StackRadar

CVE-2026-13608

High

Advisory

Published 2 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.006
49th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,397
of 17,790 indexed, latest versions
Container images
1,266
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,397 of 17,790 indexed charts deploy, on 1,266 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.88.1-10, 7.88.1-10+deb12u1, 7.88.1-10+deb12u4+36 more1:8.14.1-2+deb13u3+e4906
curlapk8.10.1-r0, 8.10.1-r1, 8.12.0-r1, 8.12.1-r0+10 more8.22.0-r0360
OSV records
ALPINE-CVE-2026-13608CGA-wfwx-52wx-xm5jDEBIAN-CVE-2026-13608UBUNTU-CVE-2026-13608ECHO-f292-4a07-579c
Also known as
CGA-x99g-hxrw-x4jm

Charts affected

1,397 by stars
ChartLatestAffected imagesRadar Score
caddy-reverse-proxydevtron0.10.11 of 1See more

caddy-reverse-proxy devtron 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/caddy:latest13ba145cba2f
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

853
devtron-enterprisedevtron48.0.03 of 28See more

devtron-enterprise devtron 48.0.0

3 of the 28 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
curl@8.5.0-2ubuntu10.11
no fix listed
quay.io/devtron/devtron-utils:dup-chart-repo-v1.1.095d6f0e05636
curl@7.88.1-10+deb12u4
no fix listed
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

68,695
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
curl@7.88.1-10+deb12u7
no fix listed

Open the chart page →

9,685
caddy-reverse-proxydevtron-labs0.10.11 of 1See more

caddy-reverse-proxy devtron-labs 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/caddy:latestdf7f1c2fb114
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

853
devtron-enterprisedevtron-labs48.0.03 of 28See more

devtron-enterprise devtron-labs 48.0.0

3 of the 28 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
curl@8.5.0-2ubuntu10.11
no fix listed
quay.io/devtron/devtron-utils:dup-chart-repo-v1.1.095d6f0e05636
curl@7.88.1-10+deb12u4
no fix listed
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

68,695
devtron-operatordevtron-labs0.23.32 of 11See more

devtron-operator devtron-labs 0.23.3

2 of the 11 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
quay.io/devtron/devtron-utils:dup-chart-repo-v1.1.095d6f0e05636
curl@7.88.1-10+deb12u4
no fix listed
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
curl@8.5.0-2ubuntu10.10
no fix listed

Open the chart page →

33,180
difydify1.0.02 of 4See more

dify dify 1.0.0

2 of the 4 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
curl@7.88.1-10+deb12u8
no fix listed
langgenius/dify-plugin-daemon:main-localda995c129e2f
curl@8.5.0-2ubuntu10.13
no fix listed

Open the chart page →

19,399
adventurelogdjjudas21Verified publisher0.1.11 of 3See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

7,501
domainmoddjjudas21Verified publisher1.0.01 of 1See more

domainmod djjudas21 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
domainmod/domainmod:4.23.04017bfe4c597
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

7,203
photoprismdjjudas21Verified publisher99.99.991 of 1See more

photoprism djjudas21 99.99.99

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
photoprism/photoprism:240711-cefc6fd632ca74
curl@8.5.0-2ubuntu10.1
no fix listed

Open the chart page →

17,053
truecommanddjjudas21Verified publisher0.1.01 of 1See more

truecommand djjudas21 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ixsystems/truecommand:3.2.019c218455cd2
curl@8.14.1-2
no fix listed

Open the chart page →

5,197
webtreesdjjudas21Verified publisher3.0.01 of 1See more

webtrees djjudas21 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
curl@8.14.1-2+deb13u3
no fix listed

Open the chart page →

5,998
wizarrdjjudas21Verified publisher0.1.51 of 1See more

wizarr djjudas21 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
curl@7.88.1-10+deb12u6
no fix listed

Open the chart page →

14,700
dnation-kubernetes-jsonnet-translatordnationcloud2.0.11 of 1See more

dnation-kubernetes-jsonnet-translator dnationcloud 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
dnationcloud/kubernetes-jsonnet-translator:2.0.178fed4f3c130
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

3,839
dnation-kubernetes-monitoringdnationcloud3.0.21 of 1See more

dnation-kubernetes-monitoring dnationcloud 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
dnationcloud/kubernetes-jsonnet-translator:2.0.178fed4f3c130
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

