StackRadar

CVE-2026-9546

High

Advisory

Published 3 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
125
of 17,781 indexed, latest versions
Container images
113
deployed by those charts
Fix available
1 of 1
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 125 of 17,781 indexed charts deploy, on 113 images.

Affected packageAffected versionsFixed inImages
curlapk8.18.0-r0, 8.19.0-r0, 8.20.0-r0, 8.20.0-r18.21.0-r0, 8.22.0-r0113
OSV records
ALPINE-CVE-2026-9546

Charts affected

125 by stars
ChartLatestAffected imagesRadar Score
forkliftkubevirt-forkliftVerified publisher0.3.01 of 2See more

forklift kubevirt-forklift 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
openresty/openresty:1.31.1.1-1-alpine-fatacd832254d9c
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,417
librenmslibrenms10.1.11 of 5See more

librenms librenms 10.1.1

1 of the 5 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
librenms/librenms:26.8.28194a4a9ff49
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

3,126
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

2,444
sonarrloeken-at-homeVerified publisher4.0.171 of 1See more

sonarr loeken-at-home 4.0.17

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
loeken/sonarr:4.0.17b940520a2236
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

866
nubladolsst-sqre0.9.231 of 5See more

nublado lsst-sqre 0.9.23

1 of the 5 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
jupyterhub/configurable-http-proxy:latest69a7170eeeda
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

5,786
decap-cmsm11sVerified publisher0.3.151 of 1See more

decap-cms m11s 0.3.15

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
m11s/decap-cms:0.2.11-s30cd6810c9885
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,151
mayastormayastorVerified publisher2.12.11 of 31See more

mayastor mayastor 2.12.1

1 of the 31 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
openebs/provisioner-localpv:4.6.099f5116f5cb8
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

21,064
kube-prometheus-stackmesosphere87.16.01 of 7See more

kube-prometheus-stack mesosphere 87.16.0

1 of the 7 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

7,398
dependency-tracknaj980.0.91 of 3See more

dependency-track naj98 0.0.9

1 of the 3 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
dependencytrack/frontend:latest8854a8320475
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

2,465
pro-builderopenfaas0.6.131 of 2See more

pro-builder openfaas 0.6.13

1 of the 2 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
moby/buildkit:v0.32.2-rootless504731e577c2
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

2,726
openobserveopenobserve0.92.21 of 6See more

openobserve openobserve 0.92.2

1 of the 6 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
natsio/nats-box:0.19.7ffce8bd10338
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

3,157
static-sitepodzone-chartsVerified publisher0.1.11 of 2See more

static-site podzone-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
library/httpd:alpine1b766f17b840
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

6,565
delugeretsamedocVerified publisher26.9.01 of 1See more

deluge retsamedoc 26.9.0

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
linuxserver/deluge:2.2.09505c64720af
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

781
caddy-reverse-proxyromholdings0.10.11 of 1See more

caddy-reverse-proxy romholdings 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
library/caddy:latestdf7f1c2fb114
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

845
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
curl@8.18.0-r0
8.21.0-r0

Open the chart page →

5,819
cinnyappschoenwald1.0.111 of 1See more

cinnyapp schoenwald 1.0.11

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
ghcr.io/cinnyapp/cinny:v4.12.6a7805a8a60ff
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

804
frontendsignalen4.24.01 of 1See more

frontend signalen 4.24.0

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
signalen/frontend:2.27.81ab79cb7fe21
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,161
ipsecsinextraVerified publisher0.6.41 of 1See more

ipsec sinextra 0.6.4

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/ipsec:5.236f4e651d1fe
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

683
smtpsmtpVerified publisher1.3.31 of 1See more

smtp smtp 1.3.3

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

1,437
buildkitsomaz94Verified publisher0.1.41 of 1See more

buildkit somaz94 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
moby/buildkit:v0.33.06c2fa84a6b61
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

722
sqs-to-snssqs-to-sns2.0.151 of 1See more

sqs-to-sns sqs-to-sns 2.0.15

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
udhos/sqs-to-sns:2.0.15cf7979da82e1
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

956
ats-ingresstrafficserver-ingress-controller0.1.01 of 1See more

ats-ingress trafficserver-ingress-controller 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
ghcr.io/apache/ats-ingress:latest2d4d776f6362
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

414
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

5,550
metabasewiremindVerified publisher2.27.5-wiremind01 of 1See more

metabase wiremind 2.27.5-wiremind0

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
metabase/metabase:v0.61.1.x9491ed11c901
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,639
xboardxboard0.2.01 of 1See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-9546.

