StackRadar

CVE-2026-13608

High

Advisory

Published 2 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.006
49th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,397
of 17,790 indexed, latest versions
Container images
1,266
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,397 of 17,790 indexed charts deploy, on 1,266 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.88.1-10, 7.88.1-10+deb12u1, 7.88.1-10+deb12u4+36 more1:8.14.1-2+deb13u3+e4906
curlapk8.10.1-r0, 8.10.1-r1, 8.12.0-r1, 8.12.1-r0+10 more8.22.0-r0360
OSV records
ALPINE-CVE-2026-13608CGA-wfwx-52wx-xm5jDEBIAN-CVE-2026-13608UBUNTU-CVE-2026-13608ECHO-f292-4a07-579c
Also known as
CGA-x99g-hxrw-x4jm

Charts affected

1,397 by stars
ChartLatestAffected imagesRadar Score
netboxhelmforgeVerified publisher2.0.11 of 4See more

netbox helmforge 2.0.1

1 of the 4 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v4.6.10-5.0.291b823a05cb5
curl@8.18.0-1ubuntu2.3
no fix listed

Open the chart page →

4,347
nextcloudhelmforgeVerified publisher1.0.01 of 3See more

nextcloud helmforge 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nextcloud:34.0.4-apachede4ad9389386
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

7,211
opencloudhelmforgeVerified publisher1.0.01 of 1See more

opencloud helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
opencloudeu/opencloud:7.2.46d992ccc5f1c
curl@8.21.0-r0
8.22.0-r0

Open the chart page →

670
openreel-videohelmforgeVerified publisher1.0.31 of 1See more

openreel-video helmforge 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
helmforge/openreel-video:v0.5.07ba0d47b943f
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,086
phpmyadminhelmforgeVerified publisher2.0.11 of 1See more

phpmyadmin helmforge 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
phpmyadmin/phpmyadmin:5.2.342a200db07b4
curl@8.14.1-2
no fix listed

Open the chart page →

4,819
pimcorehelmforgeVerified publisher2.0.11 of 6See more

pimcore helmforge 2.0.1

1 of the 6 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
dunglas/mercure:v0.24.2916834e49961
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

3,212
poznotehelmforgeVerified publisher2.0.31 of 1See more

poznote helmforge 2.0.3

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/timothepoznanski/poznote:6.86.0182664fe1ca0
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

483
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

6,068
strapihelmforgeVerified publisher2.3.141 of 3See more

strapi helmforge 2.3.14

1 of the 3 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.270e9143d6d92
curl@8.21.0-r0
8.22.0-r0

Open the chart page →

2,084
strava-statisticshelmforgeVerified publisher1.1.161 of 2See more

strava-statistics helmforge 1.1.16

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
robiningelbrecht/strava-statistics:v5.0.040842cdfd616
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

853
supersethelmforgeVerified publisher1.3.61 of 5See more

superset helmforge 1.3.6

1 of the 5 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

5,784
text-embeddings-inferencehelmforgeVerified publisher1.0.01 of 2See more

text-embeddings-inference helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/huggingface/text-embeddings-inference:cpu-1.9.3ad950d30878e
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

2,563
tomcathelmforgeVerified publisher1.0.61 of 2See more

tomcat helmforge 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/tomcat:11.0.25-jdk17-temurin-noble9e1d2afa6898
curl@8.5.0-2ubuntu10.12
no fix listed

Open the chart page →

1,253
twentyhelmforgeVerified publisher1.0.11 of 5See more

twenty helmforge 1.0.1

1 of the 5 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.40.06e3b2e68ad78
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

3,649
uptime-kumahelmforgeVerified publisher1.5.131 of 1See more

uptime-kuma helmforge 1.5.13

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

30,326
myapphelmingapp0.1.01 of 1See more

myapp helmingapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
muhammedgamal/fp23:latest74b4cd69b6fa
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

12,680
jellyfinhelm-l3st86Verified publisher0.1.81 of 1See more

jellyfin helm-l3st86 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
jellyfin/jellyfin:latestaefb67e6a7ff
curl@8.14.1-2+deb13u3
no fix listed

Open the chart page →

2,626
openaevhelm-openbasVerified publisher2.0.53 of 7See more

openaev helm-openbas 2.0.5

3 of the 7 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
bitnamilegacy/rabbitmq:4.1.2-debian-12-r1fac502149c40
curl@7.88.1-10+deb12u12
no fix listed
openaev/platform:3.260904.00a12ce8b3db9
curl@8.5.0-2ubuntu10.12
no fix listed
rustfs/rustfs:1.0.0-beta.1241fe89380f41
curl@8.21.0-r0
8.22.0-r0

Open the chart page →

7,528
openbashelm-openbasVerified publisher1.8.143 of 7See more

openbas helm-openbas 1.8.14

3 of the 7 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
bitnamilegacy/rabbitmq:4.1.2-debian-12-r1fac502149c40
curl@7.88.1-10+deb12u12
no fix listed
openbas/caldera-server:5.1.0a277796d9724
curl@7.88.1-10+deb12u8
no fix listed
openbas/platform:2.0.5d986d80b0a75
curl@8.5.0-2ubuntu10.6
no fix listed

Open the chart page →

25,190
release-cleanerhelm-release-cleanerVerified publisher1.0.01 of 1See more

release-cleaner helm-release-cleaner 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
alpine/helm:4.1.0905a068da431
curl@8.18.0-r0
8.22.0-r0

Open the chart page →

2,001
steampipehelm-steampipeVerified publisher2.4.11 of 1See more

steampipe helm-steampipe 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/steampipe:v2.4.1a982103d91d3
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

