CVE-2026-18924
CriticalAdvisory
Published 2 Sept 2026In the index since 5 Sept 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.1
- base score, highest
- EPSS
- 0.009
- 58th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,933
- of 17,790 indexed, latest versions
- Container images
- 1,747
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
The matching OSV records carry no description.
Carried by container images the latest versions of 1,933 of 17,790 indexed charts deploy, on 1,747 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| curldeb | 1:8.14.1-2+deb13u3+e1, 7.47.0-1ubuntu2.2, 7.47.0-1ubuntu2.5, 7.47.0-1ubuntu2.6+107 more | 1:8.14.1-2+deb13u3+e2 | 1,387 |
| curlapk | 8.10.1-r0, 8.10.1-r1, 8.12.0-r1, 8.12.1-r0+10 more | 8.22.0-r0 | 360 |
- OSV records
- ALPINE-CVE-2026-18924DEBIAN-CVE-2026-18924UBUNTU-CVE-2026-18924CGA-wm55-j9f4-wjrvECHO-0181-5c6a-1eed
- Also known as
- CGA-xmww-h2xq-268q
- Trending
- Rank 28 in indexed charts, since 5 Sept 2026. See the ranking →
Charts affected
1,933 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| azure-pipelines-agentfermosit | 0.0.1 | 1 of 1See more | 14,688 |
| ferriscompanyferriscompany | 0.1.0 | 1 of 1See more | 10,119 |
| infrafibonacci-cluster-infraVerified publisher | 1.0.0 | 1 of 4See more | 12,510 |
| fineractfineract-openshift | 0.1.1 | 1 of 4See more | 7,848 |
| firefly-iiifirefly-iii | 1.10.1 | 1 of 1See more | 5,038 |
| firefly-iii-stackfirefly-iii | 0.10.2 | 2 of 4See more | 10,258 |
| importerfirefly-iii | 1.6.0 | 1 of 1See more | 4,828 |
| flask-contactsfirst-idror-chart | 1.0.1 | 1 of 3See more | 5,624 |
| business-api-ecosystemfiware | 1.1.0 | 2 of 4See more | 64,192 |
| batchrunnerflanksourceVerified publisher | 1.0.44 | 1 of 1See more | 5,340 |
| mission-controlflanksourceVerified publisher | 0.1.336 | 1 of 8See more | 8,831 |
| flask-contactsflask-contacts-generic | 1.0.1 | 1 of 3See more | 5,624 |
| flinkflink | 0.5.1 | 1 of 1See more | 5,690 |
| floriapp-mongodbfloriapp | 1.0.0 | 1 of 1See more | 8,046 |
| fluent-bit-aggregatorfluent-bit-aggregatorOfficialVerified publisher | 1.1.2 | 1 of 1See more | 896 |
| fluent-bit-collectorfluent-bit-collectorOfficialVerified publisher | 1.1.2 | 1 of 1See more | 896 |
| fluentd-aggregatorfluentd-aggregatorOfficialVerified publisher | 1.0.0 | 1 of 2See more | 1,712 |
| fluxcd-helm-upgraderfluxcd-helm-upgraderVerified publisher | 0.7.7 | 1 of 1See more | 2,420 |
| flyte-devboxflyte | 0.1.0 | 1 of 13See more | 4,629 |
| fr24feederfnzv | 0.1.2 | 1 of 1See more | 2,246 |
| mod-graphqlfolio-org | 0.1.30 | 1 of 1See more | 1,091 |
| plexfydrah-charts | 2.2.0 | 1 of 1See more | 8,971 |
| esphomegabe565Verified publisher | 0.15.0 | 1 of 1See more | 3,143 |
| monicagabe565Verified publisher | 0.10.0 | 1 of 2See more | 1,174 |
| scanservjsgabe565Verified publisher | 0.9.2 | 1 of 1See more | 13,247 |
| accumulogaffer | 2.2.1 | 1 of 4See more | 16,969 |
| gaffer-road-trafficgaffer | 2.2.1 | 1 of 8See more | 9,381 |
| garge-apigargeVerified publisher | 0.1.55 | 1 of 1See more | 1,084 |
| pagesgary-pages | 1.0.0 | 2 of 3See more | 20,233 |
| airsonicgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 18,217 |
| apache-musicindexgeek-cookbookVerified publisher | 2.4.2 | 1 of 1See more | 14,698 |
| booksonic-airgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 19,234 |
| calibre-webgeek-cookbookVerified publisher | 8.4.2 | 1 of 1See more | 16,178 |
| delugegeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 13,572 |
| double-takegeek-cookbookVerified publisher | 2.3.2 | 1 of 1See more | 12,270 |
| duplicatigeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 1,764 |
| embygeek-cookbookVerified publisher | 3.4.2 | 1 of 1See more | 8,584 |
