CVE-2026-3784

Medium

Advisory

Published 11 Mar 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.004; 35th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,134; of 17,787 indexed, latest versions
Container images: 1,067; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,134 of 17,787 indexed charts deploy, on 1,067 images.

Affected package	Affected versions	Fixed in	Images
curldeb	1:8.14.1-2+deb13u3+e1, 7.58.0-2ubuntu3.3, 7.58.0-2ubuntu3.5, 7.58.0-2ubuntu3.6+69 more	1:8.14.1-2+deb13u3+e2, 7.58.0-2ubuntu3.24+esm8, 7.68.0-1ubuntu2.25+esm3, 7.81.0-1ubuntu1.23+4 more	960
curlapk	8.12.1-r0, 8.17.0-r1, 8.18.0-r0	8.19.0-r0	107

OSV records: ALPINE-CVE-2026-3784 DEBIAN-CVE-2026-3784 UBUNTU-CVE-2026-3784 ECHO-f726-ae66-88e1
Also known as: USN-8084-1, USN-8099-1

Charts affected

1,134 by stars

Chart

Latest

Affected images

Radar Score

opencloudunxwares

0.2.3

7 of 13 See more

opencloud unxwares 0.2.3

7 of the 13 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
apache/tika :2.9.2.1-full	ae0b86d3c4d0	curl@8.5.0-2ubuntu10.1	8.5.0-2ubuntu10.8
opencloudeu/web-extensions :unzip-1.0.0	1691ad6612a3	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :draw-io-1.0.0	27cb9b952f0d	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :external-sites-1.0.0	5b176baa3694	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :importer-1.0.0	6e8b2df6c5a4	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :progress-bars-1.0.0	82f888a34440	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15
opencloudeu/web-extensions :json-viewer-1.0.0	e0ac35a9576e	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15

Open the chart page →

45,392

demo-backendv2fly

0.0.3

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	curl@7.88.1-10+deb12u1	7.88.1-10+deb12u15

Open the chart page →

14,383

scrutinyvhdirk

0.1.3

1 of 1 See more

scrutiny vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/analogj/scrutiny :master-omnibus	18689773150d	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15

Open the chart page →

4,394

unmanicvhdirk

0.1.4

1 of 1 See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
josh5/unmanic :0.2.6	4d49c4816260	curl@7.81.0-1ubuntu1.15	7.81.0-1ubuntu1.23

Open the chart page →

9,396

maybe-financevicsufer

0.2.7

1 of 3 See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15

Open the chart page →

10,801

twenty-crmvictorlane

0.0.1

1 of 3 See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	curl@7.81.0-1ubuntu1.15	7.81.0-1ubuntu1.23

Open the chart page →

13,563

pagesvictor-pages

1.0.0

2 of 3 See more

pages victor-pages 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.25+esm3
flyway/flyway :6.4.4	22d97ceb0c47	curl@7.58.0-2ubuntu3.8	7.58.0-2ubuntu3.24+esm8

Open the chart page →

20,233

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.8

Open the chart page →

7,696

api-gatewaywallarm

0.2.0

1 of 1 See more

api-gateway wallarm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
wallarm/api-gateway :0.2.0	a3d4d2f780e8	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15

Open the chart page →

2,300

kongwallarm

4.6.3

1 of 7 See more

kong wallarm 4.6.3

1 of the 7 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
wallarm/kong :3.1.0-ubuntu-4.6.0	ea9608c82e40	curl@7.68.0-1ubuntu2.18	7.68.0-1ubuntu2.25+esm3

Open the chart page →

11,444

wallarm-gatewaywallarm

0.4.0

1 of 1 See more

wallarm-gateway wallarm 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
wallarm/gateway-controller :0.4.0	9c6ed23e2f0e	curl@8.14.1-2+deb13u3	8.14.1-2+deb13u4

Open the chart page →

1,996

pageswalter

1.0.0

2 of 3 See more

pages walter 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.25+esm3
flyway/flyway :6.4.4	22d97ceb0c47	curl@7.58.0-2ubuntu3.8	7.58.0-2ubuntu3.24+esm8

Open the chart page →

20,233

sirenwateim

1.0.2

1 of 1 See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
sigp/siren :v3.0.4	2c219b04758e	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15

Open the chart page →

5,774

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3

Open the chart page →

11,167

istio-service-meshwbstack

0.0.1

1 of 1 See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
istio/pilot :1.17.1	ce9d87606701	curl@7.81.0-1ubuntu1.7	7.81.0-1ubuntu1.23

