CVE-2026-3784

Medium

Advisory

Published 11 Mar 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.004; 35th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,134; of 17,787 indexed, latest versions
Container images: 1,067; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,134 of 17,787 indexed charts deploy, on 1,067 images.

Affected package	Affected versions	Fixed in	Images
curldeb	1:8.14.1-2+deb13u3+e1, 7.58.0-2ubuntu3.3, 7.58.0-2ubuntu3.5, 7.58.0-2ubuntu3.6+69 more	1:8.14.1-2+deb13u3+e2, 7.58.0-2ubuntu3.24+esm8, 7.68.0-1ubuntu2.25+esm3, 7.81.0-1ubuntu1.23+4 more	960
curlapk	8.12.1-r0, 8.17.0-r1, 8.18.0-r0	8.19.0-r0	107

OSV records: ALPINE-CVE-2026-3784 DEBIAN-CVE-2026-3784 UBUNTU-CVE-2026-3784 ECHO-f726-ae66-88e1
Also known as: USN-8084-1, USN-8099-1

Charts affected

1,134 by stars

Chart

Latest

Affected images

Radar Score

opencloudunxwares

0.2.3

7 of 13 See more

opencloud unxwares 0.2.3

7 of the 13 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
apache/tika :2.9.2.1-full	ae0b86d3c4d0	curl@8.5.0-2ubuntu10.1	8.5.0-2ubuntu10.8
opencloudeu/web-extensions :unzip-1.0.0	1691ad6612a3	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :draw-io-1.0.0	27cb9b952f0d	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :external-sites-1.0.0	5b176baa3694	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :importer-1.0.0	6e8b2df6c5a4	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :progress-bars-1.0.0	82f888a34440	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :json-viewer-1.0.0	e0ac35a9576e	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15

Open the chart page →

45,392

demo-backendv2fly

0.0.3

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	curl@7.88.1-10+deb12u1	7.88.1-10+deb12u15

Open the chart page →

14,383

scrutinyvhdirk

0.1.3

1 of 1 See more

scrutiny vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/analogj/scrutiny :master-omnibus	18689773150d	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15

Open the chart page →

4,394

unmanicvhdirk

0.1.4

1 of 1 See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
josh5/unmanic :0.2.6	4d49c4816260	curl@7.81.0-1ubuntu1.15	7.81.0-1ubuntu1.23

Open the chart page →

9,396

maybe-financevicsufer

0.2.7

1 of 3 See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15

Open the chart page →

10,801

twenty-crmvictorlane

0.0.1

1 of 3 See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	curl@7.81.0-1ubuntu1.15	7.81.0-1ubuntu1.23

Open the chart page →

13,563

pagesvictor-pages

1.0.0

2 of 3 See more

pages victor-pages 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.25+esm3
flyway/flyway :6.4.4	22d97ceb0c47	curl@7.58.0-2ubuntu3.8	7.58.0-2ubuntu3.24+esm8

Open the chart page →

20,233

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.8

Open the chart page →

7,696

api-gatewaywallarm

0.2.0

1 of 1 See more

api-gateway wallarm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
wallarm/api-gateway :0.2.0	a3d4d2f780e8	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15

Open the chart page →

2,300

kongwallarm

4.6.3

1 of 7 See more

kong wallarm 4.6.3

1 of the 7 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
wallarm/kong :3.1.0-ubuntu-4.6.0	ea9608c82e40	curl@7.68.0-1ubuntu2.18	7.68.0-1ubuntu2.25+esm3

Open the chart page →

11,444

wallarm-gatewaywallarm

0.4.0

1 of 1 See more

wallarm-gateway wallarm 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
wallarm/gateway-controller :0.4.0	9c6ed23e2f0e	curl@8.14.1-2+deb13u3	8.14.1-2+deb13u4

Open the chart page →

1,996

pageswalter

1.0.0

2 of 3 See more

pages walter 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.25+esm3
flyway/flyway :6.4.4	22d97ceb0c47	curl@7.58.0-2ubuntu3.8	7.58.0-2ubuntu3.24+esm8

Open the chart page →

20,233

sirenwateim

1.0.2

1 of 1 See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
sigp/siren :v3.0.4	2c219b04758e	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15

Open the chart page →

5,774

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3

Open the chart page →

11,167

istio-service-meshwbstack

0.0.1

1 of 1 See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
istio/pilot :1.17.1	ce9d87606701	curl@7.81.0-1ubuntu1.7	7.81.0-1ubuntu1.23

