r0
1
stashapp/stash:v0.31.1df744af5a0c9
curl@8.17.0-r1
8.22.0-r0
1
stashapp/stash-box:latesta534c8afdf39
curl@8.5.0-2ubuntu10.6
no fix listed
1
strangebee/thehive:5.8.0-1a7f7b05fba24
curl@7.88.1-10+deb12u15
no fix listed
1
structurizr/onpremises:2025.11.094b5ffb5119c8
curl@8.5.0-2ubuntu10.6
no fix listed
1
substratusai/verba:v0.4.0-baseURL261695be635eb
curl@7.88.1-10+deb12u5
no fix listed
1
supabase/logflare:latest49bfe526f1b4
curl@8.14.1-2+deb13u4
no fix listed
1
supabase/postgres:17.6.1.136f371b5f3f2ac
curl@8.19.0-r0
8.22.0-r0
1
supabase/realtime:v2.102.3aa1c92c0cf32
curl@7.88.1-10+deb12u14
no fix listed
1
supabase/realtime:v2.33.8d207e6e23ad3
curl@7.88.1-10+deb12u7
no fix listed
1
supabase/realtime:latestd3aa0c86c7b3
curl@8.14.1-2+deb13u4
no fix listed
1
supabase/studio:20241021-9f9b08326d8070c55e9
curl@7.88.1-10+deb12u7
no fix listed
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
curl@7.88.1-10+deb12u15
no fix listed
1
supabase/studio:latest94a2a9d2906e
curl@7.88.1-10+deb12u15
no fix listed
1
svtechnmaa/svtech_nagvis:v1.2.118394b08e6c3
curl@7.88.1-10+deb12u5
no fix listed
1
swaggerapi/swagger-ui:v5.32.143d9316996884
curl@8.21.0-r0
8.22.0-r0
1
swaggerapi/swagger-ui:latest9ae209e3791e
curl@8.21.0-r0
8.22.0-r0
1
syncthing/syncthing:2.1.07c60eb0ec887
curl@8.17.0-r1
8.22.0-r0
1
sysnet4admin/colosseum-cms:loge74b43c7f492
curl@7.88.1-10+deb12u12
no fix listed
1
sysnet4admin/colosseum-prm:log5802bfcd7fed
curl@7.88.1-10+deb12u12
no fix listed
1
szurubooru/client:2.5880a53ca446d
curl@8.21.0-r0
8.22.0-r0
1
tautulli/tautulli:latest670e68dd9efc
curl@8.14.1-2+deb13u4
no fix listed
1
tchiotludo/akhq:0.28.0c2824dc2ae44
curl@8.18.0-1ubuntu2.3
no fix listed
1
teknas09/bird-pod:latest12a1fa85c4aa
curl@7.88.1-10+deb12u5
no fix listed
1
temporalio/admin-tools:1.28cfde8170c92f
curl@8.17.0-r1
8.22.0-r0
1
tenureai/tenure:v1.0.285f5b222df9a5
curl@8.14.1-2+deb13u3+dhi3
no fix listed
1
themoah/klag:0.2.16610579160052
curl@8.5.0-2ubuntu10.13
no fix listed
1
theradius/loggia:0.463ba348546ec
curl@7.88.1-10+deb12u5
no fix listed
1
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
curl@8.14.1-2+deb13u2
no fix listed
1
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
curl@8.14.1-2+deb13u2
no fix listed
1
thingsboard/tbmq-integration-executor:2.4.0b5a9c1addf80
curl@8.14.1-2+deb13u4
no fix listed
1
thingsboard/tbmq-node:2.4.070661025dba5
curl@8.14.1-2+deb13u4
no fix listed
1
thongngo3301/stakefish:latesta341af5976e3
curl@7.88.1-10+deb12u1
no fix listed
1

syft 1.42.1 · advisories as of 17 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.