StackRadar

CVE-2026-13608

High

Advisory

Published 2 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.006
49th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,397
of 17,790 indexed, latest versions
Container images
1,266
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,397 of 17,790 indexed charts deploy, on 1,266 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.88.1-10, 7.88.1-10+deb12u1, 7.88.1-10+deb12u4+36 more1:8.14.1-2+deb13u3+e4906
curlapk8.10.1-r0, 8.10.1-r1, 8.12.0-r1, 8.12.1-r0+10 more8.22.0-r0360
OSV records
ALPINE-CVE-2026-13608CGA-wfwx-52wx-xm5jDEBIAN-CVE-2026-13608UBUNTU-CVE-2026-13608ECHO-f292-4a07-579c
Also known as
CGA-x99g-hxrw-x4jm

Charts affected

1,397 by stars
ChartLatestAffected imagesRadar Score
mongodb-backupsinextraVerified publisher1.1.01 of 1See more

mongodb-backup sinextra 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/mongodb:8.0.101eee8e20a87f
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

4,277
postgresql-singlesinextraVerified publisher1.15.11 of 1See more

postgresql-single sinextra 1.15.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/postgresql:16.15fafb72e98f22
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

4,937
sogosogoVerified publisher0.3.51 of 2See more

sogo sogo 0.3.5

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
sonroyaalmerol/docker-sogo:5.12.43f60f3abe990
curl@8.14.1-2+deb13u2
no fix listed

Open the chart page →

7,204
postgresql-ha-chartsoldevelo-postgresql-ha-chart16.3.41 of 2See more

postgresql-ha-chart soldevelo-postgresql-ha-chart 16.3.4

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
soldevelo/postgresql-repmgr:17.6.0-debian-12-r03eaab21e40e5
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

4,604
nginx-chartsomnath-chartVerified publisher0.1.91 of 1See more

nginx-chart somnath-chart 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
somnathmore/custom-nginx:v2bdfc06cad4ec
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

5,699
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.26.3092384dba45d
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

10,450
stardogstardog3.1.01 of 3See more

stardog stardog 3.1.0

1 of the 3 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
stardog/stardog:latest2714e5c4b3c1
curl@8.21.0-r3
8.22.0-r0

Open the chart page →

381
silverbulletstone0.10.01 of 1See more

silverbullet stone 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/silverbulletmd/silverbullet:2.10.027b5724cc367
curl@8.21.0-r0
8.22.0-r0

Open the chart page →

422
stornxstornxVerified publisher1.1.12 of 9See more

stornx stornx 1.1.1

2 of the 9 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
alazidis/stornx:1.1.1602d4f7f090c
curl@7.88.1-10+deb12u14
no fix listed
istio/pilot:1.29.1f8b0e412ac4a
curl@8.5.0-2ubuntu10.7
no fix listed

Open the chart page →

11,735
streamvisorstreamvisorVerified publisher4.1.61 of 1See more

streamvisor streamvisor 4.1.6

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
curl@8.5.0-2ubuntu10.8
no fix listed

Open the chart page →

2,881
supabasesupabse0.8.03 of 11See more

supabase supabse 0.8.0

3 of the 11 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
supabase/postgres:17.6.1.136f371b5f3f2ac
curl@8.19.0-r0
8.22.0-r0
supabase/realtime:v2.102.3aa1c92c0cf32
curl@7.88.1-10+deb12u14
no fix listed
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

18,327
app-fullsynkubeVerified publisher1.0.01 of 1See more

app-full synkube 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest6e23479198b9
curl@8.14.1-2+deb13u2
no fix listed

Open the chart page →

3,263
mumblesyntaxerror404Verified publisher1.0.41 of 1See more

mumble syntaxerror404 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/mumble-voip/mumble-server:v1.6.87002fd613b6a35
curl@8.5.0-2ubuntu10.11
no fix listed

Open the chart page →

2,143
kubedeploysysbee1.2.21 of 1See more

kubedeploy sysbee 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
ipsec-vpn-servertaskmediaVerified publisher2.2.01 of 2See more

ipsec-vpn-server taskmedia 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
hwdsl2/ipsec-vpn-server:latest2e939ffe5913
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

