StackRadar

CVE-2026-19931

Critical

Advisory

Published 2 Sept 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.012
66th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,810
of 17,803 indexed, latest versions
Container images
1,625
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,810 of 17,803 indexed charts deploy, on 1,625 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.68.0-1ubuntu2.2, 7.68.0-1ubuntu2.4, 7.68.0-1ubuntu2.5+78 more1:8.22.0-1+e11,275
curlapk8.10.1-r0, 8.10.1-r1, 8.12.0-r1, 8.12.1-r0+10 more8.22.0-r0350
OSV records
ALPINE-CVE-2026-19931DEBIAN-CVE-2026-19931UBUNTU-CVE-2026-19931CGA-4wpj-77jq-67v6ECHO-5bd0-12f6-d009
Also known as
CGA-h86j-p398-8x8h

Charts affected

1,810 by stars
ChartLatestAffected imagesRadar Score
pyredispyredis-helm0.1.01 of 2See more

pyredis pyredis-helm 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
avinash263/pyredis263:latestaa2b8727f1a6
curl@7.88.1-10
no fix listed

Open the chart page →

14,648
mychartpythonweb0.1.01 of 1See more

mychart pythonweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
qichenxu4pd/pythonexample:1.0f3a8502bc21b
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

12,676
mypythonpythonweb0.1.01 of 1See more

mypython pythonweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
qichenxu4pd/pythonexample:1.0f3a8502bc21b
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

12,676
open-terminalqaoruVerified publisher0.2.41 of 1See more

open-terminal qaoru 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/open-webui/open-terminal:0.13.0-slimdec44673c865
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

2,075
unifiqaoruVerified publisher1.1.32 of 2See more

unifi qaoru 1.1.3

2 of the 2 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
library/mongo:7.0-jammy84c4a18b60a0
curl@7.81.0-1ubuntu1.27
no fix listed
linuxserver/unifi-network-application:10.6.101-ls145ccadcad5c640
curl@8.18.0-1ubuntu2.4
no fix listed

Open the chart page →

3,487
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
curl@8.14.1-2+deb13u3
no fix listed

Open the chart page →

4,515
documentdbquench-documentdbVerified publisher0.0.111 of 1See more

documentdb quench-documentdb 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/documentdbdigest-pinnedbe72db1f2865
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

151
drupalquench-drupalVerified publisher0.0.152 of 2See more

drupal quench-drupal 0.0.15

2 of the 2 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/drupaldigest-pinned1969d8357d81
curl@8.21.0-r2
8.22.0-r0
ghcr.io/quenchworks/images/mysqldigest-pinned65ea66e8db48
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

324
ingress-nginxquench-ingress-nginxVerified publisher0.0.81 of 1See more

ingress-nginx quench-ingress-nginx 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/ingress-nginxdigest-pinned0dd302223669
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

357
mongodbquench-mongodbVerified publisher0.0.131 of 1See more

mongodb quench-mongodb 0.0.13

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/mongodbdigest-pinnede540b335ce42
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

132
mysqlquench-mysqlVerified publisher0.0.141 of 1See more

mysql quench-mysql 0.0.14

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/mysqldigest-pinned65ea66e8db48
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

139
nextcloudquench-nextcloudVerified publisher0.0.121 of 2See more

nextcloud quench-nextcloud 0.0.12

1 of the 2 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/nextclouddigest-pinneda113d014a824
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

249
postgres-documentdbquench-postgres-documentdbVerified publisher0.0.111 of 1See more

postgres-documentdb quench-postgres-documentdb 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/postgres-documentdbdigest-pinnedffcc1485b970
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

151
wordpressquench-wordpressVerified publisher0.0.151 of 2See more

wordpress quench-wordpress 0.0.15

1 of the 2 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/mysqldigest-pinned65ea66e8db48
curl@8.21.0-r2
8.22.0-r0

Open the chart page →

211
cupsr2dlan-helm-chartsVerified publisher0.1.01 of 1See more

cups r2dlan-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
anujdatar/cups:25.07.01685df04a643b
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

7,847
nginx-chartrabsnginx0.1.01 of 1See more

nginx-chart rabsnginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
library/nginx:1.276784fb0834aa
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

4,454
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
curl@7.88.1-10+deb12u7
no fix listed

Open the chart page →

21,370
app-configradar-baseVerified publisher1.7.21 of 1See more

app-config radar-base 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-app-config/radar-app-config:0.6.24431db7b486b
curl@8.5.0-2ubuntu10.8
no fix listed

