StackRadar

CVE-2026-7009

Medium

Advisory

Published 13 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
20th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
176
of 17,781 indexed, latest versions
Container images
155
deployed by those charts
Fix available
1 of 1
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 176 of 17,781 indexed charts deploy, on 155 images.

Affected packageAffected versionsFixed inImages
curlapk8.17.0-r1, 8.18.0-r0, 8.19.0-r08.20.0-r0155
OSV records
ALPINE-CVE-2026-7009

Charts affected

176 by stars
ChartLatestAffected imagesRadar Score
pimcorehelmforgeVerified publisher2.0.11 of 6See more

pimcore helmforge 2.0.1

1 of the 6 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
dunglas/mercure:v0.24.2916834e49961
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

3,156
strava-statisticshelmforgeVerified publisher1.1.161 of 2See more

strava-statistics helmforge 1.1.16

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
robiningelbrecht/strava-statistics:v5.0.040842cdfd616
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

845
release-cleanerhelm-release-cleanerVerified publisher1.0.01 of 1See more

release-cleaner helm-release-cleaner 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
alpine/helm:4.1.0905a068da431
curl@8.18.0-r0
8.20.0-r0

Open the chart page →

2,000
label-studioinseefrlab2.3.11 of 3See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
heartexlabs/label-studio:latestaa461572e8f9
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

3,157
manyfoldjeffrescVerified publisher1.0.31 of 1See more

manyfold jeffresc 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,960
docker-hub-rssjuniorjpdj0.1.311 of 1See more

docker-hub-rss juniorjpdj 0.1.31

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/theconnman/docker-hub-rss:0.6.238eba84b2be8
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,966
giteak8s-home-lab-repo2.6.01 of 1See more

gitea k8s-home-lab-repo 2.6.0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
gitea/gitea:1.26.27d13848af126
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

2,139
lidarrk8s-home-lab-repo15.3.11 of 1See more

lidarr k8s-home-lab-repo 15.3.1

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/home-operations/lidarr:3.1.29df1e14c8e09
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,568
syslog-ngk8s-home-lab-repo3.1.11 of 1See more

syslog-ng k8s-home-lab-repo 3.1.1

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/syslog-ng:4.10.247fae7f540f9
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

1,298
k8s-mutating-admission-webhookk8s-mutating-admission-webhook1.15.11 of 1See more

k8s-mutating-admission-webhook k8s-mutating-admission-webhook 1.15.1

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
udhos/k8s-mutating-admission-webhook:1.15.1e588db500edf
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

945
vaultwardenkagiso-me0.1.11 of 1See more

vaultwarden kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
vaultwarden/server:1.36.0-alpined3531610b486
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

885
kbot-self-hostedkbot-self-hostedVerified publisher0.1.81 of 7See more

kbot-self-hosted kbot-self-hosted 0.1.8

1 of the 7 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
clamav/clamav:1.4.3_base629a3050df6a
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

32,509
sweeperkrateo0.2.11 of 2See more

sweeper krateo 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
alpine/kubectl:1.36.01ee9df6316d4
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,504
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

3,441
pocket-idkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

pocket-id kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/pocket-id/pocket-id:v2.7.045bdeaf3fcd6
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,513
syncthingkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

syncthing kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
syncthing/syncthing:2.1.07c60eb0ec887
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,310
tor-proxykubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

tor-proxy kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
peterdavehello/tor-socks-proxy:latest0cc12d36d312
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,480
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

2,596
forkliftkubevirt-forkliftVerified publisher0.3.01 of 2See more

forklift kubevirt-forklift 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
openresty/openresty:1.31.1.1-1-alpine-fatacd832254d9c
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

1,417
stremiolbenicio-communityVerified publisher0.1.11 of 2See more

stremio lbenicio-community 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
lbenicio/stremio-web:latest732f9003de33
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

2,600
node-redlmatfyVerified publisher0.1.61 of 1See more

node-red lmatfy 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
nodered/node-red:4.1.10-minimald73ae167cb9b
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,809
sonarrloeken-at-homeVerified publisher4.0.171 of 1See more

sonarr loeken-at-home 4.0.17

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
loeken/sonarr:4.0.17b940520a2236
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

866
elasticvuelogic3579Verified publisher1.15.01 of 1See more

elasticvue logic3579 1.15.0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
cars10/elasticvue:1.15.0efddf4fa0fd8
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,085
nubladolsst-sqre0.9.231 of 5See more

nublado lsst-sqre 0.9.23

1 of the 5 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
jupyterhub/configurable-http-proxy:latest69a7170eeeda
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

