CVE-2026-3784

Medium

Advisory

Published 11 Mar 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.004; 35th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,134; of 17,787 indexed, latest versions
Container images: 1,067; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,134 of 17,787 indexed charts deploy, on 1,067 images.

Affected package	Affected versions	Fixed in	Images
curldeb	1:8.14.1-2+deb13u3+e1, 7.58.0-2ubuntu3.3, 7.58.0-2ubuntu3.5, 7.58.0-2ubuntu3.6+69 more	1:8.14.1-2+deb13u3+e2, 7.58.0-2ubuntu3.24+esm8, 7.68.0-1ubuntu2.25+esm3, 7.81.0-1ubuntu1.23+4 more	960
curlapk	8.12.1-r0, 8.17.0-r1, 8.18.0-r0	8.19.0-r0	107

OSV records: ALPINE-CVE-2026-3784 DEBIAN-CVE-2026-3784 UBUNTU-CVE-2026-3784 ECHO-f726-ae66-88e1
Also known as: USN-8084-1, USN-8099-1

Charts affected

1,134 by stars

Chart

Latest

Affected images

Radar Score

opencloudunxwares

0.2.3

7 of 13 See more

opencloud unxwares 0.2.3

7 of the 13 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
apache/tika :2.9.2.1-full	ae0b86d3c4d0	curl@8.5.0-2ubuntu10.1	8.5.0-2ubuntu10.8
opencloudeu/web-extensions :unzip-1.0.0	1691ad6612a3	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :draw-io-1.0.0	27cb9b952f0d	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :external-sites-1.0.0	5b176baa3694	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :importer-1.0.0	6e8b2df6c5a4	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :progress-bars-1.0.0	82f888a34440	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :json-viewer-1.0.0	e0ac35a9576e	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15

Open the chart page →

45,392

demo-backendv2fly

0.0.3

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	curl@7.88.1-10+deb12u1	7.88.1-10+deb12u15

Open the chart page →

14,383

scrutinyvhdirk

0.1.3

1 of 1 See more

scrutiny vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/analogj/scrutiny :master-omnibus	18689773150d	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15

Open the chart page →

4,394

unmanicvhdirk

0.1.4

1 of 1 See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
josh5/unmanic :0.2.6	4d49c4816260	curl@7.81.0-1ubuntu1.15	7.81.0-1ubuntu1.23

Open the chart page →

9,396

maybe-financevicsufer

0.2.7

1 of 3 See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15

Open the chart page →

10,801

twenty-crmvictorlane

0.0.1

1 of 3 See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	curl@7.81.0-1ubuntu1.15	7.81.0-1ubuntu1.23

Open the chart page →

13,563

pagesvictor-pages

1.0.0

2 of 3 See more

pages victor-pages 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.25+esm3
flyway/flyway :6.4.4	22d97ceb0c47	curl@7.58.0-2ubuntu3.8	7.58.0-2ubuntu3.24+esm8

Open the chart page →

20,233

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.8

Open the chart page →

7,696

api-gatewaywallarm

0.2.0

1 of 1 See more

api-gateway wallarm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
wallarm/api-gateway :0.2.0	a3d4d2f780e8	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15

Open the chart page →

2,300

kongwallarm

4.6.3

1 of 7 See more

kong wallarm 4.6.3

1 of the 7 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
wallarm/kong :3.1.0-ubuntu-4.6.0	ea9608c82e40	curl@7.68.0-1ubuntu2.18	7.68.0-1ubuntu2.25+esm3

Open the chart page →

11,444

wallarm-gatewaywallarm

0.4.0

1 of 1 See more

wallarm-gateway wallarm 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
wallarm/gateway-controller :0.4.0	9c6ed23e2f0e	curl@8.14.1-2+deb13u3	8.14.1-2+deb13u4

Open the chart page →

1,996

pageswalter

1.0.0

2 of 3 See more

pages walter 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.25+esm3
flyway/flyway :6.4.4	22d97ceb0c47	curl@7.58.0-2ubuntu3.8	7.58.0-2ubuntu3.24+esm8

Open the chart page →

20,233

sirenwateim

1.0.2

1 of 1 See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
sigp/siren :v3.0.4	2c219b04758e	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15

Open the chart page →

5,774

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3

Open the chart page →

11,167

istio-service-meshwbstack

0.0.1

1 of 1 See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
istio/pilot :1.17.1	ce9d87606701	curl@7.81.0-1ubuntu1.7	7.81.0-1ubuntu1.23