Open the chart page →

2,094
catalog-serverradar-baseVerified publisher0.9.31 of 1See more

catalog-server radar-base 0.9.3

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-schemas/radar-schemas-tools:0.8.16c442e8bfe6b4
curl@8.5.0-2ubuntu10.8
no fix listed

Open the chart page →

2,476
data-dashboard-backendradar-baseVerified publisher0.6.21 of 1See more

data-dashboard-backend radar-base 0.6.2

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-data-dashboard-backend/radar-data-dashboard-backend:0.2.4d1e55350923c
curl@8.5.0-2ubuntu10.8
no fix listed

Open the chart page →

2,077
management-portalradar-baseVerified publisher1.7.01 of 1See more

management-portal radar-base 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
curl@8.18.0-1ubuntu2.1
no fix listed

Open the chart page →

3,236
radar-gatewayradar-baseVerified publisher1.9.01 of 2See more

radar-gateway radar-base 1.9.0

1 of the 2 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-gateway/radar-gateway:0.9.4219d894aa7a6
curl@8.5.0-2ubuntu10.8
no fix listed

Open the chart page →

2,341
radar-integrationradar-baseVerified publisher0.9.01 of 1See more

radar-integration radar-base 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
radarbase/radar-redcapintegration:1.0.6fcd973d4796d
curl@8.5.0-2ubuntu10.6
no fix listed

Open the chart page →

2,913
radar-outputradar-baseVerified publisher1.2.101 of 1See more

radar-output radar-base 1.2.10

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-output-restructure/radar-output-restructure:3.0.67fb9c70e96a4
curl@8.5.0-2ubuntu10.8
no fix listed

Open the chart page →

2,523
radar-push-endpointradar-baseVerified publisher0.6.81 of 2See more

radar-push-endpoint radar-base 0.6.8

1 of the 2 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
radarbase/radar-push-endpoint:0.4.0e1758508e033
curl@8.5.0-2ubuntu10.6
no fix listed

Open the chart page →

3,077
radar-upload-connect-backendradar-baseVerified publisher0.9.11 of 1See more

radar-upload-connect-backend radar-base 0.9.1

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-upload-source-connector/radar-upload-connect-backend:0.6.46a04b43b8d9a
curl@8.5.0-2ubuntu10.6
no fix listed

Open the chart page →

2,591
s3-proxyradar-baseVerified publisher0.6.01 of 1See more

s3-proxy radar-base 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
andrewgaul/s3proxy:sha-85b0f987dc1d34174a5
curl@8.5.0-2ubuntu10.4
no fix listed

Open the chart page →

2,796
pagesranjinigogga1.0.01 of 3See more

pages ranjinigogga 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
curl@7.68.0-1ubuntu2.4
no fix listed

Open the chart page →

20,261
rdfoxrdfox-helm-chart0.1.22 of 2See more

rdfox rdfox-helm-chart 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
oxfordsemantic/rdfox:5.6db17910eb855
curl@7.68.0-1ubuntu2.7
no fix listed
oxfordsemantic/rdfox-init:5.6baf570ff968d
curl@7.68.0-1ubuntu2.7
no fix listed

Open the chart page →

12,910
javareact-java0.1.01 of 1See more

java react-java 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
project2team4/react:latest3ff031a08887
curl@7.68.0-1ubuntu2.7
no fix listed

Open the chart page →

15,613
sqpreadyset-sqp-nightly0.1.0-nightly.202604302 of 3See more

sqp readyset-sqp-nightly 0.1.0-nightly.20260430

2 of the 3 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
readysettech/sqp:latest588f3507280e
curl@8.5.0-2ubuntu10.6
no fix listed
readysettech/sqp-duckdb:latest67a83203ce60
curl@8.5.0-2ubuntu10.6
no fix listed

Open the chart page →

3,548
pagesrebecca-pages1.0.01 of 3See more

pages rebecca-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
curl@7.68.0-1ubuntu2.4
no fix listed

Open the chart page →

20,261
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
etherpad/etherpad:latest6020e7b57f4b
curl@8.21.0-r0
8.22.0-r0

Open the chart page →

908
sonarquberedhat-cop0.1.131 of 1See more

sonarqube redhat-cop 0.1.13

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
library/sonarqube:10.7.0-community0842dcd4c8f8
curl@7.81.0-1ubuntu1.18
no fix listed

Open the chart page →

4,258
redis-enforce-expireredis-enforce-expire1.0.01 of 1See more

redis-enforce-expire redis-enforce-expire 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
udhos/redis-enforce-expire:1.0.0615b6a7d742e
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,296
my-nginx-apprepo-for-helm-nginx-app0.1.01 of 1See more

my-nginx-app repo-for-helm-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,879
redminerestic-pvc-backupVerified publisher0.2.61 of 1See more

redmine restic-pvc-backup 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

4,304
delugeretsamedocVerified publisher26.9.01 of 1See more

deluge retsamedoc 26.9.0

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
linuxserver/deluge:2.2.09505c64720af
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