Open the chart page →

6,272

supersetwbstack

0.1.0

1 of 1 See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
apache/superset :4.0.1	ab9467fd712c	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15

Open the chart page →

6,540

wbaas-backupwbstack

0.1.0

1 of 1 See more

wbaas-backup wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/wmde/wbaas-backup :v0.1.7	8e6a9516eac0	curl@7.58.0-2ubuntu3.18	7.58.0-2ubuntu3.24+esm8

Open the chart page →

9,748

myweatherhelmwebapp1

1.3.50

1 of 8 See more

myweatherhelm webapp1 1.3.50

1 of the 8 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	curl@7.68.0-1ubuntu2.18	7.68.0-1ubuntu2.25+esm3

Open the chart page →

9,225

myweatherhelm-schedulingwebapp1

1.3.92

1 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

1 of the 9 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	curl@7.68.0-1ubuntu2.18	7.68.0-1ubuntu2.25+esm3

Open the chart page →

9,225

web-dvwaweb-dvwa

1.16.0

1 of 2 See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
gulacedia/web-dvwa-new :v3	67b467d961ca	curl@7.88.1-10	7.88.1-10+deb12u15

Open the chart page →

8,858

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
library/mongo :4.4	4be76f674fc4	curl@7.68.0-1ubuntu2.25	7.68.0-1ubuntu2.25+esm3

Open the chart page →

28,699

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	curl@7.58.0-2ubuntu3.9	7.58.0-2ubuntu3.24+esm8

Open the chart page →

10,857

giteawenerme

12.7.0

1 of 4 See more

gitea wenerme 12.7.0

1 of the 4 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
bitnamilegacy/postgresql-repmgr :17.6.0-debian-12-r2	f12387ec882b	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15

Open the chart page →

8,842

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3

Open the chart page →

15,287

wikiwikijs

3.0.0

1 of 2 See more

5,472

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	curl@7.81.0-1ubuntu1.15	7.81.0-1ubuntu1.23

Open the chart page →

9,296

keycloakwiremind

25.3.1

1 of 2 See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/wiremind/bitnami/keycloak :26.5.0-debian-12-r3	8622ea9e43c0	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15

Open the chart page →

7,643

kibanawiremind

8.5.23

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	curl@7.68.0-1ubuntu2.25	7.68.0-1ubuntu2.25+esm3

Open the chart page →

6,323

marge-botwiremind

1.4.4

1 of 1 See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
hiboxsystems/marge-bot :0.14.0	dcffb926e563	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15

Open the chart page →

5,548

rabbitmqwiremind

16.0.17

1 of 1 See more

rabbitmq wiremind 16.0.17

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
ghcr.io/wiremind/bitnami/rabbitmq :4.2.2-debian-12-r1	1572e12bc93c	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15

Open the chart page →

2,383

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.23

Open the chart page →

14,172

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15

Open the chart page →

7,685

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u15

Open the chart page →

13,197

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-3784.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	curl@8.17.0-r1	8.19.0-r0