770
apptaxmd-helm-chart0.0.21 of 1See more

app taxmd-helm-chart 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,849
tenuretenureVerified publisher1.0.61 of 2See more

tenure tenure 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
tenureai/tenure:v1.0.285f5b222df9a5
curl@8.14.1-2+deb13u3+dhi3
no fix listed

Open the chart page →

2,563
jenkinstestchart0.1.91 of 2See more

jenkins testchart 0.1.9

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
curl@7.88.1-10+deb12u4
no fix listed

Open the chart page →

9,119
jenkinstest-jenkins9.1.01 of 2See more

jenkins test-jenkins 9.1.0

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
curl@7.88.1-10+deb12u4
no fix listed

Open the chart page →

9,119
guardrails-agent-kubernetesturbotVerified publisher0.3.01 of 1See more

guardrails-agent-kubernetes turbot 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
curl@8.5.0-2ubuntu10.5
no fix listed

Open the chart page →

4,075
espocrmtwenty20-helm-chartsVerified publisher2.0.51 of 2See more

espocrm twenty20-helm-charts 2.0.5

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
espocrm/espocrm:10.0.8-fpm-alpine4bd92daf5f0c
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

493
typemilltypemill-helm-chart2.2.02 of 2See more

typemill typemill-helm-chart 2.2.0

2 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
kixote/typemilldigest-pinned4e9dff179519
curl@8.14.1-2+deb13u4
no fix listed
kixote/typemilldigest-pinned628f79a08cc7
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

5,474
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

12,672
varnish-ingress-controllervarnish-ingress-controllerVerified publisher0.5.01 of 1See more

varnish-ingress-controller varnish-ingress-controller 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
mariusm/vingress:0.5.0b3db186c3d72
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

2,318
vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets0.0.0-main1 of 2See more

vaultwarden-kubernetes-secrets vaultwarden-kubernetes-secrets 0.0.0-main

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
curl@8.5.0-2ubuntu10.6
no fix listed

Open the chart page →

4,063
devportal-admin-uiveecode-platformVerified publisher0.5.41 of 1See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
veecode/devportal-admin-ui:0.4.30c69fd286b489
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

5,259
vite-react-app-helm-chartsvite-react-app-helm-charts1.0.01 of 1See more

vite-react-app-helm-charts vite-react-app-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/marcuwynu23/vite-app-sample:latest21247f2b97c4
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,086
waldurwaldur-chartsVerified publisher8.1.22 of 3See more

waldur waldur-charts 8.1.2

2 of the 3 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
opennode/waldur-homeport:8.1.2a8b5b4777027
curl@8.21.0-r0
8.22.0-r0
opennode/waldur-mastermind:8.1.24c82b15d9042
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

4,901
ingress-nginxwenerme4.15.11 of 2See more

ingress-nginx wenerme 4.15.1

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.15.1594ceea76b01
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,548
natswenerme2.14.61 of 3See more

nats wenerme 2.14.6

1 of the 3 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
natsio/nats-box:0.19.7ffce8bd10338
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

2,315
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

3,834
wordpress-e2e-setupwoocommerce-e2e-setup0.1.11 of 2See more

wordpress-e2e-setup woocommerce-e2e-setup 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
library/wordpress:6.8-apache30bff39330d1
curl@8.14.1-2+deb13u2
no fix listed

Open the chart page →

7,764
wordpress-helmwordpress-helm0.2.91 of 4See more

wordpress-helm wordpress-helm 0.2.9

1 of the 4 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
curl@8.14.1-2+deb13u3
no fix listed

Open the chart page →

8,320
workflows-aggregatorworkflows-aggregatorVerified publisher0.16.91 of 1See more

workflows-aggregator workflows-aggregator 0.16.9

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/workflows-aggregator:0.16.9b7984253b128
curl@8.18.0-1ubuntu2.4
no fix listed

Open the chart page →

1,358
aeneabotygdrassilOfficialVerified publisher0.2.01 of 2See more

aeneabot ygdrassil 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
elautoestopista/aeneabot:4.2.1125ba620d528
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,698
qleverzazukoVerified publisher0.7.11 of 2See more

qlever zazuko 0.7.1

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/zazukoians/qlever-server:v0.10.11de7869ab46e
curl@8.5.0-2ubuntu10.13
no fix listed