775
esphomeretsamedocVerified publisher2026.2.51 of 1See more

esphome retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
esphome/esphome:2024.3.09ab8cc88b28c
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

7,469
juicepassproxyretsamedocVerified publisher2026.2.41 of 1See more

juicepassproxy retsamedoc 2026.2.4

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
ghcr.io/juicerescue/juicepassproxy:0.5.1984dc4f19162
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

3,981
istio-helloworldrgnu1.0.12 of 2See more

istio-helloworld rgnu 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
istio/examples-helloworld-v1:latest328b237e4fb1
curl@7.88.1-10+deb12u5
no fix listed
istio/examples-helloworld-v2:latest0a7f02b2c7c9
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

9,504
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

15,770
kubewatchrobusta3.5.01 of 1See more

kubewatch robusta 3.5.0

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
robustadev/kubewatch:v2.9.00457a51e36e8
curl@8.10.1-r0
8.22.0-r0

Open the chart page →

1,855
pagesroccohiggins-pages1.0.01 of 3See more

pages roccohiggins-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
curl@7.68.0-1ubuntu2.4
no fix listed

Open the chart page →

20,261
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

9,498
reviewboardrock8sVerified publisher0.0.12 of 3See more

reviewboard rock8s 0.0.1

2 of the 3 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
beanbag/reviewboard:latest6b840f546e1c
curl@7.81.0-1ubuntu1.27
no fix listed
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

6,226
monitoringrocketchat-server0.0.171 of 9See more

monitoring rocketchat-server 0.0.17

1 of the 9 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
nginxinc/nginx-unprivileged:1.29-alpine0c79d56aee56
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

7,044
rocketchat-voiprocketchat-server0.1.01 of 1See more

rocketchat-voip rocketchat-server 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
rocketchat/freeswitch:stablecfba5c20a5cc
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

5,785
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
curl@7.88.1-10+deb12u7
no fix listed

Open the chart page →

9,743
argocd-certificate-refreshromholdings0.10.81 of 1See more

argocd-certificate-refresh romholdings 0.10.8

1 of the 1 container images this version deploys carry CVE-2026-19931.

Container imageDigestPackageFixed in
quay.io/devtron/argocd-cert-refresh:v102b6db27eaf3d
curl@7.81.0-1ubuntu1.7
no fix listed

Open the chart page →

13,159

Container images carrying it

1,625 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/go-skynet/local-ai:latestd78cd113b2bc
curl@8.5.0-2ubuntu10.11
no fix listed
1
quay.io/groundcover/tools:20260719b705e0cbe171
curl@1:8.14.1-2+deb13u3+e1
1:8.22.0-1+e1
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
curl@7.88.1-10+deb12u15
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
curl@7.88.1-10+deb12u14
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
curl@7.88.1-10+deb12u14
no fix listed
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
curl@7.88.1-10+deb12u15
no fix listed
1
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
curl@8.14.1-2+deb13u2
no fix listed
1
quay.io/shesselink81/anna-nginx:v1.31.1120c19fa8a918
curl@8.21.0-r0
8.22.0-r0
1
quay.io/shesselink81/hesselinkme-nginx:v1.31.114f43beb13fc2
curl@8.21.0-r0
8.22.0-r0
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
curl@7.88.1-10+deb12u1
no fix listed
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
curl@8.5.0-2ubuntu10.10
no fix listed
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.9b7984253b128
curl@8.18.0-1ubuntu2.4
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
curl@8.14.1-2+deb13u2
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
curl@7.88.1-10+deb12u14
no fix listed
1
registry.gitlab.com/gitlab-ci-utils/curl-jq:latestb564745b6cb0
curl@8.21.0-r0
8.22.0-r0
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.5.5-gitlab25b7636dfba3f
curl@8.14.1-2+deb13u4
no fix listed
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
curl@7.68.0-1ubuntu2.4
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
curl@7.88.1-10+deb12u14
no fix listed
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
curl@8.20.0-r0
8.22.0-r0
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
curl@8.14.1-2
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.1.0fd9722fd02e3
curl@7.88.1-10+deb12u4
no fix listed
1
registry.k8s.io/provider-os/manila-csi-plugin:v1.36.0190976e2e2fe
curl@8.17.0-r1
8.22.0-r0
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.