StackRadar

CVE-2026-86409

Low

Advisory

Published 14 Oct 2026In the index since 15 Oct 2026
Severity
Low
worst across findings
CVSS
2.0
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
835
of 18,137 indexed, latest versions
Container images
688
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 835 of 18,137 indexed charts deploy, on 688 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 1:8.22.0-1+e1, 7.88.1-10, 7.88.1-10+deb12u1+23 moreno fix listed688
OSV records
DEBIAN-CVE-2026-86409ECHO-b6fb-b123-10db
Trending
Rank 49 in indexed charts, since 15 Oct 2026. See the ranking →

Charts affected

835 by stars
ChartLatestAffected imagesRadar Score
trident-protect-consoletrident-protect100.2609.1-console1 of 3See more

trident-protect-console trident-protect 100.2609.1-console

1 of the 3 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v3.0.0cad26cd945d1
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

7,829
tfy-distributortruefoundryVerified publisher0.0.11 of 4See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

20,504
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
bitnamilegacy/kubectl:1.301249fc292e84
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

10,038
applicationuniversal-helm-chartVerified publisher0.4.51 of 1See more

application universal-helm-chart 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
library/nginx:latestf9ea18bfa4fa
curl@8.14.1-2+deb13u5
no fix listed

Open the chart page →

1,815
unlaunla0.10.01 of 3See more

unla unla 0.10.0

1 of the 3 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
ghcr.io/amoylab/unla/web:latesteac1df1c5e66
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

11,093
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

6,405
opencloudunxwaresVerified publisher0.2.36 of 13See more

opencloud unxwares 0.2.3

6 of the 13 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
opencloudeu/web-extensions:unzip-1.0.01691ad6612a3
curl@7.88.1-10+deb12u8
no fix listed
opencloudeu/web-extensions:draw-io-1.0.027cb9b952f0d
curl@7.88.1-10+deb12u8
no fix listed
opencloudeu/web-extensions:external-sites-1.0.05b176baa3694
curl@7.88.1-10+deb12u8
no fix listed
opencloudeu/web-extensions:importer-1.0.06e8b2df6c5a4
curl@7.88.1-10+deb12u8
no fix listed
opencloudeu/web-extensions:progress-bars-1.0.082f888a34440
curl@7.88.1-10+deb12u8
no fix listed
opencloudeu/web-extensions:json-viewer-1.0.0e0ac35a9576e
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

49,338
demo-backendv2flyVerified publisher0.0.31 of 1See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
curl@7.88.1-10+deb12u1
no fix listed

Open the chart page →

15,782
scrutinyvhdirkVerified publisher0.1.31 of 1See more

scrutiny vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
ghcr.io/analogj/scrutiny:master-omnibus18689773150d
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

5,754
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

12,088
video-dl-botvideo-dl-botVerified publisher1.4.31 of 1See more

video-dl-bot video-dl-bot 1.4.3

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
ghcr.io/tarampampam/video-dl-bot:1.4.36daa2dc7556b
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

2,513
argus-test-envvk-helm-charts2.0.01 of 1See more

argus-test-env vk-helm-charts 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
library/nginx:latestf9ea18bfa4fa
curl@8.14.1-2+deb13u5
no fix listed

Open the chart page →

1,815
voting-app-envvoting-example-with-env0.0.32 of 6See more

voting-app-env voting-example-with-env 0.0.3

2 of the 6 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
kerolosayman308/voting-app-env:examplevotingapp_vote29d99802f2d7
curl@8.14.1-2+deb13u2
no fix listed
kerolosayman308/voting-app-env:examplevotingapp_result6e92e5a231fa
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

8,339
api-gatewaywallarmVerified publisher0.2.01 of 1See more

api-gateway wallarm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
wallarm/api-gateway:0.2.0a3d4d2f780e8
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

2,610
wallarm-gatewaywallarmVerified publisher0.4.01 of 1See more

wallarm-gateway wallarm 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
wallarm/gateway-controller:0.4.09c6ed23e2f0e
curl@8.14.1-2+deb13u3
no fix listed

Open the chart page →

2,410
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

6,569
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

7,804
web-dvwaweb-dvwa1.16.01 of 2See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
gulacedia/web-dvwa-new:v367b467d961ca
curl@7.88.1-10
no fix listed

Open the chart page →

11,207
jenkinswebencryptor1.9.181 of 1See more

jenkins webencryptor 1.9.18

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsa660310e39ad
curl@8.14.1-2+deb13u5
no fix listed

