StackRadar

CVE-2026-1965

Medium

Advisory

Published 11 Mar 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
18th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,115
of 17,790 indexed, latest versions
Container images
1,043
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,115 of 17,790 indexed charts deploy, on 1,043 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.68.0-1ubuntu2.2, 7.68.0-1ubuntu2.4, 7.68.0-1ubuntu2.5+55 more1:8.14.1-2+deb13u3+e2, 7.68.0-1ubuntu2.25+esm3, 7.81.0-1ubuntu1.23, 8.5.0-2ubuntu10.8+2 more937
curlapk8.12.1-r0, 8.17.0-r1, 8.18.0-r08.19.0-r0106
OSV records
ALPINE-CVE-2026-1965DEBIAN-CVE-2026-1965UBUNTU-CVE-2026-1965ECHO-3c02-5957-bbd3
Also known as
USN-8084-1, USN-8099-1

Charts affected

1,115 by stars
ChartLatestAffected imagesRadar Score
web-dvwaweb-dvwa1.16.01 of 2See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
gulacedia/web-dvwa-new:v367b467d961ca
curl@7.88.1-10
no fix listed

Open the chart page →

10,111
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
curl@7.68.0-1ubuntu2.25
7.68.0-1ubuntu2.25+esm3

Open the chart page →

28,697
giteawenerme12.7.01 of 4See more

gitea wenerme 12.7.0

1 of the 4 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql-repmgr:17.6.0-debian-12-r2f12387ec882b
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

8,874
juicefs-csi-driverwenerme0.32.51 of 5See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.32.595008ba63318
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

9,183
longhornwenerme1.2.31 of 2See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.2.3dca34321452c
curl@7.68.0-1ubuntu2.7
7.68.0-1ubuntu2.25+esm3

Open the chart page →

15,288
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
curl@8.17.0-r1
8.19.0-r0

Open the chart page →

5,483
jaegerwikimedia3.1.21 of 4See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
curl@7.81.0-1ubuntu1.15
7.81.0-1ubuntu1.23

Open the chart page →

9,320
keycloakwiremindVerified publisher25.3.11 of 2See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

7,664
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
curl@7.68.0-1ubuntu2.25
7.68.0-1ubuntu2.25+esm3

Open the chart page →

6,326
marge-botwiremindVerified publisher1.4.41 of 1See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
hiboxsystems/marge-bot:0.14.0dcffb926e563
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

5,559
rabbitmqwiremindVerified publisher16.0.171 of 1See more

rabbitmq wiremind 16.0.17

1 of the 1 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/rabbitmq:4.2.2-debian-12-r11572e12bc93c
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

2,496
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
curl@7.81.0-1ubuntu1.16
7.81.0-1ubuntu1.23

Open the chart page →

14,173
tabbyxdVerified publisher1.0.61 of 2See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
library/nginx:1.25a484819eb602
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

7,697
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
curl@7.88.1-10+deb12u7
no fix listed

Open the chart page →

13,783
language-toolzekker6Verified publisher1.12.11 of 2See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-1965.

Container imageDigestPackageFixed in
erikvl87/languagetool:6.7-dockerupdate-3e1ea6a975388
curl@8.17.0-r1
8.19.0-r0