3,154
my-nginxhelmtaiwo0.1.01 of 1See more

my-nginx helmtaiwo 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
samplehelmapphelmtraining3.0.01 of 1See more

samplehelmapp helmtraining 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
praravind1801/helmimages:3.0.0f29d637b9ce1
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

5,996
home-ha-mockhome-ha-mockVerified publisher2.0.51 of 1See more

home-ha-mock home-ha-mock 2.0.5

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/smarter-project/home-ha-mock:main95ee018cf558
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

3,065
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
curl@7.88.1-10+deb12u4
no fix listed

Open the chart page →

16,415
home-security-demohome-security-demoVerified publisher2.0.121 of 3See more

home-security-demo home-security-demo 2.0.12

1 of the 3 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/smarter-project/home-ha-mock:main95ee018cf558
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

3,148
webserverhongshaoyangVerified publisher0.1.31 of 1See more

webserver hongshaoyang 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/httpd:alpine1b766f17b840
curl@8.20.0-r1
8.22.0-r0

Open the chart page →

902
paperlesshpVerified publisher0.1.22 of 5See more

paperless hp 0.1.2

2 of the 5 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.3467097317623a
curl@8.20.0-5~bpo13+1
no fix listed
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

26,984
hydrahydraVerified publisher0.9.51 of 2See more

hydra hydra 0.9.5

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/smarter-project/hydra/isolated-vm:main4457b79b24cd
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

9,084
isolated-vmhydraVerified publisher0.9.41 of 1See more

isolated-vm hydra 0.9.4

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/smarter-project/hydra/isolated-vm:main4457b79b24cd
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

7,785
nginx-charthyomin-nginx0.1.01 of 1See more

nginx-chart hyomin-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
nginx-charthyun-nginx0.1.01 of 1See more

nginx-chart hyun-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
ibexaibexaVerified publisher3.11.11 of 10See more

ibexa ibexa 3.11.1

1 of the 10 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
boky/postfix:4.4.0f3f247fd4252
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

5,986
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

57,759
ibm-ucv-prodibm-helm5.2.61 of 16See more

ibm-ucv-prod ibm-helm 5.2.6

1 of the 16 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
bitnamilegacy/rabbitmq:4.1.2fac502149c40
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

12,161
browserlessicoretechVerified publisher0.16.61 of 1See more

browserless icoretech 0.16.6

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
curl@8.5.0-2ubuntu10.13
no fix listed

Open the chart page →

2,007
multicaicoretechVerified publisher0.4.431 of 5See more

multica icoretech 0.4.43

1 of the 5 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/postgres:18-alpined3e1620b530c
curl@8.21.0-r0
8.22.0-r0

Open the chart page →

2,591
nextjsicoretechVerified publisher1.2.01 of 1See more

nextjs icoretech 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
arunvelsriram/utils:latest655ad18fd8d6
curl@8.5.0-2ubuntu10.6
no fix listed

Open the chart page →

9,038
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

11,885
web-chartimcherry57780.1.01 of 1See more

web-chart imcherry5778 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
onechartimioVerified publisher0.76.01 of 1See more

onechart imio 0.76.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
infisical/infisical:latest02082bf13163
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

3,042
influxdb3-coreinfluxdata0.1.11 of 1See more

influxdb3-core influxdata 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/influxdb:3.10.5-core695a8063ff10
curl@8.5.0-2ubuntu10.11
no fix listed

Open the chart page →

850
influxdb3-enterpriseinfluxdata0.11.11 of 1See more

influxdb3-enterprise influxdata 0.11.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/influxdb:3.11.2-enterprise6ce2bf22499b
curl@8.5.0-2ubuntu10.12
no fix listed

Open the chart page →

831
influxdb-enterpriseinfluxdata0.2.12 of 2See more

influxdb-enterprise influxdata 0.2.1

2 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/influxdb:1.12.3-meta8812029260b5
curl@7.88.1-10+deb12u14
no fix listed
library/influxdb:1.12.3-datab0f9fc41ed79
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

5,980
influxdbinfluxdb20.1.01 of 1See more

influxdb influxdb2 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/influxdb:latestf75e48af0598
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

2,357
op-stackinfradao0.0.11 of 1See more

op-stack infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
label-studioinseefrlab2.3.11 of 3See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
heartexlabs/label-studio:latestaa461572e8f9
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

3,157
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
nocodb/nocodb:latest4b760f0d2547
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

781

Container images carrying it

1,266 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/shesselink81/hesselinkme-nginx:v1.31.114f43beb13fc2
curl@8.21.0-r0
8.22.0-r0
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
curl@7.88.1-10+deb12u1
no fix listed
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
curl@8.5.0-2ubuntu10.10
no fix listed
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.9b7984253b128
curl@8.18.0-1ubuntu2.4
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
curl@8.14.1-2+deb13u2
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
curl@7.88.1-10+deb12u14
no fix listed
1
registry.gitlab.com/gitlab-ci-utils/curl-jq:latestb564745b6cb0
curl@8.21.0-r0
8.22.0-r0
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.5.5-gitlab25b7636dfba3f
curl@8.14.1-2+deb13u4
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
curl@7.88.1-10+deb12u14
no fix listed
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
curl@8.20.0-r0
8.22.0-r0
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
curl@8.14.1-2
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.1.0fd9722fd02e3
curl@7.88.1-10+deb12u4
no fix listed
1
registry.k8s.io/provider-os/manila-csi-plugin:v1.36.0190976e2e2fe
curl@8.17.0-r1
8.22.0-r0
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.