5,786
decap-cmsm11sVerified publisher0.3.151 of 1See more

decap-cms m11s 0.3.15

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
m11s/decap-cms:0.2.11-s30cd6810c9885
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

1,151
novosgamarcusrepo0.1.11 of 2See more

novosga marcusrepo 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
novosga/novosga:latest34b9acbe6e51
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

3,706
dependency-trackmediamarktsaturn1.9.21 of 2See more

dependency-track mediamarktsaturn 1.9.2

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
dependencytrack/frontend:4.14.200560b57a6cf
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

3,818
prometheus-operatormesosphere12.11.131 of 8See more

prometheus-operator mesosphere 12.11.13

1 of the 8 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
grafana/grafana:12.3.39e1e77ade304
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

11,689
mollysocketmollysocket-wrenixVerified publisher0.1.141 of 2See more

mollysocket mollysocket-wrenix 0.1.14

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
alpine/kubectl:1.35.3c4a11ae9a1cb
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

2,521
radicalemt1905024.1.11 of 1See more

radicale mt190502 4.1.1

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
tomsquest/docker-radicale:3.6.1.0a594c624c5a6
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,546
umamimt1905028.1.41 of 3See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.0.328f263fe06f7
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

4,016
ingress-nginxmxytest4.15.11 of 2See more

ingress-nginx mxytest 4.15.1

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.15.1594ceea76b01
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,547
dependency-tracknaj980.0.91 of 3See more

dependency-track naj98 0.0.9

1 of the 3 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
dependencytrack/frontend:latest8854a8320475
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

2,465
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

3,798
ocisocis-community0.1.01 of 1See more

ocis ocis-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
owncloud/ocis:8.0.1b38fd8fdd58f
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

2,346
octant-uioctant-ui0.0.1-testing1 of 1See more

octant-ui octant-ui 0.0.1-testing

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/mydecisive/octant-ui:0.0.1-testing61e4066b22fb
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,109
openobserveopenobserve0.92.21 of 6See more

openobserve openobserve 0.92.2

1 of the 6 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
natsio/nats-box:0.19.7ffce8bd10338
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

3,157
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-ui:latest7f91594d5eb3
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

71,208
loki-standaloneot-container-kit1.0.21 of 5See more

loki-standalone ot-container-kit 1.0.2

1 of the 5 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
nginxinc/nginx-unprivileged:1.29-alpine0c79d56aee56
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

3,580
radarr-testpanzer1119Verified publisher0.1.21 of 2See more

radarr-test panzer1119 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/radarr:6.0.4c8a55bd83672
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,288
stk-fluent-bit-loki-s3paxtecnologia0.2.01 of 6See more

stk-fluent-bit-loki-s3 paxtecnologia 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
nginxinc/nginx-unprivileged:1.29-alpine0c79d56aee56
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

3,739
picoclawpicoclawVerified publisher0.1.261 of 1See more

picoclaw picoclaw 0.1.26

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/mattn/picoclaw:latest517556c8b144
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,556
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

2,751
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

3,270
redis-enforce-expireredis-enforce-expire1.0.01 of 1See more

redis-enforce-expire redis-enforce-expire 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
udhos/redis-enforce-expire:1.0.0615b6a7d742e
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

1,302
monitoringrocketchat-server0.0.171 of 9See more

monitoring rocketchat-server 0.0.17

1 of the 9 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
nginxinc/nginx-unprivileged:1.29-alpine0c79d56aee56
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

6,859
caddy-reverse-proxyromholdings0.10.11 of 1See more

caddy-reverse-proxy romholdings 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
library/caddy:latestdf7f1c2fb114
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

845
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
curl@8.17.0-r1
8.20.0-r0

Open the chart page →

3,370
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
curl@8.18.0-r0
8.20.0-r0

Open the chart page →

5,819
cinnyappschoenwald1.0.111 of 1See more

cinnyapp schoenwald 1.0.11

1 of the 1 container images this version deploys carry CVE-2026-7009.

Container imageDigestPackageFixed in
ghcr.io/cinnyapp/cinny:v4.12.6a7805a8a60ff
curl@8.19.0-r0
8.20.0-r0

Open the chart page →

804

Container images carrying it

155 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/deployhub/ms-nginx:svccat-v11.0.815-g717581d2d3400664e8
curl@8.17.0-r1
8.20.0-r0
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
curl@8.17.0-r1
8.20.0-r0
1
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
curl@8.17.0-r1
8.20.0-r0
1
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
curl@8.17.0-r1
8.20.0-r0
1
registry.k8s.io/provider-os/manila-csi-plugin:v1.36.0190976e2e2fe
curl@8.17.0-r1
8.20.0-r0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.