Open the chart page →

6,272

supersetwbstack

0.1.0

1 of 1 See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
apache/superset :4.0.1	ab9467fd712c	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15

Open the chart page →

6,540

wbaas-backupwbstack

0.1.0

1 of 1 See more

wbaas-backup wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/wmde/wbaas-backup :v0.1.7	8e6a9516eac0	curl@7.58.0-2ubuntu3.18	7.58.0-2ubuntu3.24+esm8

Open the chart page →

9,748

myweatherhelmwebapp1

1.3.50

1 of 8 See more

myweatherhelm webapp1 1.3.50

1 of the 8 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	curl@7.68.0-1ubuntu2.18	7.68.0-1ubuntu2.25+esm3

Open the chart page →

9,225

myweatherhelm-schedulingwebapp1

1.3.92

1 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

1 of the 9 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	curl@7.68.0-1ubuntu2.18	7.68.0-1ubuntu2.25+esm3

Open the chart page →

9,225

web-dvwaweb-dvwa

1.16.0

1 of 2 See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
gulacedia/web-dvwa-new :v3	67b467d961ca	curl@7.88.1-10	7.88.1-10+deb12u15

Open the chart page →

8,858

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
library/mongo :4.4	4be76f674fc4	curl@7.68.0-1ubuntu2.25	7.68.0-1ubuntu2.25+esm3

Open the chart page →

28,699

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	curl@7.58.0-2ubuntu3.9	7.58.0-2ubuntu3.24+esm8

Open the chart page →

10,857

giteawenerme

12.7.0

1 of 4 See more

gitea wenerme 12.7.0

1 of the 4 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
bitnamilegacy/postgresql-repmgr :17.6.0-debian-12-r2	f12387ec882b	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15

Open the chart page →

8,842

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3

Open the chart page →

15,287

wikiwikijs

3.0.0

1 of 2 See more

5,472

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	curl@7.81.0-1ubuntu1.15	7.81.0-1ubuntu1.23

Open the chart page →

9,296

keycloakwiremind

25.3.1

1 of 2 See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/wiremind/bitnami/keycloak :26.5.0-debian-12-r3	8622ea9e43c0	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15

Open the chart page →

7,643

kibanawiremind

8.5.23

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	curl@7.68.0-1ubuntu2.25	7.68.0-1ubuntu2.25+esm3

Open the chart page →

6,323

marge-botwiremind

1.4.4

1 of 1 See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
hiboxsystems/marge-bot :0.14.0	dcffb926e563	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15

Open the chart page →

5,548

rabbitmqwiremind

16.0.17

1 of 1 See more

rabbitmq wiremind 16.0.17

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/wiremind/bitnami/rabbitmq :4.2.2-debian-12-r1	1572e12bc93c	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15

