CVE-2026-7168

Medium

Advisory

Published 29 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.005; 39th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,204; of 17,787 indexed, latest versions
Container images: 1,139; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,204 of 17,787 indexed charts deploy, on 1,139 images.

Affected package	Affected versions	Fixed in	Images
curldeb	1:8.14.1-2+deb13u3+e1, 7.58.0-2ubuntu3.3, 7.58.0-2ubuntu3.5, 7.58.0-2ubuntu3.6+71 more	1:8.14.1-2+deb13u3+e2, 7.58.0-2ubuntu3.24+esm10, 7.68.0-1ubuntu2.25+esm5, 7.81.0-1ubuntu1.24+4 more	982
curlapk	8.12.1-r0, 8.17.0-r1, 8.18.0-r0, 8.19.0-r0	8.20.0-r0	157

OSV records: ALPINE-CVE-2026-7168 DEBIAN-CVE-2026-7168 UBUNTU-CVE-2026-7168 ECHO-992e-5e26-c10d
Also known as: USN-8227-1, USN-8525-1

Charts affected

1,204 by stars

Chart

Latest

Affected images

Radar Score

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-7168.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.24

Open the chart page →

14,172

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-7168.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15

Open the chart page →

7,685

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-7168.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u15

Open the chart page →

13,197

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-7168.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	curl@8.17.0-r1	8.20.0-r0

Open the chart page →

1,571

Container images carrying it

1,139 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
obsidiandynamics/kafdrop :3.30.0	5337c9e0e2de	curl@7.68.0-1ubuntu2.7	7.68.0-1ubuntu2.25+esm5	2
opencloudeu/web-extensions :unzip-1.0.0	1691ad6612a3	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	2
opencloudeu/web-extensions :draw-io-1.0.0	27cb9b952f0d	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	2
opencloudeu/web-extensions :external-sites-1.0.0	5b176baa3694	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	2
opencloudeu/web-extensions :importer-1.0.0	6e8b2df6c5a4	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	2
opencloudeu/web-extensions :progress-bars-1.0.0	82f888a34440	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	2
opencloudeu/web-extensions :json-viewer-1.0.0	e0ac35a9576e	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	2
opendatacube/ows :latest	668cbb41473c	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.9	2
piomin/sample-spring-kotlin-microservice :1.1	871f784dd6bc	curl@7.81.0-1ubuntu1.4	7.81.0-1ubuntu1.24	2
qichenxu4pd/pythonexample :1.0	f3a8502bc21b	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15	2
quickwit/quickwit :v0.8.2	363ff56ce456	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15	2
rajnandan1/kener :3.2.19	30407afca731	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15	2
requarks/wiki :2 :latest	68f0d1848261	curl@8.17.0-r1	8.20.0-r0	2
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	curl@7.68.0-1ubuntu2.22	7.68.0-1ubuntu2.25+esm5	2
svtechnmaa/svtech_debuger :v1.0.0	b2987abe57d3	curl@7.81.0-1ubuntu1.2	7.81.0-1ubuntu1.24	2
syncthing/syncthing :2.1.1	775c4aac4862	curl@8.19.0-r0	8.20.0-r0	2
tzahi12345/youtubedl-material :4.3.2 :latest	2f943d584711	curl@7.81.0-1ubuntu1.10	7.81.0-1ubuntu1.24	2
uffizzi/controller :latest	0344805f267b	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15	2
vdiogov/glpi-conteiner :latest	6945f84f0058	curl@7.88.1-10+deb12u6	7.88.1-10+deb12u15	2
wolveix/satisfactory-server :latest :v1.9.10	e103700ae6ae	curl@7.81.0-1ubuntu1.20	7.81.0-1ubuntu1.24	2
zabbix/zabbix-agent :ubuntu-6.4-latest	349b924472a7	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.9	2
ghcr.io/appscode/inbox-server :latest :postgres-latest	536358d7b17e	curl@7.81.0-1ubuntu1.21	7.81.0-1ubuntu1.24	2
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.9	2
ghcr.io/cinnyapp/cinny :v4.12.6	a7805a8a60ff	curl@8.19.0-r0	8.20.0-r0	2
ghcr.io/codingducksrl/laravel :8.1	5be52524664c	curl@7.81.0-1ubuntu1.6	7.81.0-1ubuntu1.24	2
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	curl@7.81.0-1ubuntu1.3	7.81.0-1ubuntu1.24	2
ghcr.io/flaresolverr/flaresolverr :v3.4.6	7962759d99d7	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	2
ghcr.io/games-on-whales/retroarch :1.0.0	103fbcec2314	curl@7.68.0-1ubuntu2.6	7.68.0-1ubuntu2.25+esm5	2
ghcr.io/google/fleetspeak :v0.1.17	cd264d33efd4	curl@7.88.1-10+deb12u6	7.88.1-10+deb12u15	2
ghcr.io/linuxserver/openvpn-as :version-2.8.6-916f8e7d-ubuntu18	4ee0764310e7	curl@7.58.0-2ubuntu3.10	7.58.0-2ubuntu3.24+esm10	2
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway :unprivileged-oss :unprivileged-oss-20250331	3db8145349a3	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u15	2
ghcr.io/salaboy/fmtok8s-frontend :v0.1.1	03fd01b4f56e	curl@7.81.0-1ubuntu1.2	7.81.0-1ubuntu1.24	2
ghcr.io/smarter-project/home-ha-mock :main	95ee018cf558	curl@7.88.1-10+deb12u12	7.88.1-10+deb12u15	2
ghcr.io/smarter-project/hydra/isolated-vm :main	4457b79b24cd	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	2
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	curl@7.68.0-1ubuntu2.18	7.68.0-1ubuntu2.25+esm5	2
quay.io/argoproj/argocd :v2.14.11	5fc69e31c755	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.9	2
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra :latest	b1198ea741d1	curl@8.17.0-r1	8.20.0-r0	2
registry.gitlab.com/shortlink-org/shortlink/ui :main	9bdb1062d960	curl@8.17.0-r1	8.20.0-r0	2
1dev/server :11.9.0	cd5b12fe5471	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.9	1
48n6e/camellia-redis-proxy :1.4.0-jdk-21-0.0.1	a6ed886fddfc	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
5200710/hadoop :3.2.3-java8	092d3088a5fb	curl@7.68.0-1ubuntu2.21	7.68.0-1ubuntu2.25+esm5	1
aapjeisbaas/wp-frankenphp :v0.2.2	6b261abc7fb0	curl@8.14.1-2+deb13u3	8.14.1-2+deb13u4	1
aboogie/login_test_backend :new	9c41a4483ac8	curl@7.88.1-10+deb12u6	7.88.1-10+deb12u15	1
adorsys/keycloak-config-cli :6.3.0-26.1.0	85be7a45a94c	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.9	1
adorsys/keycloak-config-cli :6.1.6-25.0.1	eb49a2dcbbb8	curl@8.5.0-2ubuntu10.1	8.5.0-2ubuntu10.9	1
adwerx/github-actions-runner :2.276.1-20.04-1	840d2b078682	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.25+esm5	1
ahmetfurkandemir/iceberg-rest-fixture-postgresql :1.10.0	142231a0b8b7	curl@7.81.0-1ubuntu1.20	7.81.0-1ubuntu1.24	1
airbyte/pod-sweeper :1.5.1	98d2c39d512e	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	1
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.25+esm5	1
akaunting/akaunting :3.0.15	52811b36ec3a	curl@7.88.1-10	7.88.1-10+deb12u15	1