StackRadar

CVE-2026-7009

Medium

Advisory

Published 13 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
20th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
176
of 17,781 indexed, latest versions
Container images
155
deployed by those charts
Fix available
1 of 1
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 176 of 17,781 indexed charts deploy, on 155 images.

Affected packageAffected versionsFixed inImages
curlapk8.17.0-r1, 8.18.0-r0, 8.19.0-r08.20.0-r0155
OSV records
ALPINE-CVE-2026-7009

Charts affected

176 by stars
ChartLatestAffected imagesRadar Score
etherpadschoenwald0.3.01 of 1See more

etherpad schoenwald 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
etherpad/etherpad:2.7.2b723fe5f2594
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

2,133
synapse-adminschoenwald1.0.11 of 1See more

synapse-admin schoenwald 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
awesometechnologies/synapse-admin:0.11.4a1c1f4662875
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,802
persistence-elasticsecurecodebox-persistence-elastic5.7.01 of 1See more

persistence-elastic securecodebox-persistence-elastic 5.7.0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
securecodebox/persistence-elastic-dashboard-importer:5.7.0afcefbd56d61
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

885
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

7,708
bffshortlink0.2.11 of 1See more

bff shortlink 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,690
linkshortlink0.7.31 of 1See more

link shortlink 0.7.3

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,674
link-uishortlink0.7.51 of 1See more

link-ui shortlink 0.7.5

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/ui:main9bdb1062d960
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,321
uishortlink0.7.51 of 1See more

ui shortlink 0.7.5

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/ui:main9bdb1062d960
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,321
frontendsignalen4.24.01 of 1See more

frontend signalen 4.24.0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
signalen/frontend:2.27.81ab79cb7fe21
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

1,161
ingress-nginxsoftonic4.15.11 of 2See more

ingress-nginx softonic 4.15.1

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.15.1594ceea76b01
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,547
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
grafana/grafana:12.3.2ba93c9d192e5
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

4,974
sqs-to-snssqs-to-sns2.0.151 of 1See more

sqs-to-sns sqs-to-sns 2.0.15

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
udhos/sqs-to-sns:2.0.15cf7979da82e1
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

956
hazelcaststakaterVerified publisher1.0.21 of 1See more

hazelcast stakater 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
hazelcast/hazelcast:latestf086bf0ecb23
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,702
mybbsudermanjr0.1.01 of 3See more

mybb sudermanjr 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
mybb/mybb:1.8f2a54bce31c5
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

2,157
qbittorrentsudo-kraken-qbittorrentVerified publisher5.1.51 of 2See more

qbittorrent sudo-kraken-qbittorrent 5.1.5

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/home-operations/qbittorrent:5.1.4bb82ad6668f8
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

2,129
stashswuuper-githubVerified publisher0.1.161 of 1See more

stash swuuper-github 0.1.16

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
stashapp/stash:v0.31.1df744af5a0c9
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

2,396
poscatechnostructuresVerified publisher1.0.01 of 1See more

posca technostructures 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,115
mrasiftech-thinker1.0.41 of 1See more

mrasif tech-thinker 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
mrasif/mrasif.in:v4.6.0375a1ed8fdc0
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

2,043
act-runnertektonops0.1.21 of 2See more

act-runner tektonops 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
gitea/act_runner:nightly7940221bcfc9
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

4,212
tikatikaVerified publisher0.3.01 of 1See more

tika tika 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/kenchrcum/tika:3.3.0-full708446bc6783
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,825
traefik-secrets-exportertraefik-secrets-exporter0.0.21 of 1See more

traefik-secrets-exporter traefik-secrets-exporter 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/reiche-world/traefik-secrets-exporter:0.0.21485ff93cbf9
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,675
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

5,550
excalidashunxwaresVerified publisher2026.2.51 of 2See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
zimengxiong/excalidash-frontend:0.4.27242629350b06
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

2,620
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

5,459
metabasewiremindVerified publisher2.27.5-wiremind01 of 1See more

metabase wiremind 2.27.5-wiremind0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
metabase/metabase:v0.61.1.x9491ed11c901
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

1,639
language-toolzekker6Verified publisher1.12.11 of 2See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
erikvl87/languagetool:6.7-dockerupdate-3e1ea6a975388
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,571