| factoriogeek-cookbookVerified publisher | 1.2.2 | 1 of 2See more | 1,449 |
| gapsgeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 8,982 |
| haste-servergeek-cookbookVerified publisher | 3.4.2 | 1 of 1See more | 11,042 |
| icinga2geek-cookbookVerified publisher | 4.2.0 | 1 of 1See more | 9,103 |
| jackettgeek-cookbookVerified publisher | 11.7.2 | 1 of 1See more | 9,736 |
| komgageek-cookbookVerified publisher | 2.4.2 | 1 of 1See more | 12,586 |
| lancachegeek-cookbookVerified publisher | 0.6.2 | 1 of 1See more | 1,270 |
| lidarrgeek-cookbookVerified publisher | 14.2.2 | 1 of 1See more | 14,328 |
| mopidygeek-cookbookVerified publisher | 0.1.2 | 1 of 1See more | 12,993 |
| nzbgetgeek-cookbookVerified publisher | 12.4.2 | 1 of 1See more | 12,124 |
| nzbhydra2geek-cookbookVerified publisher | 10.4.2 | 1 of 1See more | 17,758 |
| openkmgeek-cookbookVerified publisher | 4.2.0 | 1 of 1See more | 28,039 |
| photoprismgeek-cookbookVerified publisher | 7.2.0 | 1 of 1See more | 19,560 |
Container images carrying it
1,747 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | d600eac6283f | curl | no fix listed | 1 |
| ghcr.io/ | 2ed0183564d7 | curl | no fix listed | 1 |
| ghcr.io/ | 853e6f105b51 | curl | no fix listed | 1 |
| ghcr.io/ | ca7dc7362968 | curl | no fix listed | 1 |
| ghcr.io/ | 443d9850a688 | curl | 8.22.0-r0 | 1 |
| ghcr.io/ | 129212faf248 | curl | 8.22.0-r0 | 1 |
| ghcr.io/ | 0e99f12bb040 | curl | no fix listed | 1 |
| ghcr.io/ | d9d796a1b846 | curl | no fix listed | 1 |
| ghcr.io/ | a058034ca006 | curl | no fix listed | 1 |
| ghcr.io/ | 896e4926e0d7 | curl | 8.22.0-r0 | 1 |
| ghcr.io/ | 8d943799621b | curl | no fix listed | 1 |
| ghcr.io/ | 726a947bb65b | curl | no fix listed | 1 |
| ghcr.io/ | 246dc2160efe | curl | no fix listed | 1 |
| ghcr.io/ | 8136c3beda7a | curl | no fix listed | 1 |
| ghcr.io/ | 40b804fce7f9 | curl | 8.22.0-r0 | 1 |
| ghcr.io/ | fce5b6fd161c | curl | 8.22.0-r0 | 1 |
| ghcr.io/ | c17978fb13dd | curl | 8.22.0-r0 | 1 |
| ghcr.io/ | 8c05f7366981 | curl | no fix listed | 1 |
| ghcr.io/ | f0363376b260 | curl | 8.22.0-r0 | 1 |
| ghcr.io/ | 272d92a59e8a | curl | 8.22.0-r0 | 1 |
| ghcr.io/ | 76771c3cc8c3 | curl | no fix listed | 1 |
| ghcr.io/ | a2be95de450c | curl | no fix listed | 1 |
| ghcr.io/ | 16fda01ae58a | curl | no fix listed | 1 |
| ghcr.io/ | a1fed512261f | curl | 8.22.0-r0 | 1 |
| ghcr.io/ | af610992a416 | curl | no fix listed | 1 |
| ghcr.io/ | 2e059589f7f7 | curl | 8.22.0-r0 | 1 |
| ghcr.io/ | f3d0c7d35498 | curl | no fix listed | 1 |
| ghcr.io/ | 609f48af4efc | curl | no fix listed | 1 |
| ghcr.io/ | d89a6d21e361 | curl | no fix listed | 1 |
| ghcr.io/ | 080150de7d86 | curl | no fix listed | 1 |
| ghcr.io/ | 3225d2bc6b3c | curl | no fix listed | 1 |
| ghcr.io/ | f53bde3acd4f | curl | no fix listed | 1 |
| ghcr.io/ | aa45adaf59a7 | curl | no fix listed | 1 |
| ghcr.io/ | bffe3c22fabc | curl | no fix listed | 1 |
| ghcr.io/ | 30b88f2a6b73 | curl | 8.22.0-r0 | 1 |
| ghcr.io/ | 0f31f8b0441b | curl | no fix listed | 1 |
| ghcr.io/ | 8ac53eb38393 | curl | no fix listed | 1 |
| ghcr.io/ | 45d8b5aab491 | curl | no fix listed | 1 |
| ghcr.io/ | a982103d91d3 | curl | no fix listed | 1 |
| ghcr.io/ | e59ebde55709 | curl | no fix listed | 1 |
| ghcr.io/ | ddcdd0f34004 | curl | 8.22.0-r0 | 1 |
| ghcr.io/ | 87f9e8a92bd7 | curl | no fix listed | 1 |
| ghcr.io/ | 7a50c07e7c69 | curl | no fix listed | 1 |
| ghcr.io/ | 6e82914e1051 | curl | no fix listed | 1 |
| ghcr.io/ | 84edfe8a67a8 | curl | 8.22.0-r0 | 1 |
| ghcr.io/ | bcd5b8d4c45c | curl | no fix listed | 1 |
| ghcr.io/ | 7e1d7a11a11a | curl | no fix listed | 1 |
| ghcr.io/ | e589db0d0a2c | curl | no fix listed | 1 |
| ghcr.io/ | 22ae556e0de4 | curl | no fix listed | 1 |
| ghcr.io/ | 8525a1a67958 | curl | no fix listed | 1 |