CVE-2026-82209

High

Advisory

Published 2 Sept 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.005; 44th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,912; of 17,790 indexed, latest versions
Container images: 1,723; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,912 of 17,790 indexed charts deploy, on 1,723 images.

Affected package	Affected versions	Fixed in	Images
curldeb	1:8.14.1-2+deb13u3+e1, 7.47.0-1ubuntu2.2, 7.47.0-1ubuntu2.5, 7.47.0-1ubuntu2.6+107 more	1:8.14.1-2+deb13u3+e3	1,365
curlapk	8.10.1-r0, 8.10.1-r1, 8.12.0-r1, 8.12.1-r0+11 more	8.22.0-r0, 8.22.0-r2	358

OSV records: ALPINE-CVE-2026-82209 DEBIAN-CVE-2026-82209 UBUNTU-CVE-2026-82209 CGA-9f3f-x983-mfhp CGA-j94g-crm5-pmj7 ECHO-7268-3d2f-bfcf
Also known as: CGA-ccc6-3x2j-267v, CGA-j4hv-w3rj-j5r2, CGA-rmc2-h5mg-6v9h, CGA-vp94-fhjh-v5w8
Trending: Rank 42 in indexed charts, since 5 Sept 2026. See the ranking →

Charts affected

1,912 by stars

Chart

Latest

Affected images

Radar Score

wordpress-alpinewordpress-alpine

1.5.18

2 of 6 See more

wordpress-alpine wordpress-alpine 1.5.18

2 of the 6 container images this version deploys carry CVE-2026-82209.

Container image	Digest	Package	Fixed in
ghcr.io/shesselink81/nginx-alpine :7.1.0.0	9783481cad2a	curl@8.21.0-r0	8.22.0-r0
ghcr.io/shesselink81/wordpress-alpine :7.1.0.0	32ace450bcd9	curl@8.21.0-r0	8.22.0-r0

Open the chart page →

4,032

Wordpresswordpress-mariadb

1.0.2

1 of 2 See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-82209.

Container image	Digest	Package	Fixed in
library/wordpress :latest	5a93c470ae82	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

5,635

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-82209.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	curl@7.81.0-1ubuntu1.16	no fix listed

Open the chart page →

14,172

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-82209.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	curl@8.20.0-r0	8.22.0-r0

Open the chart page →

1,042

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-82209.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	curl@7.88.1-10+deb12u5	no fix listed

Open the chart page →

7,685

xkopsxkops

0.1.0

2 of 5 See more

xkops xkops 0.1.0

2 of the 5 container images this version deploys carry CVE-2026-82209.

Container image	Digest	Package	Fixed in
library/mongo :latest	5211c51171f5	curl@8.5.0-2ubuntu10.11	no fix listed
murtazashah46/helmfile :latest	4d11726cf803	curl@7.88.1-10+deb12u7	no fix listed

Open the chart page →

13,197

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-82209.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

1,839

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-82209.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

1,839

prometheus-monitoring-stackyotron-helm-charts

1.2.0

1 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-82209.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	curl@8.21.0-r0	8.22.0-r0

Open the chart page →

879

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-82209.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	curl@8.17.0-r1	8.22.0-r0

Open the chart page →

1,571

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-82209.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

1,839

zoo-project-druzoo-project

0.10.4

2 of 6 See more

zoo-project-dru zoo-project 0.10.4

2 of the 6 container images this version deploys carry CVE-2026-82209.

Container image	Digest	Package	Fixed in
library/postgres :18.4-alpine3.24	9a8afca54e78	curl@8.21.0-r0	8.22.0-r0
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	curl@7.81.0-1ubuntu1.25	no fix listed

