StackRadar

CVE-2026-19931

Critical

Advisory

Published 2 Sept 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.012
66th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,801
of 17,803 indexed, latest versions
Container images
1,611
deployed by those charts
Fix available
1 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,801 of 17,803 indexed charts deploy, on 1,611 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.68.0-1ubuntu2.2, 7.68.0-1ubuntu2.4, 7.68.0-1ubuntu2.5+78 moreno fix listed1,263
curlapk8.10.1-r0, 8.10.1-r1, 8.12.0-r1, 8.12.1-r0+10 more8.22.0-r0348
OSV records
ALPINE-CVE-2026-19931DEBIAN-CVE-2026-19931UBUNTU-CVE-2026-19931CGA-4wpj-77jq-67v6ECHO-5bd0-12f6-d009
Also known as
CGA-h86j-p398-8x8h
Trending
Rank 35 in indexed charts, since 5 Sept 2026. See the ranking →

Charts affected

1,801 by stars
ChartLatestAffected imagesRadar Score
zoo-project-druzoo-projectOfficialVerified publisher0.10.42 of 6See more

zoo-project-dru zoo-project 0.10.4

2 of the 6 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
library/postgres:18.4-alpine3.249a8afca54e78
curl@8.21.0-r0
8.22.0-r0
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
curl@7.81.0-1ubuntu1.25
no fix listed

Open the chart page →

7,936

Container images carrying it

1,611 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
gcr.io/istio-testing/operator:latest8d4576f7b98f
curl@8.5.0-2ubuntu10.1
no fix listed
1
gcr.io/ml-pipeline/metadata-writer:2.3.09bcfd2abc361
curl@7.88.1-10+deb12u7
no fix listed
1
ghcr.io/aardbol/opencode-server:v1.18.23-alpine7930061993f7
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/abcdesktopio/mongo:safe8.0c4c1938a973b
curl@8.5.0-2ubuntu10.13
no fix listed
1
ghcr.io/aeharding/voyager:latest779759172676
curl@8.14.1-2+deb13u4
no fix listed
1
ghcr.io/afairgiant/medikeep:v0.70.04c28334f3c79
curl@7.88.1-10+deb12u15
no fix listed
1
ghcr.io/alekc/samba-docker:v1.1.0cc9a028d9c43
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/alexanderwanyoike/the0/runtime:1.14.7459010a02aff
curl@8.5.0-2ubuntu10.13
no fix listed
1
ghcr.io/alexmorbo/dell_idrac_fan_controller:v0.1.6-1d110504d551d
curl@8.5.0-2ubuntu10.6
no fix listed
1
ghcr.io/analogj/scrutiny:master-omnibus18689773150d
curl@7.88.1-10+deb12u14
no fix listed
1
ghcr.io/analogj/scrutiny:v0.9.2-web71be54e99608
curl@8.14.1-2+deb13u2
no fix listed
1
ghcr.io/angelnu/tt-rss:2.0.10068d332ae2410f8
curl@8.18.0-1ubuntu2.4
no fix listed
1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
curl@8.5.0-2ubuntu10.6
no fix listed
1
ghcr.io/apache/ats-ingress:latest2d4d776f6362
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/apache/flink-kubernetes-operator:c703255e9c2ce635b89
curl@7.81.0-1ubuntu1.18
no fix listed
1
ghcr.io/appscode/cluster-ui:2.4.0f527d10769ac
curl@8.21.0-r0
8.22.0-r0
1
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
curl@8.16.0-4~bpo13+1
no fix listed
1
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
curl@7.81.0-1ubuntu1.15
no fix listed
1
ghcr.io/appscode/s3proxy:sha-a82ca6820518335f9f9
curl@7.81.0-1ubuntu1.16
no fix listed
1
ghcr.io/appscode/trivydb:0.0.367ffb0309acb
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/appscode/website:v2026.9.1170d9d1b78d39
curl@8.21.0-r0
8.22.0-r0
1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
curl@7.88.1-10+deb12u7
no fix listed
1
ghcr.io/autobrr/qui:v1.14.110b7945d4f09
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/avistotelecom/docker-wazuh-agent:4.12.08766ba08bf1a
curl@7.88.1-10+deb12u12
no fix listed
1
ghcr.io/base/node-reth:v1.1.18eb6e492fe3c
curl@8.5.0-2ubuntu10.9
no fix listed
1
ghcr.io/base-org/node:v0.11.11aba0ffe55ea
curl@7.81.0-1ubuntu1.20
no fix listed
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
curl@8.15.0-r4
8.22.0-r0
1
ghcr.io/beslovas/duckdb-ui:1.3.272f35584026d
curl@7.88.1-10+deb12u14
no fix listed
1
ghcr.io/biru-scop/tenzu-front:latest16759fa523f8
curl@8.19.0-r0
8.22.0-r0
1
ghcr.io/bitmagnet-io/bitmagnet:v0.10b6373349a301
curl@8.21.0-r0
8.22.0-r0
1
ghcr.io/brittonhayes/arma-reforger:latest6fde1edc0983
curl@7.68.0-1ubuntu2.16
no fix listed
1
ghcr.io/browserless/chrome:v2.56.7d600eac6283f
curl@8.5.0-2ubuntu10.13
no fix listed
1
ghcr.io/browserless/chromium:v2.55.42ed0183564d7
curl@8.5.0-2ubuntu10.11
no fix listed
1
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
curl@8.5.0-2ubuntu10.8
no fix listed
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
curl@7.88.1-10+deb12u6
no fix listed
1
ghcr.io/bysamio/casepack-docs:0.8.0443d9850a688
curl@8.21.0-r0
8.22.0-r0
1
ghcr.io/bysamio/casepack-spa:0.30.0129212faf248
curl@8.21.0-r0
8.22.0-r0
1
ghcr.io/camptocamp/tetragon-policy-builder:master0e99f12bb040
curl@7.88.1-10+deb12u8
no fix listed
1
ghcr.io/camunda-community-hub/zeebe-simple-monitor:2.6.2d9d796a1b846
curl@7.81.0-1ubuntu1.15
no fix listed
1
ghcr.io/caninehq/canine:latesta058034ca006
curl@7.88.1-10+deb12u15
no fix listed
1
ghcr.io/cedar2025/xboard:latest896e4926e0d7
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
curl@7.88.1-10+deb12u15
no fix listed
1
ghcr.io/cjmalloy/jasper:v1.3.282726a947bb65b
curl@7.88.1-10+deb12u15
no fix listed
1
ghcr.io/cjmalloy/jasper-ui:v1.3.623246dc2160efe
curl@8.14.1-2+deb13u4
no fix listed
1
ghcr.io/cleanuparr/cleanuparr:2.10.68136c3beda7a
curl@8.5.0-2ubuntu10.13
no fix listed
1
ghcr.io/cloudquery/cloudquery:6.40.040b804fce7f9
curl@8.21.0-r0
8.22.0-r0
1
ghcr.io/cloudscript-technology/dumpscript:v0.0.42-alpine-edgefce5b6fd161c
curl@8.19.0-r0
8.22.0-r0
1
ghcr.io/cobbler/cobbler-web:v1.1.0c17978fb13dd
curl@8.21.0-r0
8.22.0-r0
1
ghcr.io/cohdi/composable-dra-driver:v0.2.28c05f7366981
curl@8.14.1-2+deb13u3
no fix listed
1

syft 1.42.1 · advisories as of 17 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.