3,839
dnation-kubernetes-monitoring-stackdnationcloud4.0.22 of 17See more

dnation-kubernetes-monitoring-stack dnationcloud 4.0.2

2 of the 17 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
dnationcloud/kubernetes-jsonnet-translator:2.0.178fed4f3c130
curl@7.88.1-10+deb12u15
no fix listed
grafana/grafana:13.1.0121a7a9ece6d
curl@8.20.0-r1
8.22.0-r0

Open the chart page →

21,744
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-frontend:k8s8e53861be292
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

10,340
healthchecksdoubanVerified publisher1.0.101 of 2See more

healthchecks douban 1.0.10

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
healthchecks/healthchecks:latestaa08a61b0dcf
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,731
duckdb-uiduckdb-ui0.5.21 of 1See more

duckdb-ui duckdb-ui 0.5.2

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/beslovas/duckdb-ui:1.3.272f35584026d
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

4,488
postgres-backup-localduck-helm0.1.51 of 1See more

postgres-backup-local duck-helm 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
prodrigestivill/postgres-backup-local:latestf70742ebe42b
curl@8.14.1-2
no fix listed

Open the chart page →

3,479
clickhouse-monitoringduyet0.1.22 of 2See more

clickhouse-monitoring duyet 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
alpine/curl:8.21.0a1c44bab54d8
curl@8.21.0-r0
8.22.0-r0
ghcr.io/duyet/clickhouse-monitoring:latest84edfe8a67a8
curl@8.20.0-r1
8.22.0-r0

Open the chart page →

1,051
rundeckdwardu-helm-charts0.3.41 of 2See more

rundeck dwardu-helm-charts 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

19,835
arbitrumdysnixVerified publisher0.1.11 of 1See more

arbitrum dysnix 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
offchainlabs/nitro-node:v3.1.0-7d1d84ce95865866129
curl@7.88.1-10+deb12u6
no fix listed

Open the chart page →

9,273
base-consensusdysnixVerified publisher0.2.01 of 1See more

base-consensus dysnix 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/base/node-reth:v1.1.18eb6e492fe3c
curl@8.5.0-2ubuntu10.9
no fix listed

Open the chart page →

1,749
iotaeclipse-aeriosVerified publisher1.0.21 of 4See more

iota eclipse-aerios 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
eclipseaerios/iota-messages-api:lateste7f5ba0bc64d
curl@8.14.1-2+deb13u2
no fix listed

Open the chart page →

13,487
management-portaleclipse-aeriosVerified publisher1.1.01 of 2See more

management-portal eclipse-aerios 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
eclipseaerios/management-portal-frontend:1.2.23a8e4cf60629
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

3,892
redpandaeclipse-aeriosVerified publisher5.7.81 of 4See more

redpanda eclipse-aerios 5.7.8

1 of the 4 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
redpandadata/redpanda:latest468bd13a9f2b
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,595
vaultwardenedudip0.11.01 of 1See more

vaultwarden edudip 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
vaultwarden/server:1.37.1ebdfe70701c6
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

2,057
esphomeegebackVerified publisher2.0.251 of 1See more

esphome egeback 2.0.25

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
esphome/esphome:2026.7.44866347cb5b4
curl@8.14.1-2+deb13u3
no fix listed

Open the chart page →

3,189
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
curl@8.20.0-r1
8.22.0-r0

Open the chart page →

2,164
node-redegebackVerified publisher2.0.131 of 1See more

node-red egeback 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
nodered/node-red:5.0.410f40d0a83e7
curl@8.21.0-r0
8.22.0-r0

Open the chart page →

975
uptime-kumaegebackVerified publisher2.0.121 of 1See more

uptime-kuma egeback 2.0.12

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

30,217
eks-auto-pod-id-assoceks-auto-pod-id-assoc0.6.01 of 1See more

eks-auto-pod-id-assoc eks-auto-pod-id-assoc 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
udhos/eks-auto-pod-id-assoc:0.6.0196ef68af380
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

957
pgadmin4eks-storageclass0.1.01 of 2See more

pgadmin4 eks-storageclass 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
dpage/pgadmin4:latest2f4ce946ddf8
curl@8.21.0-r0
8.22.0-r0

Open the chart page →

398
kube-ecp-stackemqx-operator2.5.12 of 16See more

kube-ecp-stack emqx-operator 2.5.1

2 of the 16 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
emqx/ecp-ui:2.5.1e33e9816f147
curl@7.88.1-10+deb12u8
no fix listed
library/telegraf:1.27507a3eecf809
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

