CVE-2026-82208

High

Advisory

Published 6 Sept 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.004; 36th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 810; of 17,787 indexed, latest versions
Container images: 609; deployed by those charts
Fix available: 1 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 810 of 17,787 indexed charts deploy, on 609 images.

Affected package	Affected versions	Fixed in	Images
curlapk	8.10.1-r0, 8.10.1-r1, 8.12.0-r1, 8.12.1-r0+12 more	8.22.0-r0	372
curldeb	8.14.1-2, 8.14.1-2+deb13u2, 8.14.1-2+deb13u3, 8.14.1-2+deb13u3+dhi3+7 more	no fix listed	237

OSV records: ALPINE-CVE-2026-82208 DEBIAN-CVE-2026-82208 CGA-2r8r-5xgj-phfc
Also known as: CGA-x94p-gcgx-vxvm
Trending: Rank 17 in indexed charts, since 5 Sept 2026. See the ranking →

Charts affected

810 by stars

Chart

Latest

Affected images

Radar Score

metabasewiremind

2.27.5-wiremind0

1 of 1 See more

metabase wiremind 2.27.5-wiremind0

1 of the 1 container images this version deploys carry CVE-2026-82208.

Container image	Digest	Package	Fixed in
metabase/metabase :v0.61.1.x	9491ed11c901	curl@8.19.0-r0	8.22.0-r0

Open the chart page →

1,640

wordpress-alpinewordpress-alpine

1.5.18

2 of 6 See more

wordpress-alpine wordpress-alpine 1.5.18

2 of the 6 container images this version deploys carry CVE-2026-82208.

Container image	Digest	Package	Fixed in
ghcr.io/shesselink81/nginx-alpine :7.1.0.0	9783481cad2a	curl@8.21.0-r0	8.22.0-r0
ghcr.io/shesselink81/wordpress-alpine :7.1.0.0	32ace450bcd9	curl@8.21.0-r0	8.22.0-r0

Open the chart page →

4,032

Wordpresswordpress-mariadb

1.0.2

1 of 2 See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-82208.

Container image	Digest	Package	Fixed in
library/wordpress :latest	5a93c470ae82	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

5,635

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-82208.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	curl@8.20.0-r0	8.22.0-r0

Open the chart page →

1,042

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-82208.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

1,839

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-82208.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

1,839

prometheus-monitoring-stackyotron-helm-charts

1.2.0

1 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-82208.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	curl@8.21.0-r0	8.22.0-r0

Open the chart page →

879

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-82208.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	curl@8.17.0-r1	8.22.0-r0

Open the chart page →

1,571

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-82208.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

1,839

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-82208.

Container image	Digest	Package	Fixed in
library/postgres :18.4-alpine3.24	9a8afca54e78	curl@8.21.0-r0	8.22.0-r0