Open the chart page →

2,383

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.23

Open the chart page →

14,172

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15

Open the chart page →

7,685

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u15

Open the chart page →

13,197

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	curl@8.17.0-r1	8.19.0-r0

Open the chart page →

1,571

Container images carrying it

1,067 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
fireflyiii/core :version-6.5.9	fe4ecec4c2ba	curl@8.14.1-2+deb13u2	8.14.1-2+deb13u4	2
fireflyiii/data-importer :version-2.2.3	ab52bf932546	curl@8.14.1-2+deb13u2	8.14.1-2+deb13u4	2
freeradius/freeradius-server :3.0.21	21c8bfa904d8	curl@7.58.0-2ubuntu3.8	7.58.0-2ubuntu3.24+esm8	2
geoservercloud/geoserver-cloud-gateway :1.0-RC3	756559ee788a	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3	2
geoservercloud/geoserver-cloud-rest :1.0-RC3	99540eef78ad	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3	2
geoservercloud/geoserver-cloud-wcs :1.0-RC3	5c254c53a357	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3	2
geoservercloud/geoserver-cloud-webui :1.0-RC3	c687b1cbc891	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3	2
geoservercloud/geoserver-cloud-wfs :1.0-RC3	5288f320cf36	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3	2
geoservercloud/geoserver-cloud-wms :1.0-RC3	a30a60ac6cd0	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3	2
gjeanmart/safe-ganache-node :latest	926264c8f2d1	curl@7.88.1-10	7.88.1-10+deb12u15	2
gradiant/ueransim :3.2.6	015b30d5fa0f	curl@7.81.0-1ubuntu1.20	7.81.0-1ubuntu1.23	2
grafana/grafana :12.3.1	2175aaa91c96	curl@8.17.0-r1	8.19.0-r0	2
grafana/grafana :12.3.3	9e1e77ade304	curl@8.17.0-r1	8.19.0-r0	2
grafana/grafana :12.4.1	e932bd6ed0e0	curl@8.17.0-r1	8.19.0-r0	2
interlayhq/interbtc :latest	a66d0e35e70f	curl@7.68.0-1ubuntu2.25	7.68.0-1ubuntu2.25+esm3	2
istio/kubectl :1.5.10	dbb7726d1bf0	curl@7.58.0-2ubuntu3.9	7.58.0-2ubuntu3.24+esm8	2
istio/proxyv2 :1.18.0	757d28c24100	curl@7.81.0-1ubuntu1.10	7.81.0-1ubuntu1.23	2
istio/proxyv2 :1.10.3	a78b7a165744	curl@7.58.0-2ubuntu3.13	7.58.0-2ubuntu3.24+esm8	2
jenkins/jenkins :2.426.1-jdk11	b470bcdc4ecd	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u15	2
jenkins/jenkins :2.541.3-jdk21	c4098086090c	curl@8.14.1-2+deb13u2	8.14.1-2+deb13u4	2
kurento/kurento-media-server :latest	03c0d34d0828	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.8	2
library/cassandra :3.11.6	5aa8400b4b3b	curl@7.58.0-2ubuntu3.9	7.58.0-2ubuntu3.24+esm8	2
library/cassandra :4.1.3	7cbcec0086ac	curl@7.81.0-1ubuntu1.15	7.81.0-1ubuntu1.23	2
library/elasticsearch :7.17.3	5e6ac15bf6a5	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3	2
library/influxdb :2.7	b8d940ca9376	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	2
library/mongo :5.0	41108d183e97	curl@7.68.0-1ubuntu2.25	7.68.0-1ubuntu2.25+esm3	2
library/mongo :4.2.3	58b25d51baa1	curl@7.58.0-2ubuntu3.8	7.58.0-2ubuntu3.24+esm8	2
library/nginx :latest	6e23479198b9	curl@8.14.1-2+deb13u2	8.14.1-2+deb13u4	2
library/nginx :1.27.0	98f8ec75657d	curl@7.88.1-10+deb12u6	7.88.1-10+deb12u15	2
library/nginx :1.29.4	9dd288848f44	curl@8.14.1-2+deb13u2	8.14.1-2+deb13u4	2
library/phpmyadmin :5.2.1	6e75aa8f767c	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	2
library/python :3.7	eedf63967cdb	curl@7.88.1-10+deb12u1	7.88.1-10+deb12u15	2
library/wordpress :6.8.3-apache :6.8-apache	30bff39330d1	curl@8.14.1-2+deb13u2	8.14.1-2+deb13u4	2
louislam/uptime-kuma :2.5.4	917318f9d7be	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	2
louislam/uptime-kuma :2.3.2	9aeb4e51d038	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	2
louislam/uptime-kuma :2.5.0	a8610b3b4c38	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	2
mesosphere/kubeaddons-catalog :v0.11.4	073db43d0b8b	curl@7.68.0-1ubuntu2.2	7.68.0-1ubuntu2.25+esm3	2
moreillon/group-manager-front :v3.3.1	c9f85db3baa5	curl@7.88.1-10+deb12u6	7.88.1-10+deb12u15	2
moreillon/user-manager :v5.0.2	e1c9bfab5c16	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u15	2
moreillon/user-manager-front :v5.0.3	b067dbbbb6af	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u15	2
obsidiandynamics/kafdrop :3.30.0	5337c9e0e2de	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3	2
opencloudeu/web-extensions :unzip-1.0.0	1691ad6612a3	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	2
opencloudeu/web-extensions :draw-io-1.0.0	27cb9b952f0d	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	2
opencloudeu/web-extensions :external-sites-1.0.0	5b176baa3694	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	2
opencloudeu/web-extensions :importer-1.0.0	6e8b2df6c5a4	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	2
opencloudeu/web-extensions :progress-bars-1.0.0	82f888a34440	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	2
opencloudeu/web-extensions :json-viewer-1.0.0	e0ac35a9576e	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	2
opendatacube/ows :latest	668cbb41473c	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.8	2
piomin/sample-spring-kotlin-microservice :1.1	871f784dd6bc	curl@7.81.0-1ubuntu1.4	7.81.0-1ubuntu1.23	2
qichenxu4pd/pythonexample :1.0	f3a8502bc21b	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15	2