Open the chart page →

2,494
zcash-stackzcashVerified publisher0.4.51 of 2See more

zcash-stack zcash 0.4.5

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
electriccoinco/lightwalletd:v0.5.42ae3a551e111
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

2,919
opencode-serveraardbol-opencode-serverVerified publisher1.5.01 of 1See more

opencode-server aardbol-opencode-server 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/aardbol/opencode-server:v1.18.23-alpine7930061993f7
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

723
abstract-nodeabstract-nodeVerified publisher0.1.491 of 2See more

abstract-node abstract-node 0.1.49

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
matterlabs/external-node:9734bf2-17870579939295dadc06bdf3b
curl@7.88.1-10+deb12u7
no fix listed

Open the chart page →

4,577
active-mqactivemq-helm-chartVerified publisher1.8.21 of 3See more

active-mq activemq-helm-chart 1.8.2

1 of the 3 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
apache/activemq-artemis:2.44.00305c26f19ed
curl@8.5.0-2ubuntu10.6
no fix listed

Open the chart page →

3,232
jenkinsaditisingh-jenkins1.0.01 of 1See more

jenkins aditisingh-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

2,498
gobackupadnoctemVerified publisher0.4.01 of 1See more

gobackup adnoctem 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
huacnlee/gobackup:v3.1.1560be93229a5
curl@8.21.0-r0
8.22.0-r0

Open the chart page →

1,835
gotenbergadnoctemVerified publisher0.5.01 of 1See more

gotenberg adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.37.0f29984bd1e22
curl@8.21.0-2~bpo13+1
no fix listed

Open the chart page →

5,877
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

3,838
uptime-kumaadnoctemVerified publisher0.4.11 of 1See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

30,326
ahnlich-dbahnlich-dbVerified publisher0.1.11 of 1See more

ahnlich-db ahnlich-db 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
ghcr.io/deven96/ahnlich-db:latest45d8b5aab491
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,609
pod-sweeperairbyteVerified publisher1.5.11 of 1See more

pod-sweeper airbyte 1.5.1

1 of the 1 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
airbyte/pod-sweeper:1.5.198d2c39d512e
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

4,956
airbyteairbyte-v2Verified publisher2.3.01 of 10See more

airbyte airbyte-v2 2.3.0

1 of the 10 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
airbyte/manifest-server:7.28.2deec511b51c3
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

11,776
akeyless-gatewayakeyless-services-helmVerified publisher3.5.41 of 2See more

akeyless-gateway akeyless-services-helm 3.5.4

1 of the 2 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
akeyless/gateway:5.3.13d2e7dce5eb9
curl@8.5.0-2ubuntu10.13
no fix listed

Open the chart page →

1,380
aktoakto0.2.02 of 7See more

akto akto 0.2.0

2 of the 7 container images this version deploys carry CVE-2026-13608.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-dashboard:latestb53a854bd7c1
curl@8.5.0-2ubuntu10.12
no fix listed
public.ecr.aws/aktosecurity/akto-api-testing:latest97d830d5538a
curl@8.5.0-2ubuntu10.12
no fix listed

Open the chart page →

13,712

Container images carrying it

1,266 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/shesselink81/hesselinkme-nginx:v1.31.114f43beb13fc2
curl@8.21.0-r0
8.22.0-r0
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
curl@7.88.1-10+deb12u1
no fix listed
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
curl@8.5.0-2ubuntu10.10
no fix listed
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.9b7984253b128
curl@8.18.0-1ubuntu2.4
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
curl@8.14.1-2+deb13u2
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
curl@7.88.1-10+deb12u14
no fix listed
1
registry.gitlab.com/gitlab-ci-utils/curl-jq:latestb564745b6cb0
curl@8.21.0-r0
8.22.0-r0
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.5.5-gitlab25b7636dfba3f
curl@8.14.1-2+deb13u4
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
curl@7.88.1-10+deb12u14
no fix listed
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
curl@8.20.0-r0
8.22.0-r0
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
curl@8.14.1-2
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.1.0fd9722fd02e3
curl@7.88.1-10+deb12u4
no fix listed
1
registry.k8s.io/provider-os/manila-csi-plugin:v1.36.0190976e2e2fe
curl@8.17.0-r1
8.22.0-r0
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.