Open the chart page →

2,194
giteawener12.7.01 of 4See more

gitea wener 12.7.0

1 of the 4 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql-repmgr:17.6.0-debian-12-r2f12387ec882b
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

10,533
juicefs-csi-driverwener0.33.01 of 5See more

juicefs-csi-driver wener 0.33.0

1 of the 5 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.0f918e7331c05
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

12,321
giteawenerme12.7.01 of 4See more

gitea wenerme 12.7.0

1 of the 4 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql-repmgr:17.6.0-debian-12-r2f12387ec882b
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

10,533
juicefs-csi-driverwenerme0.33.01 of 5See more

juicefs-csi-driver wenerme 0.33.0

1 of the 5 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.0f918e7331c05
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

12,321
keycloakwiremindVerified publisher25.3.11 of 2See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/keycloak:26.5.0-debian-12-r38622ea9e43c0
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

8,885
marge-botwiremindVerified publisher1.4.41 of 1See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
hiboxsystems/marge-bot:0.14.0dcffb926e563
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

5,984
rabbitmqwiremindVerified publisher16.0.171 of 1See more

rabbitmq wiremind 16.0.17

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
ghcr.io/wiremind/bitnami/rabbitmq:4.2.2-debian-12-r11572e12bc93c
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

3,260
Wordpresswordpress-mariadb1.0.21 of 2See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
library/wordpress:latestf32ffa85064d
curl@8.14.1-2+deb13u5
no fix listed

Open the chart page →

6,168
wordpresswordpress-ng1.0.111 of 2See more

wordpress wordpress-ng 1.0.11

1 of the 2 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
cloudtooling/wordpress:7.1.3fb4863035a05
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

5,096
tabbyxdVerified publisher1.0.61 of 2See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
library/nginx:1.25a484819eb602
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

8,888
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
curl@7.88.1-10+deb12u7
no fix listed

Open the chart page →

15,800
nginx-chartxxoznge-nginx0.1.01 of 1See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
library/nginx:latestf9ea18bfa4fa
curl@8.14.1-2+deb13u5
no fix listed

Open the chart page →

1,815
my-nginx-appyasser-nginx-app0.1.01 of 1See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
library/nginx:stable9bf97bd7714f
curl@8.14.1-2+deb13u5
no fix listed

Open the chart page →

1,815
jenkinszanise-jenkins-helm-chart0.1.01 of 1See more

jenkins zanise-jenkins-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsa660310e39ad
curl@8.14.1-2+deb13u5
no fix listed

Open the chart page →

2,194
NEW_APPzekker6Verified publisher0.0.01 of 1See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
library/nginx:latestf9ea18bfa4fa
curl@8.14.1-2+deb13u5
no fix listed

Open the chart page →

1,815
sockpuppetbrowserzekker6Verified publisher0.1.01 of 1See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86409.

Container imageDigestPackageFixed in
dgtlmoon/sockpuppetbrowser:latest1d8f72d2ce20
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