Open the chart page →

1,571

Container images carrying it

1,043 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
curl@8.14.1-2+deb13u2
8.14.1-2+deb13u4
1
ghcr.io/pixelfederation/unbound:1.24.2_0fce820a03964
curl@8.17.0-r1
8.19.0-r0
1
ghcr.io/platformrelay/kollect:v0.20.0c95fa31ead03
curl@7.88.1-10+deb12u15
no fix listed
1
ghcr.io/pocket-id/pocket-id:v2.7.045bdeaf3fcd6
curl@8.17.0-r1
8.19.0-r0
1
ghcr.io/port-labs/port-agent:v0.8.12c92d1e223f5c
curl@1:8.14.1-2+deb13u3+e1
1:8.14.1-2+deb13u3+e2
1
ghcr.io/pschichtel/s3-backup:0.7.017666811f6a7
curl@8.14.1-2+deb13u3
8.14.1-2+deb13u4
1
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
curl@8.14.1-2+deb13u3
8.14.1-2+deb13u4
1
ghcr.io/radar-base/radar-upload-source-connector/radar-upload-connect-backend:0.6.46a04b43b8d9a
curl@8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.8
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
curl@7.88.1-10+deb12u12
no fix listed
1
ghcr.io/reiche-world/traefik-secrets-exporter:0.0.21485ff93cbf9
curl@8.17.0-r1
8.19.0-r0
1
ghcr.io/reitermarkus/7d2d:main39953b387b61
curl@8.14.1-2+deb13u2
8.14.1-2+deb13u4
1
ghcr.io/rss-bridge/rss-bridge:latest606896116558
curl@7.88.1-10+deb12u15
no fix listed
1
ghcr.io/samr037/node-debug-dashboard:0.3.0c79b2e64a211
curl@7.88.1-10+deb12u15
no fix listed
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
curl@7.88.1-10+deb12u8
no fix listed
1
ghcr.io/sergelogvinov/mongodb:8.0.101eee8e20a87f
curl@7.88.1-10+deb12u12
no fix listed
1
ghcr.io/sergelogvinov/mongosync:1.15.0fa99ed475f03
curl@8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.8
1
ghcr.io/sergelogvinov/postgresql:16.15fafb72e98f22
curl@7.88.1-10+deb12u15
no fix listed
1
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
curl@8.14.1-2+deb13u2
8.14.1-2+deb13u4
1
ghcr.io/smarter-project/audio-client:v3.1.23c8375dc5487
curl@7.68.0-1ubuntu2.14
7.68.0-1ubuntu2.25+esm3
1
ghcr.io/smarter-project/gstreamer:v1.0.25ecb16015aa8
curl@7.68.0-1ubuntu2.14
7.68.0-1ubuntu2.25+esm3
1
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
curl@7.68.0-1ubuntu2.14
7.68.0-1ubuntu2.25+esm3
1
ghcr.io/streamingfast/firehose-core:v1.12.391fca773a63f
curl@8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.8
1
ghcr.io/streamingfast/firehose-ethereum:v2.12.489969b78fb07
curl@8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.8
1
ghcr.io/streamingfast/firehose-ethereum:v2.14.3bf816072380e
curl@8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.8
1
ghcr.io/streamingfast/firehose-ethereum:v2.12.4-gethd7bdfa7b41da
curl@8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.8
1
ghcr.io/streamingfast/go-ethereum:geth-v1.16.9-fh3.08e3cb38953a3
curl@8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.8
1
ghcr.io/streamingfast/substreams-sink-kv:v2.3.026953ec68d5d
curl@7.68.0-1ubuntu2.24
7.68.0-1ubuntu2.25+esm3
1
ghcr.io/streamingfast/substreams-sink-noop:v1.4.0d7c43c3135c6
curl@7.68.0-1ubuntu2.24
7.68.0-1ubuntu2.25+esm3
1
ghcr.io/sudo-kraken/3d-printing-cost-calculators:v1.1.1220c5e4e1a3d
curl@7.88.1-10+deb12u14
no fix listed
1
ghcr.io/sudo-kraken/authentik-webfinger-proxy:v1.1.1e1351a977607
curl@7.88.1-10+deb12u14
no fix listed
1
ghcr.io/sudo-kraken/fantasy-dice-chamber:v1.3.299fd4cb0f4fe
curl@7.88.1-10+deb12u14
no fix listed
1
ghcr.io/sudo-kraken/finances-tracker:v1.1.1c73527cde81c
curl@7.88.1-10+deb12u14
no fix listed
1
ghcr.io/sudo-kraken/jf-pushover-webhook:v1.1.0ee9cf22a39ab
curl@7.88.1-10+deb12u14
no fix listed
1
ghcr.io/theconnman/docker-hub-rss:0.6.238eba84b2be8
curl@8.17.0-r1
8.19.0-r0
1
ghcr.io/thoroslives/zilean:v3.10.1bce6aca0f6ca
curl@8.12.1-r0
8.19.0-r0
1
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
curl@8.5.0-2ubuntu10.5
8.5.0-2ubuntu10.8
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
curl@8.17.0-r1
8.19.0-r0
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
curl@8.17.0-r1
8.19.0-r0
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
curl@8.17.0-r1
8.19.0-r0
1
ghcr.io/voxpupuli/container-puppetdb:7.18.0-v1.5.0a56dfe91f5b1
curl@7.81.0-1ubuntu1.16
7.81.0-1ubuntu1.23
1
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
curl@7.81.0-1ubuntu1.16
7.81.0-1ubuntu1.23
1
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
curl@7.81.0-1ubuntu1.20
7.81.0-1ubuntu1.23
1
ghcr.io/vshn/haproxy-with-mysql:1.0.0a3c27ee3fb2f
curl@7.88.1-10+deb12u1
no fix listed
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
curl@7.88.1-10+deb12u14
no fix listed
1
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
curl@7.88.1-10+deb12u14
no fix listed
1
ghcr.io/wiremind/bitnami/rabbitmq:4.2.2-debian-12-r11572e12bc93c
curl@7.88.1-10+deb12u14
no fix listed
1
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
curl@7.88.1-10+deb12u4
no fix listed
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
curl@7.88.1-10+deb12u6
no fix listed
1
ghcr.io/wolveix/satisfactory-server:v1.9.10e0f2f8c97598
curl@7.81.0-1ubuntu1.20
7.81.0-1ubuntu1.23
1
ghcr.io/wundergraph/cosmo/otelcollector:0.18.15a6fe78d4d15
curl@7.88.1-10+deb12u8
no fix listed
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.