Open the chart page →

7,916

Container images carrying it

1,723 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
library/nginx :latest	6e23479198b9	curl@8.14.1-2+deb13u2	no fix listed	2
library/nginx :1.27.0	98f8ec75657d	curl@7.88.1-10+deb12u6	no fix listed	2
library/nginx :1.29.4	9dd288848f44	curl@8.14.1-2+deb13u2	no fix listed	2
library/phpmyadmin :5.2.1	6e75aa8f767c	curl@7.88.1-10+deb12u8	no fix listed	2
library/python :3.7	eedf63967cdb	curl@7.88.1-10+deb12u1	no fix listed	2
library/redmine :6.1.3-trixie	f474a901faec	curl@8.14.1-2+deb13u4	no fix listed	2
library/wordpress :6.8.3-apache :6.8-apache	30bff39330d1	curl@8.14.1-2+deb13u2	no fix listed	2
library/zookeeper :3.9.5	f258365d4882	curl@7.81.0-1ubuntu1.26	no fix listed	2
lightstep/collector :2021-01-26_23-02-36Z	11c5569aaf3b	curl@7.47.0-1ubuntu2.12	no fix listed	2
linuxserver/jackett :latest	609a1830692d	curl@8.21.0-r0	8.22.0-r0	2
localstack/localstack-pro :latest	4aef81c53168	curl@8.14.1-2+deb13u4	no fix listed	2
louislam/uptime-kuma :2.3.2	9aeb4e51d038	curl@7.88.1-10+deb12u14	no fix listed	2
louislam/uptime-kuma :2.5.0	a8610b3b4c38	curl@7.88.1-10+deb12u14	no fix listed	2
memgraph/memgraph :3.13.1	bd3fe13228f4	curl@8.5.0-2ubuntu10.13	no fix listed	2
mesosphere/kubeaddons-catalog :v0.11.4	073db43d0b8b	curl@7.68.0-1ubuntu2.2	no fix listed	2
metabase/metabase :v0.61.1.x	9491ed11c901	curl@8.19.0-r0	8.22.0-r0	2
moby/buildkit :v0.32.2-rootless	504731e577c2	curl@8.20.0-r0	8.22.0-r0	2
moreillon/group-manager-front :v3.3.1	c9f85db3baa5	curl@7.88.1-10+deb12u6	no fix listed	2
moreillon/user-manager :v5.0.2	e1c9bfab5c16	curl@7.88.1-10+deb12u4	no fix listed	2
moreillon/user-manager-front :v5.0.3	b067dbbbb6af	curl@7.88.1-10+deb12u4	no fix listed	2
n8nio/n8n :2.36.7	14c4285bc303	curl@8.21.0-r0	8.22.0-r0	2
nacos/nacos-server :latest	1c191c30c8cd	curl@8.18.0-1ubuntu2.4	no fix listed	2
nginxinc/nginx-unprivileged :stable	cb92301e719d	curl@8.14.1-2+deb13u4	no fix listed	2
obsidiandynamics/kafdrop :3.30.0	5337c9e0e2de	curl@7.68.0-1ubuntu2.7	no fix listed	2
omecproject/mcord-synchronizer :comac-1.0.0	cfdb566dd949	curl@7.47.0-1ubuntu2.12	no fix listed	2
opencloudeu/web-extensions :unzip-1.0.0	1691ad6612a3	curl@7.88.1-10+deb12u8	no fix listed	2
opencloudeu/web-extensions :draw-io-1.0.0	27cb9b952f0d	curl@7.88.1-10+deb12u8	no fix listed	2
opencloudeu/web-extensions :external-sites-1.0.0	5b176baa3694	curl@7.88.1-10+deb12u8	no fix listed	2
opencloudeu/web-extensions :importer-1.0.0	6e8b2df6c5a4	curl@7.88.1-10+deb12u8	no fix listed	2
opencloudeu/web-extensions :progress-bars-1.0.0	82f888a34440	curl@7.88.1-10+deb12u8	no fix listed	2
opencloudeu/web-extensions :json-viewer-1.0.0	e0ac35a9576e	curl@7.88.1-10+deb12u8	no fix listed	2
opendatacube/ows :latest	668cbb41473c	curl@8.5.0-2ubuntu10.6	no fix listed	2
openebs/provisioner-localpv :4.6.0	99f5116f5cb8	curl@8.20.0-r0	8.22.0-r0	2
pgautoupgrade/pgautoupgrade :18-alpine	48b448825656	curl@8.21.0-r0	8.22.0-r0	2
piomin/sample-spring-kotlin-microservice :1.1	871f784dd6bc	curl@7.81.0-1ubuntu1.4	no fix listed	2
polyaxon/polyaxon-agent :2.16.4	eca6952b20e6	curl@8.14.1-2+deb13u4	no fix listed	2
polyaxon/polyaxon-cli :2.16.4	024ff3fa775e	curl@8.14.1-2+deb13u4	no fix listed	2
qichenxu4pd/pythonexample :1.0	f3a8502bc21b	curl@7.88.1-10+deb12u5	no fix listed	2
quickwit/quickwit :v0.8.2	363ff56ce456	curl@7.88.1-10+deb12u5	no fix listed	2
rajnandan1/kener :3.2.19	30407afca731	curl@7.88.1-10+deb12u12	no fix listed	2
requarks/wiki :2 :latest	68f0d1848261	curl@8.17.0-r1	8.22.0-r0	2
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	curl@7.68.0-1ubuntu2.22	no fix listed	2
svtechnmaa/svtech_debuger :v1.0.0	b2987abe57d3	curl@7.81.0-1ubuntu1.2	no fix listed	2
swaggerapi/swagger-ui :v5.32.14	3d9316996884	curl@8.21.0-r0	8.22.0-r0	2
syncthing/syncthing :2.1.1	775c4aac4862	curl@8.19.0-r0	8.22.0-r0	2
tzahi12345/youtubedl-material :4.3.2 :latest	2f943d584711	curl@7.81.0-1ubuntu1.10	no fix listed	2
uffizzi/controller :latest	0344805f267b	curl@7.88.1-10+deb12u5	no fix listed	2
vdiogov/glpi-conteiner :latest	6945f84f0058	curl@7.88.1-10+deb12u6	no fix listed	2
wolveix/satisfactory-server :latest :v1.9.10	e103700ae6ae	curl@7.81.0-1ubuntu1.20	no fix listed	2
zabbix/zabbix-agent :ubuntu-6.4-latest	349b924472a7	curl@8.5.0-2ubuntu10.6	no fix listed	2