5,138

Container images carrying it

688 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
openhab/openhab:5.2.1bfd4a60e90da
curl@8.14.1-2+deb13u4
no fix listed
1
opennode/waldur-mastermind:8.1.382e8f276c5ed
curl@8.14.1-2+deb13u5
no fix listed
1
openproject/hocuspocus:release-338001b288dc1359dfb5
curl@7.88.1-10+deb12u12
no fix listed
1
openproject/openproject:17.9.1-slim2beeecac788d
curl@8.14.1-2+deb13u5
no fix listed
1
passbolt/passbolt:5.16.0-1-ce1768916a04b1
curl@8.14.1-2+deb13u5
no fix listed
1
penpotapp/exporter:2.18.3418232d6ca31
curl@8.14.1-2+deb13u5+dhi0
no fix listed
1
phan2410/falcon-asgi-server:0.1.04a86d138832d
curl@7.88.1-10+deb12u12
no fix listed
1
phpmyadmin/phpmyadmin:5.2.342a200db07b4
curl@8.14.1-2
no fix listed
1
pk910/powfaucet:v2-stable3dcae6a62896
curl@7.88.1-10+deb12u12
no fix listed
1
pockost/matomo:5.14.0134c35415788
curl@8.14.1-2+deb13u5
no fix listed
1
polyaxon/polyaxon-api:2.17.0163707082036
curl@8.14.1-2+deb13u5
no fix listed
1
polyaxon/polyaxon-streams:2.17.0a5fec70e757b
curl@8.14.1-2+deb13u5
no fix listed
1
postgis/postgis:18-3.67e00e8c3539f
curl@8.14.1-2+deb13u4
no fix listed
1
powerdns/pdns-recursor-54:5.4.7ec0ad7d67b63
curl@8.14.1-2+deb13u5
no fix listed
1
praravind1801/helmimages:3.0.0f29d637b9ce1
curl@7.88.1-10+deb12u5
no fix listed
1
prefecthq/prefect:3.8.8-python3.1119463f92420b
curl@8.14.1-2+deb13u5
no fix listed
1
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
curl@7.88.1-10+deb12u6
no fix listed
1
pretix/standalone:2026.7.05df3b7aa852e
curl@8.14.1-2+deb13u4
no fix listed
1
prodrigestivill/postgres-backup-local:latestf70742ebe42b
curl@8.14.1-2
no fix listed
1
prowlercloud/prowler-api:5.31.14f252d579be2
curl@7.88.1-10+deb12u14
no fix listed
1
purestream711/nostalgiatv-server:0.10.26-20261015-0010429e4aa573c1
curl@8.14.1-2+deb13u5
no fix listed
1
qjoly/kubernetes-coffee-image:simple9f0c5ce8b5d7
curl@8.14.1-2+deb13u5
no fix listed
1
quickwit/quickwit:v0.8.1d29332bdadcc
curl@7.88.1-10+deb12u5
no fix listed
1
reallibrephotos/librephotos-proxy:1.2.1111203b9551a
curl@8.14.1-2+deb13u5
no fix listed
1
redash/redash:25.8.000d813437db5
curl@7.88.1-10+deb12u12
no fix listed
1
redash/redash:26.3.0c5c9148f5c38
curl@7.88.1-10+deb12u14
no fix listed
1
redimp/otterwiki:21435c8cc536d
curl@7.88.1-10+deb12u15
no fix listed
1
redpandadata/redpanda:latestc98c2f04a751
curl@8.14.1-2+deb13u5
no fix listed
1
rhasspy/wyoming-speech-to-phrase:1.4.3e532f0dbc6b2
curl@7.88.1-10+deb12u14
no fix listed
1
rocketchat/freeswitch:stablecfba5c20a5cc
curl@7.88.1-10+deb12u12
no fix listed
1
roundcube/roundcubemail:1.6.16-apache-nonroot17d9d9580962
curl@8.14.1-2+deb13u3
no fix listed
1
santisbon/speedtest:latest8ee3a1697227
curl@7.88.1-10+deb12u1
no fix listed
1
sashafefler/spacecapybara_app:latestf96d7804c0ca
curl@7.88.1-10+deb12u7
no fix listed
1
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
curl@7.88.1-10+deb12u4
no fix listed
1
serversideup/php:8.5-fpm-nginx8f8c2f010ac5
curl@8.14.1-2+deb13u4
no fix listed
1
shamimkuet/nginx:1.0.2b82902a76a04
curl@7.88.1-10+deb12u6
no fix listed
1
signalen/backend:2.50.1826bb090bc4e4
curl@7.88.1-10+deb12u15
no fix listed
1
sigp/siren:v3.0.42c219b04758e
curl@7.88.1-10+deb12u12
no fix listed
1
sigscale/cgf:lateste076e06d7647
curl@7.88.1-10+deb12u12
no fix listed
1
sigscale/cse:latestdfa75c395b95
curl@7.88.1-10+deb12u15
no fix listed
1
sigscale/im:2.1.1-160ee9b3d5721
curl@7.88.1-10+deb12u5
no fix listed
1
sigscale/ocs:latest3b8ec91d359d
curl@7.88.1-10+deb12u15
no fix listed
1
sirrend/helmup-engine:0.1.13699e79e3d4e2
curl@7.88.1-10+deb12u6
no fix listed
1
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
curl@7.88.1-10+deb12u6
no fix listed
1
sissbruecker/linkding:1.35.00c5dddf0b37c
curl@7.88.1-10+deb12u7
no fix listed
1
sissbruecker/linkding:1.41.0-plusa222fb777e1f
curl@7.88.1-10+deb12u12
no fix listed
1
sissbruecker/linkding:1.47.0e35cb50e0581
curl@8.14.1-2+deb13u4
no fix listed
1
socialmediamacroscope/histogram:0.1.26418f9bdb4d2
curl@7.88.1-10+deb12u1
no fix listed
1
socialmediamacroscope/network_analysis:0.1.3b351c21422e6
curl@7.88.1-10+deb12u1
no fix listed
1
socialmediamacroscope/preprocessing:0.1.3ca863306314b
curl@7.88.1-10+deb12u1
no fix listed
1

syft 1.42.1 · advisories as of 15 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.