StackRadar

CVE-2026-13608

High

Advisory

Published 2 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.006
49th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,374
of 17,792 indexed, latest versions
Container images
1,229
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,374 of 17,792 indexed charts deploy, on 1,229 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.88.1-10, 7.88.1-10+deb12u1, 7.88.1-10+deb12u4+36 more1:8.14.1-2+deb13u3+e4878
curlapk8.10.1-r0, 8.10.1-r1, 8.12.0-r1, 8.12.1-r0+10 more8.22.0-r0351
OSV records
ALPINE-CVE-2026-13608CGA-wfwx-52wx-xm5jDEBIAN-CVE-2026-13608UBUNTU-CVE-2026-13608ECHO-f292-4a07-579c
Also known as
CGA-x99g-hxrw-x4jm

Charts affected

1,374 by stars
ChartLatestAffected imagesRadar Score
firehose-ethereumpinaxVerified publisher0.3.21 of 2See more

firehose-ethereum pinax 0.3.2

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/firehose-ethereum:v2.12.4-gethd7bdfa7b41da
curl@8.5.0-2ubuntu10.6
no fix listed

Open the chart page →

7,165
subgraph-oraclepinaxVerified publisher0.0.11 of 1See more

subgraph-oracle pinax 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/graphprotocol/availability-oracle:sha-28312fd472a25038957
curl@7.88.1-10+deb12u6
no fix listed

Open the chart page →

11,420
substreams-tier-2pinaxVerified publisher0.0.81 of 1See more

substreams-tier-2 pinax 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/firehose-ethereum:v2.12.489969b78fb07
curl@8.5.0-2ubuntu10.6
no fix listed

Open the chart page →

4,950
pingdom-operatorpingdom-operator0.0.201 of 1See more

pingdom-operator pingdom-operator 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
curl@7.88.1-10+deb12u6
no fix listed

Open the chart page →

11,996
pipekitpipekit-helmOfficialVerified publisher7.6.01 of 6See more

pipekit pipekit-helm 7.6.0

1 of the 6 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
fluent/fluent-bit:5.1.1a941bdd5ca55
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,098
web-chartpjw-ktcloudlab0.1.01 of 1See more

web-chart pjw-ktcloudlab 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
planectlplanectlVerified publisher0.7.02 of 10See more

planectl planectl 0.7.0

2 of the 10 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/node:208f693eaa7e0a
curl@7.88.1-10+deb12u14
no fix listed
quay.io/argoproj/argocd:v2.14.115fc69e31c755
curl@8.5.0-2ubuntu10.6
no fix listed

Open the chart page →

26,118
plex-media-serverplex-media-server1.9.01 of 1See more

plex-media-server plex-media-server 1.9.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
plexinc/pms-docker:1.43.3.10896-cb3ebc72d83a425ae9e13
curl@8.5.0-2ubuntu10.11
no fix listed

Open the chart page →

975
k8s-oidc-discovery-providerpnnl-miscscripts0.1.21 of 2See more

k8s-oidc-discovery-provider pnnl-miscscripts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:1.29.49dd288848f44
curl@8.14.1-2+deb13u2
no fix listed

Open the chart page →

4,284
nginx-apppnnl-miscscripts0.1.21 of 1See more

nginx-app pnnl-miscscripts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
pixiecore-simpleconfigpnnl-miscscripts0.1.51 of 1See more

pixiecore-simpleconfig pnnl-miscscripts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
pod-birdspod-birds0.1.01 of 1See more

pod-birds pod-birds 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
teknas09/bird-pod:latest12a1fa85c4aa
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

13,002
libretimepodzone-chartsVerified publisher0.4.12 of 9See more

libretime podzone-charts 0.4.1

2 of the 9 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed
ghcr.io/libretime/icecast:latest3c98b92e9535
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

11,213
static-sitepodzone-chartsVerified publisher0.1.12 of 2See more

static-site podzone-charts 0.1.1

2 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/httpd:alpine1b766f17b840
curl@8.20.0-r1
8.22.0-r0
registry.k8s.io/git-sync/git-sync:v4.1.0fd9722fd02e3
curl@7.88.1-10+deb12u4
no fix listed

Open the chart page →

6,586
agentpolyaxon2.16.43 of 4See more

agent polyaxon 2.16.4

3 of the 4 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
polyaxon/polyaxon-agent:2.16.4eca6952b20e6
curl@8.14.1-2+deb13u4
no fix listed
polyaxon/polyaxon-cli:2.16.4024ff3fa775e
curl@8.14.1-2+deb13u4
no fix listed
polyaxon/polyaxon-streams:2.16.4c186bd9834c0
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

10,254
polyaxonpolyaxon2.16.43 of 5See more

polyaxon polyaxon 2.16.4

3 of the 5 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
polyaxon/polyaxon-agent:2.16.4eca6952b20e6
curl@8.14.1-2+deb13u4
no fix listed
polyaxon/polyaxon-api:2.16.42b55c3265a90
curl@8.14.1-2+deb13u4
no fix listed
polyaxon/polyaxon-cli:2.16.4024ff3fa775e
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

13,995
quickwitportefaix-hub0.1.11 of 1See more

quickwit portefaix-hub 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
quickwit/quickwit:v0.8.1d29332bdadcc
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

3,652
port-agentport-labsVerified publisher0.8.161 of 1See more

port-agent port-labs 0.8.16

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/port-labs/port-agent:v0.8.12c92d1e223f5c
curl@1:8.14.1-2+deb13u3+e1
1:8.14.1-2+deb13u3+e4

Open the chart page →

724
prefect-agentprefectVerified publisher2024.8.301638221 of 1See more

prefect-agent prefect 2024.8.30163822

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
curl@7.88.1-10+deb12u6
no fix listed