Open the chart page →

6,272

supersetwbstack

0.1.0

1 of 1 See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
apache/superset :4.0.1	ab9467fd712c	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15

Open the chart page →

6,540

wbaas-backupwbstack

0.1.0

1 of 1 See more

wbaas-backup wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/wmde/wbaas-backup :v0.1.7	8e6a9516eac0	curl@7.58.0-2ubuntu3.18	7.58.0-2ubuntu3.24+esm8

Open the chart page →

9,748

myweatherhelmwebapp1

1.3.50

1 of 8 See more

myweatherhelm webapp1 1.3.50

1 of the 8 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	curl@7.68.0-1ubuntu2.18	7.68.0-1ubuntu2.25+esm3

Open the chart page →

9,225

myweatherhelm-schedulingwebapp1

1.3.92

1 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

1 of the 9 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	curl@7.68.0-1ubuntu2.18	7.68.0-1ubuntu2.25+esm3

Open the chart page →

9,225

web-dvwaweb-dvwa

1.16.0

1 of 2 See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
gulacedia/web-dvwa-new :v3	67b467d961ca	curl@7.88.1-10	7.88.1-10+deb12u15

Open the chart page →

8,858

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
library/mongo :4.4	4be76f674fc4	curl@7.68.0-1ubuntu2.25	7.68.0-1ubuntu2.25+esm3

Open the chart page →

28,699

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	curl@7.58.0-2ubuntu3.9	7.58.0-2ubuntu3.24+esm8

Open the chart page →

10,857

giteawenerme

12.7.0

1 of 4 See more

gitea wenerme 12.7.0

1 of the 4 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
bitnamilegacy/postgresql-repmgr :17.6.0-debian-12-r2	f12387ec882b	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15

Open the chart page →

8,842

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3

Open the chart page →

15,287

wikiwikijs

3.0.0

1 of 2 See more

5,472

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	curl@7.81.0-1ubuntu1.15	7.81.0-1ubuntu1.23

Open the chart page →

9,296

keycloakwiremind

25.3.1

1 of 2 See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/wiremind/bitnami/keycloak :26.5.0-debian-12-r3	8622ea9e43c0	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15

Open the chart page →

7,643

kibanawiremind

8.5.23

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	curl@7.68.0-1ubuntu2.25	7.68.0-1ubuntu2.25+esm3

Open the chart page →

6,323

marge-botwiremind

1.4.4

1 of 1 See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
hiboxsystems/marge-bot :0.14.0	dcffb926e563	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15

Open the chart page →

5,548

rabbitmqwiremind

16.0.17

1 of 1 See more

rabbitmq wiremind 16.0.17

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/wiremind/bitnami/rabbitmq :4.2.2-debian-12-r1	1572e12bc93c	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15

