StackRadar

CVE-2026-8925

Critical

Advisory

Published 24 Jun 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.007
50th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
520
of 17,787 indexed, latest versions
Container images
475
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 520 of 17,787 indexed charts deploy, on 475 images.

Affected packageAffected versionsFixed inImages
curldeb7.81.0-1ubuntu1.2, 7.81.0-1ubuntu1.3, 7.81.0-1ubuntu1.4, 7.81.0-1ubuntu1.6+24 more7.81.0-1ubuntu1.25, 8.5.0-2ubuntu10.10, 8.14.1-2ubuntu1.4, 8.18.0-1ubuntu2.2261
curlapk8.17.0-r1, 8.18.0-r0, 8.19.0-r0, 8.20.0-r0+1 more8.21.0-r0, 8.22.0-r0214
OSV records
ALPINE-CVE-2026-8925UBUNTU-CVE-2026-8925
Also known as
USN-8487-1

Charts affected

520 by stars
ChartLatestAffected imagesRadar Score
act-runnertektonops0.1.21 of 2See more

act-runner tektonops 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
gitea/act_runner:nightly7940221bcfc9
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

4,212
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
dblaci/ubuntu-ssh-rsync:20231020eea697611af4
curl@7.81.0-1ubuntu1.14
7.81.0-1ubuntu1.25

Open the chart page →

20,270
tikatikaVerified publisher0.3.01 of 1See more

tika tika 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
ghcr.io/kenchrcum/tika:3.3.0-full708446bc6783
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,825
traefik-secrets-exportertraefik-secrets-exporter0.0.21 of 1See more

traefik-secrets-exporter traefik-secrets-exporter 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
ghcr.io/reiche-world/traefik-secrets-exporter:0.0.21485ff93cbf9
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,675
ats-ingresstrafficserver-ingress-controller0.1.01 of 1See more

ats-ingress trafficserver-ingress-controller 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
ghcr.io/apache/ats-ingress:latest2d4d776f6362
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

414
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

5,550
excalidashunxwaresVerified publisher2026.2.51 of 2See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
zimengxiong/excalidash-frontend:0.4.27242629350b06
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

2,620
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
curl@8.5.0-2ubuntu10.1
8.5.0-2ubuntu10.10

Open the chart page →

45,239
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
curl@7.81.0-1ubuntu1.15
7.81.0-1ubuntu1.25

Open the chart page →

9,347
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
curl@8.5.0-2ubuntu10.8
8.5.0-2ubuntu10.10

Open the chart page →

4,305
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
twentycrm/twenty-postgres-spilo:latest2f78405a78be
curl@7.81.0-1ubuntu1.15
7.81.0-1ubuntu1.25

Open the chart page →

13,459
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
curl@8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.10

Open the chart page →

7,628
istio-service-meshwbstack0.0.11 of 1See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
istio/pilot:1.17.1ce9d87606701
curl@7.81.0-1ubuntu1.7
7.81.0-1ubuntu1.25

Open the chart page →

6,232
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

5,459
jaegerwikimedia3.1.21 of 4See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
curl@7.81.0-1ubuntu1.15
7.81.0-1ubuntu1.25

Open the chart page →

9,248
elasticsearchwiremindVerified publisher8.19.01 of 1See more

elasticsearch wiremind 8.19.0

1 of the 1 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
library/elasticsearch:8.19.1289729a95066a
curl@8.5.0-2ubuntu10.8
8.5.0-2ubuntu10.10

Open the chart page →

2,191
metabasewiremindVerified publisher2.27.5-wiremind01 of 1See more

metabase wiremind 2.27.5-wiremind0

1 of the 1 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
metabase/metabase:v0.61.1.x9491ed11c901
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,639
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
curl@7.81.0-1ubuntu1.16
7.81.0-1ubuntu1.25

Open the chart page →

14,100
xboardxboard0.2.01 of 1See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
ghcr.io/cedar2025/xboard:latest896e4926e0d7
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

1,042
language-toolzekker6Verified publisher1.12.11 of 2See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-8925.