Open the chart page →

1,571

Container images carrying it

1,067 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
dellcloud/pages :monitor	6ba7b22caacd	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.25+esm3	79
flyway/flyway :6.4.4	22d97ceb0c47	curl@7.58.0-2ubuntu3.8	7.58.0-2ubuntu3.24+esm8	79
library/mongo :5.0.6-focal	8e70544b6c76	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3	10
jellyfin/jellyfin :10.11 :10.11.11 :latest	aefb67e6a7ff	curl@8.14.1-2+deb13u3	8.14.1-2+deb13u4	7
library/kong :3.6	a42d2b4503e7	curl@7.81.0-1ubuntu1.20	7.81.0-1ubuntu1.23	7
bitnamilegacy/rabbitmq :4.1.3 :4.1.3-debian-12-r1	9e635efba431	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15	6
nginxinc/nginx-unprivileged :1.29-alpine	0c79d56aee56	curl@8.17.0-r1	8.19.0-r0	6
quay.io/devtron/devtron-utils :dup-chart-repo-v1.1.0	95d6f0e05636	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u15	6
bitnamilegacy/kubectl :1.29.2	c74b703deed2	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15	5
flaresolverr/flaresolverr :latest :v3.5.0	139dfee1c6f8	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	5
library/mongo :4.4	4be76f674fc4	curl@7.68.0-1ubuntu2.25	7.68.0-1ubuntu2.25+esm3	5
registry.k8s.io/ingress-nginx/controller :v1.15.1	594ceea76b01	curl@8.17.0-r1	8.19.0-r0	5
bitnamilegacy/rabbitmq :4.1.2 :4.1.2-debian-12-r1	fac502149c40	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15	4
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	curl@7.81.0-1ubuntu1.15	7.81.0-1ubuntu1.23	4
library/mongo :5.0-focal	5e15a3f014ed	curl@7.68.0-1ubuntu2.25	7.68.0-1ubuntu2.25+esm3	4
library/mongo :4.2.12-bionic	628741415fc9	curl@7.58.0-2ubuntu3.12	7.58.0-2ubuntu3.24+esm8	4
library/mongo :4.4.6	6efa05203990	curl@7.58.0-2ubuntu3.13	7.58.0-2ubuntu3.24+esm8	4
library/nginx :1.27.1	287ff321f9e3	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u15	4
mastercloudapps/planner :v1.23	40a950b311b2	curl@7.81.0-1ubuntu1.8	7.81.0-1ubuntu1.23	4
oscarsotosanchez/weatherservice :v1.0	911ec961d10b	curl@7.58.0-2ubuntu3.12	7.58.0-2ubuntu3.24+esm8	4
bitnamilegacy/kubectl :latest	cd354d5b2556	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15	3
bitnamilegacy/os-shell :12-debian-12-r51	77e65e9d633e	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15	3
cloudve/cloudlaunch-server :latest	4a3d7fae90bb	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3	3
codeurjc/planner :v1.0	800cf520c245	curl@7.81.0-1ubuntu1.8	7.81.0-1ubuntu1.23	3
dgraph/dgraph :v21.12.0	3b55ea83fffe	curl@7.68.0-1ubuntu2.6	7.68.0-1ubuntu2.25+esm3	3
gchq/hdfs :3.3.3	5ec58edbb2db	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.8	3
guacamole/guacamole :1.6.0	f344085e618b	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.8	3
jacobalberty/unifi :v10.0.162	896c0ab82d33	curl@7.68.0-1ubuntu2.25	7.68.0-1ubuntu2.25+esm3	3
library/nginx :1.25 :1.25.5	a484819eb602	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15	3
selenium/hub :3.141.59	02f251d48d5f	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm3	3
xenondb/percona :5.7.33	0e26872a2b67	curl@7.68.0-1ubuntu2.5	7.68.0-1ubuntu2.25+esm3	3
ghcr.io/conductionnl/gateway-ui :stag	6a5594b7b32c	curl@7.88.1-10	7.88.1-10+deb12u15	3
quay.io/devtron/ai-agent :0.0.1	6545dac92173	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u15	3
quay.io/devtron/argocd-cert-refresh :v10	2b6db27eaf3d	curl@7.81.0-1ubuntu1.7	7.81.0-1ubuntu1.23	3
quay.io/devtron/k8s-utils :807ca3c2-488-14005	f296c2ec5db7	curl@7.81.0-1ubuntu1.10	7.81.0-1ubuntu1.23	3
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	3
quay.io/jupyterhub/configurable-http-proxy :5.2.0	522738d5285e	curl@8.17.0-r1	8.19.0-r0	3
alpine/k8s :1.32.12	048f8d9c8cc7	curl@8.18.0-r0	8.19.0-r0	2
alpine/kubectl :1.35.4	9ccd82364762	curl@8.17.0-r1	8.19.0-r0	2
alpine/kubectl :1.35.2	ec8f734b0a10	curl@8.17.0-r1	8.19.0-r0	2
apache/nifi-registry :1.26.0	7cdfd8deec92	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.23	2
apache/rocketmq :5.4.0	319cd8a81ed1	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.8	2
apache/tika :2.9.2.1-full	ae0b86d3c4d0	curl@8.5.0-2ubuntu10.1	8.5.0-2ubuntu10.8	2
bitnamilegacy/elasticsearch :9.1.2-debian-12-r0	00176a47afa0	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15	2
bitnamilegacy/postgresql-repmgr :17.6.0-debian-12-r2	f12387ec882b	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15	2
cfssl/cfssl :latest :v1.6.5	c9018c2ddf0b	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15	2
clamav/clamav :1.4.3_base	629a3050df6a	curl@8.17.0-r1	8.19.0-r0	2
dunglas/mercure :v0 :v0.24.2	916834e49961	curl@8.17.0-r1	8.19.0-r0	2
eqalpha/keydb :latest	6537505c4235	curl@7.68.0-1ubuntu2.20	7.68.0-1ubuntu2.25+esm3	2
eqalpha/keydb :x86_64_v6.3.4	eceb1806730c	curl@7.68.0-1ubuntu2.20	7.68.0-1ubuntu2.25+esm3	2