Open the chart page →

2,383

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.23

Open the chart page →

14,172

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15

Open the chart page →

7,685

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u15

Open the chart page →

13,197

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	curl@8.17.0-r1	8.19.0-r0

Open the chart page →

1,571

Container images carrying it

1,067 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ckulka/baikal :0.10.1-nginx	434bdd162247	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15	1
cloudve/ttyd :latest	d79c1c5881c0	curl@7.58.0-2ubuntu3.9	7.58.0-2ubuntu3.24+esm8	1
cm2network/squad :latest	8cba47f53df5	curl@8.14.1-2+deb13u2	8.14.1-2+deb13u4	1
collabora/code :24.04.13.2.1	01dc4ab83977	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	1
collabora/code :23.05.10.1.1	05299b452f7f	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15	1
conductoross/conductor :3.31.0	9fba127693e6	curl@8.14.1-2+deb13u3	8.14.1-2+deb13u4	1
consensys/teku :25.4.1	bf6ecd2ea716	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.8	1
contentsquareplatform/chproxy :v1.26.5	24555f22d4be	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u15	1
cortezaproject/corteza :2024.9.6	0bcdcbcd3c63	curl@7.81.0-1ubuntu1.21	7.81.0-1ubuntu1.23	1
cortezaproject/corteza :2024.9.0	8eb7a26605c9	curl@7.68.0-1ubuntu2.24	7.68.0-1ubuntu2.25+esm3	1
cortezaproject/corteza :2024.9.4	cb9f200de5d2	curl@7.81.0-1ubuntu1.20	7.81.0-1ubuntu1.23	1
cortezaproject/corteza-server-corredor :2024.9.4	4ea78dfe5364	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15	1
countly/countly-server :25.05.4	e3c238248f99	curl@7.68.0-1ubuntu2.22	7.68.0-1ubuntu2.25+esm3	1
cribl/cribl :3.0.2	762747cb6796	curl@7.58.0-2ubuntu3.13	7.58.0-2ubuntu3.24+esm8	1
cspconsole/config-provider :1.0.36	5524a26a6c23	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
cspconsole/csp-control-center :1.0.10	46dda4a31bd6	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
cspconsole/report-collector :1.0.158	39750248193b	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
cybrarist/discount-bandit :v4.0.4	e9e2447ac666	curl@8.14.1-2+deb13u2	8.14.1-2+deb13u4	1
dachichang/basic-auth-s3-nginx :1.0.0	7ccac90a935e	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u15	1
dannielkil/book-frontend :latest	937993927694	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u15	1
daskdev/dask-notebook :1.1.0	052630f5ca04	curl@7.58.0-2ubuntu3.5	7.58.0-2ubuntu3.24+esm8	1
datamate/seafile-professional :11.0.20	2dd66b722464	curl@7.81.0-1ubuntu1.20	7.81.0-1ubuntu1.23	1
dblaci/ubuntu-ssh-rsync :20231020	eea697611af4	curl@7.81.0-1ubuntu1.14	7.81.0-1ubuntu1.23	1
deconzcommunity/deconz :2.29.2	062de2362641	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	1
dellcloud/category :distributed	02fc234353a9	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.25+esm3	1
dellcloud/pages :1.0	4d2eb25b9225	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.25+esm3	1
dependencytrack/apiserver :4.14.2	1ba4f004e1ec	curl@8.14.1-2+deb13u2	8.14.1-2+deb13u4	1
dependencytrack/frontend :4.14.2	00560b57a6cf	curl@8.17.0-r1	8.19.0-r0	1
dgraph/dgraph :v24.1.4	b57fa31f9b7f	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.8	1
dgraziotin/nginx-webdav-nononsense :1.23.1	38f2de42bed0	curl@7.68.0-1ubuntu2.12	7.68.0-1ubuntu2.25+esm3	1
diygod/rsshub :2025-11-09	7a6312cac0d5	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
dniel/api-posts :master	45a667852f2a	curl@7.58.0-2ubuntu3.8	7.58.0-2ubuntu3.24+esm8	1
dobtc/bitcoin :25.1	a870f7cb1105	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u15	1
docmost/docmost :0.95.0	41c8d777cf23	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
docuseal/docuseal :2.4.1	7493fd7f6728	curl@8.17.0-r1	8.19.0-r0	1
dokuwiki/dokuwiki :2025-05-14a	f08ecfdda239	curl@8.14.1-2	8.14.1-2+deb13u4	1
dolibarr/dolibarr :22.0.4	7ad88fc9b13c	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
domainmod/domainmod :4.23.0	4017bfe4c597	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	1
dongjiang1989/lxcfs :v6.0.3	4bf9ae391948	curl@7.68.0-1ubuntu2.25	7.68.0-1ubuntu2.25+esm3	1
dragonflyoss/client :v0.1.82	edf3e921f4e0	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15	1
dremio/dremio-oss :24.1.0	80ed2e3b7c43	curl@7.81.0-1ubuntu1.10	7.81.0-1ubuntu1.23	1
drpcorg/dshackle :0.54.0	8858fae1859d	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.23	1
drumsergio/genieacs :1.2.16.0	28244054e1bf	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
dserio83/velero-api :0.3.1	6b3d9115fee2	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15	1
dserio83/velero-watchdog :0.1.8	d5deae589229	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15	1
duck1123/cert-downloader :latest	0e29f19fa67c	curl@7.81.0-1ubuntu1.13	7.81.0-1ubuntu1.23	1
duck1123/lnd-fileserver :latest	9d6fb247b714	curl@7.81.0-1ubuntu1.13	7.81.0-1ubuntu1.23	1
dunglas/mercure :v0.24.0	80fcb704a741	curl@8.17.0-r1	8.19.0-r0	1
dzikoysk/reposilite :3.5.26	4128c2d7a6ba	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.8	1
eclipseaerios/iota-messages-api :latest	e7f5ba0bc64d	curl@8.14.1-2+deb13u2	8.14.1-2+deb13u4	1