Container imageDigestPackageFixed in
ghcr.io/cedar2025/xboard:latest896e4926e0d7
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

1,042

Container images carrying it

113 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
grafana/grafana:13.1.0121a7a9ece6d
curl@8.20.0-r1
8.21.0-r0
4
library/httpd:2.4-alpine:alpine1b766f17b840
curl@8.20.0-r1
8.21.0-r0
4
natsio/nats-box:0.19.7ffce8bd10338
curl@8.19.0-r0
8.22.0-r0
3
alpine/k8s:1.32.12048f8d9c8cc7
curl@8.18.0-r0
8.21.0-r0
2
gisaia/arlas-fam-wui:0.18.13700dcaf7a75
curl@8.20.0-r0
8.22.0-r0
2
gisaia/arlas-wui:28.0.3b83b3e067173
curl@8.19.0-r0
8.22.0-r0
2
gisaia/arlas-wui-builder:28.0.1a35977a5bb7d
curl@8.19.0-r0
8.22.0-r0
2
gisaia/arlas-wui-hub:28.0.21a3cc43d822f
curl@8.19.0-r0
8.22.0-r0
2
jupyterhub/configurable-http-proxy:5.3.0:latest69a7170eeeda
curl@8.19.0-r0
8.22.0-r0
2
library/caddy:2.11.4-alpine:2-alpine5f5c8640aae0
curl@8.19.0-r0
8.22.0-r0
2
library/caddy:latestdf7f1c2fb114
curl@8.19.0-r0
8.22.0-r0
2
metabase/metabase:v0.61.1.x9491ed11c901
curl@8.19.0-r0
8.22.0-r0
2
moby/buildkit:v0.32.2-rootless504731e577c2
curl@8.20.0-r0
8.22.0-r0
2
openebs/provisioner-localpv:4.6.099f5116f5cb8
curl@8.20.0-r0
8.22.0-r0
2
syncthing/syncthing:2.1.1775c4aac4862
curl@8.19.0-r0
8.22.0-r0
2
ghcr.io/cinnyapp/cinny:v4.12.6a7805a8a60ff
curl@8.19.0-r0
8.22.0-r0
2
ghcr.io/home-assistant/home-assistant:2026.9.1:latest612d76760b54
curl@8.20.0-r1
8.21.0-r0
2
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
curl@8.20.0-r1
8.21.0-r0
2
alpine/helm:4.1.0905a068da431
curl@8.18.0-r0
8.21.0-r0
1
alpine/k8s:1.36.244ef4942e171
curl@8.20.0-r1
8.21.0-r0
1
alpine/k8s:1.35.6b7a12c5ddf26
curl@8.20.0-r1
8.21.0-r0
1
alpine/k8s:1.35.5d870622d0040
curl@8.20.0-r1
8.21.0-r0
1
appwrite/appwrite:1.9.6adc7d0e7ec23
curl@8.19.0-r0
8.22.0-r0
1
byjg/easy-haproxy:6.1.1230fdb7b00ae
curl@8.20.0-r1
8.21.0-r0
1
casbin/casdoor:3.62.17729da148c61
curl@8.19.0-r0
8.22.0-r0
1
casbin/casdoor:3.62.0e08231f16c00
curl@8.19.0-r0
8.22.0-r0
1
clamav/clamav:1.0dd0d9cc746af
curl@8.20.0-r1
8.21.0-r0
1
dependencytrack/frontend:latest8854a8320475
curl@8.19.0-r0
8.22.0-r0
1
devkrishan001/frontend:latesta0ad60836e6b
curl@8.19.0-r0
8.22.0-r0
1
dragonflyoss/scheduler:v2.5.2-rc.06d710dc2bae0
curl@8.20.0-r0
8.22.0-r0
1
eclipseaerios/management-portal-frontend:1.2.23a8e4cf60629
curl@8.19.0-r0
8.22.0-r0
1
epamedp/edp-gerrit:3.14.249e8fe9c4855
curl@8.20.0-r0
8.22.0-r0
1
espocrm/espocrm:10.0.8-fpm-alpine4bd92daf5f0c
curl@8.20.0-r0
8.22.0-r0
1
filebrowser/filebrowser:v2.63.15-s6dbac07403040
curl@8.19.0-r0
8.22.0-r0
1
folioci/mod-graphql:latestf0655a6a08fd
curl@8.20.0-r0
8.22.0-r0
1
geonode/geoserver_data:2.28.4-latest435cbc5f3f05
curl@8.20.0-r1
8.21.0-r0
1
gitea/gitea:1.26.27d13848af126
curl@8.19.0-r0
8.22.0-r0
1
gomods/athens:v0.18.197cc113b34b0
curl@8.20.0-r0
8.22.0-r0
1
google/cloud-sdk:alpinef7d3e6d6d4f4
curl@8.20.0-r0
8.22.0-r0
1
graviteeio/ae-engine:3.0.24140932887e0
curl@8.20.0-r0
8.22.0-r0
1
haproxytech/haproxy-alpine:3.4.37a3ef2dd8b5b
curl@8.20.0-r0
8.22.0-r0
1
haproxytech/haproxy-unified-gateway:1.0.7b9bffe2d0fd1
curl@8.20.0-r0
8.22.0-r0
1
haproxytech/kubernetes-ingress:3.2.14d90f628d659e
curl@8.20.0-r0
8.22.0-r0
1
homeassistant/home-assistant:2026.75a531753cea9
curl@8.20.0-r1
8.21.0-r0
1
hwdsl2/ipsec-vpn-server:latest2e939ffe5913
curl@8.20.0-r0
8.22.0-r0
1
jesec/flood:4.14.3c887dad96b40
curl@8.20.0-r1
8.21.0-r0
1
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
curl@8.20.0-r0
8.22.0-r0
1
library/caddy:latest13ba145cba2f
curl@8.19.0-r0
8.22.0-r0
1
library/nginx:1.31.0-alpine2f07d83bf561
curl@8.19.0-r0
8.22.0-r0
1
librenms/librenms:26.8.28194a4a9ff49
curl@8.20.0-r0
8.22.0-r0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.