Open the chart page →

5,513
priceapp-chartpriceapp0.1.01 of 1See more

priceapp-chart priceapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ildarmukhametzyanov/priceapp:0.115d23720a3ee
curl@7.88.1-10+deb12u1
no fix listed

Open the chart page →

8,241
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

2,761
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

3,280
wp-chartprojet-devops0.1.01 of 2See more

wp-chart projet-devops 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/wordpress:latest5a93c470ae82
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

5,270
web-chartpsb-ktcloudlab0.1.01 of 1See more

web-chart psb-ktcloudlab 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
web-chartpsg-ktcloudlab0.1.01 of 1See more

web-chart psg-ktcloudlab 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
nginx-chartpshs-nginx0.1.01 of 1See more

nginx-chart pshs-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
powerdnspuckpuck2.0.02 of 4See more

powerdns puckpuck 2.0.0

2 of the 4 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/adminer:51596436ca855
curl@8.21.0-r0
8.22.0-r0
library/postgres:18-alpined3e1620b530c
curl@8.21.0-r0
8.22.0-r0

Open the chart page →

4,643
apppvillaverdeVerified publisher0.2.61 of 1See more

app pvillaverde 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:1.31a53fc6c27208
curl@8.14.1-2+deb13u5
no fix listed

Open the chart page →

1,752
game-serverpvillaverdeVerified publisher1.0.61 of 1See more

game-server pvillaverde 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/itzg/minecraft-server:latest46919d151d39
curl@8.5.0-2ubuntu10.13
no fix listed

Open the chart page →

4,129
loki-stackpyalive-cdmswebappVerified publisher2.6.51 of 4See more

loki-stack pyalive-cdmswebapp 2.6.5

1 of the 4 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
curl@8.21.0-r0
8.22.0-r0

Open the chart page →

6,556
pyredispyredis-helm0.1.01 of 2See more

pyredis pyredis-helm 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
avinash263/pyredis263:latestaa2b8727f1a6
curl@7.88.1-10
no fix listed

Open the chart page →

14,628
mychartpythonweb0.1.01 of 1See more

mychart pythonweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
qichenxu4pd/pythonexample:1.0f3a8502bc21b
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

12,639
mypythonpythonweb0.1.01 of 1See more

mypython pythonweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
qichenxu4pd/pythonexample:1.0f3a8502bc21b
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

12,639
open-terminalqaoruVerified publisher0.2.41 of 1See more

open-terminal qaoru 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/open-webui/open-terminal:0.13.0-slimdec44673c865
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

2,055
unifiqaoruVerified publisher1.1.31 of 2See more

unifi qaoru 1.1.3

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
linuxserver/unifi-network-application:10.6.101-ls145ccadcad5c640
curl@8.18.0-1ubuntu2.4
no fix listed

Open the chart page →

3,428
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
curl@8.14.1-2+deb13u3
no fix listed

Open the chart page →

4,302
documentdbquench-documentdbVerified publisher0.0.111 of 1See more

documentdb quench-documentdb 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/documentdbdigest-pinnedbe72db1f2865
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

152
drupalquench-drupalVerified publisher0.0.152 of 2See more

drupal quench-drupal 0.0.15

2 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/drupaldigest-pinned1969d8357d81
curl@8.21.0-r2
8.22.0-r0
ghcr.io/quenchworks/images/mysqldigest-pinned65ea66e8db48
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

288
forgejoquench-forgejoVerified publisher0.0.91 of 1See more

forgejo quench-forgejo 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/forgejodigest-pinnedbad89a915768
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

157
ingress-nginxquench-ingress-nginxVerified publisher0.0.81 of 1See more

ingress-nginx quench-ingress-nginx 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/ingress-nginxdigest-pinned0dd302223669
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

346
matomoquench-matomoVerified publisher0.0.21 of 1See more

matomo quench-matomo 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/matomodigest-pinned6e2b580b0384
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

160
mongodbquench-mongodbVerified publisher0.0.131 of 1See more

mongodb quench-mongodb 0.0.13

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/mongodbdigest-pinnede540b335ce42
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

121
mysqlquench-mysqlVerified publisher0.0.141 of 1See more

mysql quench-mysql 0.0.14

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/mysqldigest-pinned65ea66e8db48
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

128
nextcloudquench-nextcloudVerified publisher0.0.121 of 2See more

nextcloud quench-nextcloud 0.0.12

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/nextclouddigest-pinneda113d014a824
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

228
postgres-documentdbquench-postgres-documentdbVerified publisher0.0.111 of 1See more

postgres-documentdb quench-postgres-documentdb 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/postgres-documentdbdigest-pinnedffcc1485b970
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

152
wordpressquench-wordpressVerified publisher0.0.142 of 2See more

wordpress quench-wordpress 0.0.14

2 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/mysqldigest-pinned65ea66e8db48
curl@8.21.0-r2
8.22.0-r0
ghcr.io/quenchworks/images/wordpressdigest-pinned35cb31c7fd2b
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

288
cupsr2dlan-helm-chartsVerified publisher0.1.01 of 1See more

cups r2dlan-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
anujdatar/cups:25.07.01685df04a643b
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

7,713
nginx-chartrabsnginx0.1.01 of 1See more

nginx-chart rabsnginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:1.276784fb0834aa
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

4,479
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
curl@7.88.1-10+deb12u7
no fix listed

Open the chart page →

21,291
app-configradar-baseVerified publisher1.7.21 of 1See more

app-config radar-base 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-app-config/radar-app-config:0.6.24431db7b486b
curl@8.5.0-2ubuntu10.8
no fix listed

Open the chart page →

2,080

Container images carrying it

1,229 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

No deployed image carries CVE-2026-13608.

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.