Container imageDigestPackageFixed in
erikvl87/languagetool:6.7-dockerupdate-3e1ea6a975388
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,571

Container images carrying it

475 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
gcr.io/datadoghq/cluster-agent:7.61.06efe04ba4e06
curl@8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.10
1
gcr.io/datadoghq/private-action-runner:v1.21.05f5918f843a4
curl@8.5.0-2ubuntu10.8
8.5.0-2ubuntu10.10
1
gcr.io/google.com/cloudsdktool/google-cloud-cli:alpine6d35276c2562
curl@8.20.0-r0
8.22.0-r0
1
gcr.io/istio-testing/operator:latest8d4576f7b98f
curl@8.5.0-2ubuntu10.1
8.5.0-2ubuntu10.10
1
ghcr.io/aardbol/opencode-server:v1.18.23-alpine7930061993f7
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/alekc/samba-docker:v1.1.0cc9a028d9c43
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/alexmorbo/dell_idrac_fan_controller:v0.1.6-1d110504d551d
curl@8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.10
1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
curl@8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.10
1
ghcr.io/apache/ats-ingress:latest2d4d776f6362
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/apache/flink-kubernetes-operator:c703255e9c2ce635b89
curl@7.81.0-1ubuntu1.18
7.81.0-1ubuntu1.25
1
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
curl@7.81.0-1ubuntu1.15
7.81.0-1ubuntu1.25
1
ghcr.io/appscode/s3proxy:sha-a82ca6820518335f9f9
curl@7.81.0-1ubuntu1.16
7.81.0-1ubuntu1.25
1
ghcr.io/appscode/trivydb:0.0.367ffb0309acb
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/autobrr/qui:v1.14.110b7945d4f09
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/base/node-reth:v1.1.18eb6e492fe3c
curl@8.5.0-2ubuntu10.9
8.5.0-2ubuntu10.10
1
ghcr.io/base-org/node:v0.11.11aba0ffe55ea
curl@7.81.0-1ubuntu1.20
7.81.0-1ubuntu1.25
1
ghcr.io/biru-scop/tenzu-front:latest16759fa523f8
curl@8.19.0-r0
8.22.0-r0
1
ghcr.io/bitwarden/web:2026.8.00767b242240d
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
curl@8.5.0-2ubuntu10.8
8.5.0-2ubuntu10.10
1
ghcr.io/camunda-community-hub/zeebe-simple-monitor:2.6.2d9d796a1b846
curl@7.81.0-1ubuntu1.15
7.81.0-1ubuntu1.25
1
ghcr.io/cedar2025/xboard:latest896e4926e0d7
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/cloudscript-technology/dumpscript:v0.0.42-alpine-edgefce5b6fd161c
curl@8.19.0-r0
8.21.0-r0
1
ghcr.io/cosmicrocks/datum:v0.4.0beta76771c3cc8c3
curl@8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.10
1
ghcr.io/cross-seed/cross-seed:6.13.7a1fed512261f
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/dakera-ai/dakera-dashboard:0.3.292e059589f7f7
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/damap-org/damap-backend:5.0.0f3d0c7d35498
curl@8.5.0-2ubuntu10.9
8.5.0-2ubuntu10.10
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
curl@7.81.0-1ubuntu1.15
7.81.0-1ubuntu1.25
1
ghcr.io/djerfy/zabbix-kubernetes-discovery:v1.4.207a50c07e7c69
curl@8.5.0-2ubuntu10.5
8.5.0-2ubuntu10.10
1
ghcr.io/duyet/clickhouse-monitoring:latest84edfe8a67a8
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/ethpandaops/benchmarkoor-ui:latestd090bb2060d9
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/ethpandaops/dispatchoor-web:latest18e30413dac2
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/fluxcd/kustomize-controller:v1.9.23aecec8bafdb
curl@8.19.0-r0
8.22.0-r0
1
ghcr.io/formancehq/membership:v1.11.024a0113d5fb0
curl@7.81.0-1ubuntu1.20
7.81.0-1ubuntu1.25
1
ghcr.io/gchq/cyberchef:11.0.045082a0ac41d
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/gla-rad/enav-eureka:latest05002092c621
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/gluufederation/flex/persistence-loader:0.0.0-nightlyc26589258dec
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/gregperlinli/certvault:2.12.0a7d0cc9e260a
curl@8.5.0-2ubuntu10.6
8.5.0-2ubuntu10.10
1
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/home-operations/lidarr:3.1.29df1e14c8e09
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/home-operations/lidarr:3.1.2.4902dab0e07502a3
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/home-operations/plex:1.43.1a9c3723cb31c
curl@8.5.0-2ubuntu10.8
8.5.0-2ubuntu10.10
1
ghcr.io/home-operations/prowlarr:2.4.0b7da6e9defbe
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/home-operations/qbittorrent:5.2.224f2d793cb7f
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/home-operations/qbittorrent:5.1.4bb82ad6668f8
curl@8.17.0-r1
8.22.0-r0
1
ghcr.io/home-operations/radarr:6.2.1a566e7d364b9
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/home-operations/sonarr:4.0.171989718e9fce
curl@8.20.0-r1
8.21.0-r0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.