23,813
enderdash-agentenderdashVerified publisher0.1.61 of 1See more

enderdash-agent enderdash 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/enderdash-com/enderdash-agent:latest8525a1a67958
curl@8.5.0-2ubuntu10.13
no fix listed

Open the chart page →

695
kube-packetloss-exporterenixVerified publisher0.2.11 of 2See more

kube-packetloss-exporter enix 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
bitnamilegacy/kubectl:1.3164614ef8290f
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

6,165
nginx-charteoc-chartsVerified publisher2.0.01 of 1See more

nginx-chart eoc-charts 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
wordpresseoc-chartsVerified publisher0.14.41 of 1See more

wordpress eoc-charts 0.14.4

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/wordpress:6.8.3-apache30bff39330d1
curl@8.14.1-2+deb13u2
no fix listed

Open the chart page →

7,301
matomoeosc-lot-1Verified publisher0.2.01 of 1See more

matomo eosc-lot-1 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/matomo:5.1.2-apache2415789e1602
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

5,352
gerrit-operatorepmdedpVerified publisher2.25.01 of 2See more

gerrit-operator epmdedp 2.25.0

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
epamedp/edp-gerrit:3.14.249e8fe9c4855
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

1,160
espocrmespocrmVerified publisher1.0.11 of 2See more

espocrm espocrm 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
espocrm/espocrm:9.3.101b5a24504ed9
curl@8.14.1-2+deb13u3
no fix listed

Open the chart page →

6,566
assertoorethereum-helm-chartsVerified publisher1.2.01 of 1See more

assertoor ethereum-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ethpandaops/assertoor:latest1efa2fba6711
curl@8.14.1-2+deb13u3
no fix listed

Open the chart page →

2,924
benchmarkoor-uiethereum-helm-chartsVerified publisher0.1.01 of 1See more

benchmarkoor-ui ethereum-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/ethpandaops/benchmarkoor-ui:latestd090bb2060d9
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,339
powfaucetethereum-helm-chartsVerified publisher1.2.11 of 1See more

powfaucet ethereum-helm-charts 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
pk910/powfaucet:v2-stable3dcae6a62896
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

4,479
syncoor-serverethereum-helm-chartsVerified publisher0.0.11 of 1See more

syncoor-server ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/ethpandaops/syncoor:master233aa9808fc7
curl@8.21.0-r0
8.22.0-r0

Open the chart page →

961
syncoor-webethereum-helm-chartsVerified publisher0.0.11 of 1See more

syncoor-web ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/ethpandaops/syncoor-web:master60d7c38d6062
curl@8.21.0-r0
8.22.0-r0

Open the chart page →

371
tekuethereum-helm-chartsVerified publisher1.2.11 of 2See more

teku ethereum-helm-charts 1.2.1

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
consensys/teku:latest3a4f5761ae1c
curl@8.5.0-2ubuntu10.11
no fix listed

Open the chart page →

1,017
web3signerethereum-helm-chartsVerified publisher1.0.61 of 4See more

web3signer ethereum-helm-charts 1.0.6

1 of the 4 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
consensys/web3signer:latestf146a51a1ba3
curl@8.18.0-1ubuntu2.3
no fix listed

Open the chart page →

2,041
beeport-uiethersphereVerified publisher0.76.22 of 3See more

beeport-ui ethersphere 0.76.2

2 of the 3 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed
library/node:ltsbe23f54a88d3
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

7,463

Container images carrying it

1,266 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/shesselink81/hesselinkme-nginx:v1.31.114f43beb13fc2
curl@8.21.0-r0
8.22.0-r0
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
curl@7.88.1-10+deb12u1
no fix listed
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
curl@8.5.0-2ubuntu10.10
no fix listed
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.9b7984253b128
curl@8.18.0-1ubuntu2.4
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
curl@8.14.1-2+deb13u2
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
curl@7.88.1-10+deb12u14
no fix listed
1
registry.gitlab.com/gitlab-ci-utils/curl-jq:latestb564745b6cb0
curl@8.21.0-r0
8.22.0-r0
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.5.5-gitlab25b7636dfba3f
curl@8.14.1-2+deb13u4
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
curl@7.88.1-10+deb12u14
no fix listed
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
curl@8.20.0-r0
8.22.0-r0
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
curl@8.14.1-2
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.1.0fd9722fd02e3
curl@7.88.1-10+deb12u4
no fix listed
1
registry.k8s.io/provider-os/manila-csi-plugin:v1.36.0190976e2e2fe
curl@8.17.0-r1
8.22.0-r0
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.