Container images carrying it

155 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
temporalio/admin-tools:1.28cfde8170c92f
curl@8.17.0-r1
8.20.0-r0
1
temporalio/auto-setup:1.29.7f14912b699cf
curl@8.19.0-r0
8.20.0-r0
1
tombursch/kitchenowl-web:v0.7.8517f808eee66
curl@8.17.0-r1
8.20.0-r0
1
tomsquest/docker-radicale:3.6.1.0a594c624c5a6
curl@8.17.0-r1
8.20.0-r0
1
twentycrm/twenty:v2.22.0e7d9948bf284
curl@8.19.0-r0
8.20.0-r0
1
udhos/eks-auto-pod-id-assoc:0.6.0196ef68af380
curl@8.19.0-r0
8.20.0-r0
1
udhos/k8s-mutating-admission-webhook:1.15.1e588db500edf
curl@8.19.0-r0
8.20.0-r0
1
udhos/redis-enforce-expire:1.0.0615b6a7d742e
curl@8.17.0-r1
8.20.0-r0
1
udhos/sqs-to-sns:2.0.15cf7979da82e1
curl@8.19.0-r0
8.20.0-r0
1
vaultwarden/server:1.36.0-alpined3531610b486
curl@8.17.0-r1
8.20.0-r0
1
zimengxiong/excalidash-frontend:0.4.27242629350b06
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/appscode/trivydb:0.0.367ffb0309acb
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/autobrr/qui:v1.14.110b7945d4f09
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/biru-scop/tenzu-front:latest16759fa523f8
curl@8.19.0-r0
8.20.0-r0
1
ghcr.io/cloudscript-technology/dumpscript:v0.0.42-alpine-edgefce5b6fd161c
curl@8.19.0-r0
8.20.0-r0
1
ghcr.io/comet-ml/opik/opik-frontend:2.2.59bc2f49e9bb3e
curl@8.19.0-r0
8.20.0-r0
1
ghcr.io/comet-ml/opik/opik-python-backend:2.2.59269d0e55ea97
curl@8.19.0-r0
8.20.0-r0
1
ghcr.io/cross-seed/cross-seed:6.13.7a1fed512261f
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/dakera-ai/dakera-dashboard:0.3.292e059589f7f7
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/ethpandaops/benchmarkoor-ui:latestd090bb2060d9
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/ethpandaops/dispatchoor-web:latest18e30413dac2
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/fluxcd/kustomize-controller:v1.9.23aecec8bafdb
curl@8.19.0-r0
8.20.0-r0
1
ghcr.io/gchq/cyberchef:11.0.045082a0ac41d
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/gla-rad/enav-eureka:latest05002092c621
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/home-operations/lidarr:3.1.29df1e14c8e09
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/home-operations/lidarr:3.1.2.4902dab0e07502a3
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/home-operations/qbittorrent:5.1.4bb82ad6668f8
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/home-operations/tautulli:2.17.12183820d45a1
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/hotio/qbittorrent:release-5.2.007198d49e5b4
curl@8.19.0-r0
8.20.0-r0
1
ghcr.io/jeremylong/open-vulnerability-data-mirror:v9.0.49a69aa14dc3e
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/kenchrcum/tika:3.3.0-full708446bc6783
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/linuxserver/radarr:6.0.4c8a55bd83672
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/linuxserver/syslog-ng:4.10.247fae7f540f9
curl@8.19.0-r0
8.20.0-r0
1
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/marcuwynu23/vite-app-sample:latest21247f2b97c4
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/mattn/picoclaw:latest517556c8b144
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/mkutlak/alluredeck-ui:0.41.0c19509b1b336
curl@8.19.0-r0
8.20.0-r0
1
ghcr.io/mydecisive/octant-ui:0.0.1-testing61e4066b22fb
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/openrelik/openrelik-ui:latest7f91594d5eb3
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/open-telemetry/demo:3.0.0-telemetry-docs3519858704e7
curl@8.19.0-r0
8.20.0-r0
1
ghcr.io/pixelfederation/unbound:1.24.2_0fce820a03964
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/pocket-id/pocket-id:v2.7.045bdeaf3fcd6
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/reiche-world/traefik-secrets-exporter:0.0.21485ff93cbf9
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/theconnman/docker-hub-rss:0.6.238eba84b2be8
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
curl@8.17.0-r1
8.20.0-r0
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
curl@8.17.0-r1
8.20.0-r0
1
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
curl@8.19.0-r0
8.20.0-r0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.