Open the chart page →

7,916

Container images carrying it

609 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
library/nginx :1.31 :1.31.5 :latest :trixie	05b8cb60c354	curl@8.14.1-2+deb13u4	no fix listed	106
library/nginx :stable	d5792f71a949	curl@8.14.1-2+deb13u4	no fix listed	23
library/postgres :18.6-alpine :18-alpine :alpine	d3e1620b530c	curl@8.21.0-r0	8.22.0-r0	17
jenkins/jenkins :2.568.3-jdk21 :2.568.3-lts-jdk21 :lts	c1e4c349365f	curl@8.14.1-2+deb13u4	no fix listed	13
grafana/grafana :latest	f772d434e8fa	curl@8.21.0-r0	8.22.0-r0	12
jellyfin/jellyfin :10.11 :10.11.11 :latest	aefb67e6a7ff	curl@8.14.1-2+deb13u3	no fix listed	7
library/phpmyadmin :5.2.3-apache :latest	3a8a8d6b5289	curl@8.14.1-2+deb13u4	no fix listed	7
vaultwarden/server :1.37.2 :latest	094b5689ed81	curl@8.14.1-2+deb13u4	no fix listed	7
ghcr.io/paperless-ngx/paperless-ngx :3.1.3	aa810a36942c	curl@8.14.1-2+deb13u4	no fix listed	7
library/wordpress :7.1.0-apache :latest	5a93c470ae82	curl@8.14.1-2+deb13u4	no fix listed	6
nginxinc/nginx-unprivileged :1.29-alpine	0c79d56aee56	curl@8.17.0-r1	8.22.0-r0	6
dpage/pgadmin4 :9.17 :latest	2f4ce946ddf8	curl@8.21.0-r0	8.22.0-r0	5
library/adminer :6.0.1 :latest	f742dcf1b6ca	curl@8.21.0-r0	8.22.0-r0	5
library/httpd :2.4 :2.4.68 :latest	979c38c2228d	curl@8.14.1-2+deb13u4	no fix listed	5
registry.k8s.io/ingress-nginx/controller :v1.15.1	594ceea76b01	curl@8.17.0-r1	8.22.0-r0	5
decisionrules/server :latest	f38d8571fa06	curl@8.21.0-r0	8.22.0-r0	4
grafana/grafana :13.1.0	121a7a9ece6d	curl@8.20.0-r1	8.22.0-r0	4
library/httpd :2.4-alpine :alpine	1b766f17b840	curl@8.20.0-r1	8.22.0-r0	4
linuxserver/sonarr :4.0.19 :latest	4d9df314875e	curl@8.21.0-r0	8.22.0-r0	4
pihole/pihole :2026.07.2 :latest	f7d1be836e3b	curl@8.21.0-r0	8.22.0-r0	4
rustfs/rustfs :1.0.0-beta.12 :latest	41fe89380f41	curl@8.21.0-r0	8.22.0-r0	4
alpine/git :latest :v2.54.0	6f3b5029566d	curl@8.21.0-r0	8.22.0-r0	3
decisionrules/client :latest	92e459f2c673	curl@8.21.0-r0	8.22.0-r0	3
fluent/fluent-bit :5.1.2 :latest	d792375ca8e5	curl@8.14.1-2+deb13u4	no fix listed	3
grafana/grafana :13.1.1	7cb8c64c4d57	curl@8.21.0-r0	8.22.0-r0	3
natsio/nats-box :0.19.7	ffce8bd10338	curl@8.19.0-r0	8.22.0-r0	3
vaultwarden/server :1.37.1	ebdfe70701c6	curl@8.14.1-2+deb13u4	no fix listed	3
ghcr.io/quenchworks/images/mysql	65ea66e8db48	curl@8.21.0-r2	no fix listed	3
quay.io/jupyterhub/configurable-http-proxy :5.2.0	522738d5285e	curl@8.17.0-r1	8.22.0-r0	3
registry.gitlab.com/gitlab-org/gitlab-runner :alpine-v19.3.1	af0325804248	curl@8.21.0-r0	8.22.0-r0	3
alpine/git :latest	4f9488b7295b	curl@8.21.0-r0	8.22.0-r0	2
alpine/k8s :1.32.12	048f8d9c8cc7	curl@8.18.0-r0	8.22.0-r0	2
alpine/kubectl :1.35.4	9ccd82364762	curl@8.17.0-r1	8.22.0-r0	2
alpine/kubectl :1.35.2	ec8f734b0a10	curl@8.17.0-r1	8.22.0-r0	2
cagriekin/pg-ha :2.0.1-pg18	99e17aa165df	curl@8.14.1-2+deb13u4	no fix listed	2
clamav/clamav :1.4.3_base	629a3050df6a	curl@8.17.0-r1	8.22.0-r0	2
dunglas/mercure :v0 :v0.24.2	916834e49961	curl@8.17.0-r1	8.22.0-r0	2
fireflyiii/core :version-6.5.9	fe4ecec4c2ba	curl@8.14.1-2+deb13u2	no fix listed	2
fireflyiii/data-importer :version-2.2.3	ab52bf932546	curl@8.14.1-2+deb13u2	no fix listed	2
gisaia/agate :0.18.1	98213fa403ae	curl@8.21.0-r0	8.22.0-r0	2
gisaia/airs :0.18.1	5abfe00317bf	curl@8.21.0-r0	8.22.0-r0	2
gisaia/aproc-service :0.18.1	ac6564921994	curl@8.21.0-r0	8.22.0-r0	2
gisaia/arlas-fam-wui :0.18.1	3700dcaf7a75	curl@8.20.0-r0	8.22.0-r0	2
gisaia/arlas-wui :28.0.3	b83b3e067173	curl@8.19.0-r0	8.22.0-r0	2
gisaia/arlas-wui-builder :28.0.1	a35977a5bb7d	curl@8.19.0-r0	8.22.0-r0	2
gisaia/arlas-wui-hub :28.0.2	1a3cc43d822f	curl@8.19.0-r0	8.22.0-r0	2
gisaia/fam :0.18.1	ae525930b4b6	curl@8.21.0-r0	8.22.0-r0	2
gotenberg/gotenberg :8.36.0	87c16b9f3642	curl@8.21.0-2~bpo13+1	no fix listed	2
gotenberg/gotenberg :8 :8.37.0	f29984bd1e22	curl@8.21.0-2~bpo13+1	no fix listed	2
grafana/grafana :12.3.1	2175aaa91c96	curl@8.17.0-r1	8.22.0-r0	2