StackRadar

CVE-2026-102633

Medium

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
778
of 17,957 indexed, latest versions
Container images
648
deployed by those charts
Fix available
None
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 778 of 17,957 indexed charts deploy, on 648 images.

Affected packageAffected versionsFixed inImages
expatdeb2.5.0-1, 2.5.0-1+deb12u1, 2.5.0-1+deb12u2, 2.5.0-1+deb12u3+6 moreno fix listed648
OSV records
DEBIAN-CVE-2026-102633
Trending
Rank 32 in indexed charts, since 30 Sept 2026. See the ranking →

Charts affected

778 by stars
ChartLatestAffected imagesRadar Score
tfy-distributortruefoundryVerified publisher0.0.11 of 4See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
expat@2.5.0-1
no fix listed

Open the chart page →

18,124
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
bitnamilegacy/kubectl:1.301249fc292e84
expat@2.5.0-1+deb12u1
no fix listed

Open the chart page →

9,013
applicationuniversal-helm-chartVerified publisher0.4.51 of 1See more

application universal-helm-chart 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,765
unlaunla0.10.01 of 3See more

unla unla 0.10.0

1 of the 3 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
ghcr.io/amoylab/unla/web:latesteac1df1c5e66
expat@2.5.0-1+deb12u1
no fix listed

Open the chart page →

9,416
opencloudunxwaresVerified publisher0.2.36 of 13See more

opencloud unxwares 0.2.3

6 of the 13 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
opencloudeu/web-extensions:unzip-1.0.01691ad6612a3
expat@2.5.0-1+deb12u1
no fix listed
opencloudeu/web-extensions:draw-io-1.0.027cb9b952f0d
expat@2.5.0-1+deb12u1
no fix listed
opencloudeu/web-extensions:external-sites-1.0.05b176baa3694
expat@2.5.0-1+deb12u1
no fix listed
opencloudeu/web-extensions:importer-1.0.06e8b2df6c5a4
expat@2.5.0-1+deb12u1
no fix listed
opencloudeu/web-extensions:progress-bars-1.0.082f888a34440
expat@2.5.0-1+deb12u1
no fix listed
opencloudeu/web-extensions:json-viewer-1.0.0e0ac35a9576e
expat@2.5.0-1+deb12u1
no fix listed

Open the chart page →

46,735
demo-backendv2flyVerified publisher0.0.31 of 1See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
expat@2.5.0-1
no fix listed

Open the chart page →

15,088
vaultwardenvaultwarden-helmVerified publisher1.2.71 of 2See more

vaultwarden vaultwarden-helm 1.2.7

1 of the 2 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/postgresql:18.4-system-trixie42708a75345b
expat@2.8.2-1~deb13u1
no fix listed

Open the chart page →

2,045
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
expat@2.5.0-1+deb12u1
no fix listed

Open the chart page →

11,496
video-dl-botvideo-dl-botVerified publisher1.4.31 of 1See more

video-dl-bot video-dl-bot 1.4.3

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
ghcr.io/tarampampam/video-dl-bot:1.4.36daa2dc7556b
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

2,105
argus-test-envvk-helm-charts2.0.01 of 1See more

argus-test-env vk-helm-charts 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,765
aih-scannerwallarmVerified publisher2.9.01 of 2See more

aih-scanner wallarm 2.9.0

1 of the 2 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
wallarm/aih-scanner:2.9.0b39795d50e83
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

3,118
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
expat@2.5.0-1+deb12u1
no fix listed

Open the chart page →

6,197
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
expat@2.5.0-1
no fix listed

Open the chart page →

7,486
web-dvwaweb-dvwa1.16.01 of 2See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
gulacedia/web-dvwa-new:v367b467d961ca
expat@2.5.0-1
no fix listed

Open the chart page →

10,447
jenkinswebencryptor1.9.181 of 1See more

jenkins webencryptor 1.9.18

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

2,766
juicefs-csi-driverwener0.33.01 of 5See more

juicefs-csi-driver wener 0.33.0

1 of the 5 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.0f918e7331c05
expat@2.5.0-1+deb12u3
no fix listed

Open the chart page →

9,591
juicefs-csi-driverwenerme0.33.01 of 5See more

juicefs-csi-driver wenerme 0.33.0

1 of the 5 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.33.0f918e7331c05
expat@2.5.0-1+deb12u3
no fix listed

Open the chart page →

9,591
marge-botwiremindVerified publisher1.4.41 of 1See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
hiboxsystems/marge-bot:0.14.0dcffb926e563
expat@2.5.0-1
no fix listed

Open the chart page →

5,770
Wordpresswordpress-mariadb1.0.21 of 2See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
library/wordpress:latest8746e7e072e3
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

4,986
wordpresswordpress-ng1.0.101 of 2See more

wordpress wordpress-ng 1.0.10

1 of the 2 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
cloudtooling/wordpress:7.1.20b390e7e3425
expat@2.5.0-1+deb12u3
no fix listed

Open the chart page →

4,096
tabbyxdVerified publisher1.0.61 of 2See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
library/nginx:1.25a484819eb602
expat@2.5.0-1
no fix listed

Open the chart page →

7,980
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
expat@2.5.0-1+deb12u1
no fix listed

Open the chart page →

14,050
nginx-chartxxoznge-nginx0.1.01 of 1See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,765
my-nginx-appyasser-nginx-app0.1.01 of 1See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
library/nginx:stableb972f831f200
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,765
jenkinszanise-jenkins-helm-chart0.1.01 of 1See more

jenkins zanise-jenkins-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

2,766
changedetection-iozekker6Verified publisher1.102.01 of 1See more

changedetection-io zekker6 1.102.0

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.7096dae27b5d6
expat@2.5.0-1+deb12u3
no fix listed

Open the chart page →

2,916
NEW_APPzekker6Verified publisher0.0.01 of 1See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,765
sockpuppetbrowserzekker6Verified publisher0.1.01 of 1See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102633.

Container imageDigestPackageFixed in
dgtlmoon/sockpuppetbrowser:latest1d8f72d2ce20
expat@2.5.0-1+deb12u3
no fix listed

Open the chart page →

4,916

Container images carrying it

648 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
sslhep/servicex_code_gen_raw_uproot:v1.8.61494a81a474b
expat@2.8.3-1~deb13u1
no fix listed
1
sslhep/servicex_code_gen_topcp:v1.8.6f7faf8c6c3e4
expat@2.8.3-1~deb13u1
no fix listed
1
sslhep/servicex-did-finder-atlasopenmagic:v1.8.6bd738c952e72
expat@2.8.3-1~deb13u1
no fix listed
1
sslhep/servicex-did-finder-cernopendata:v1.8.623a80e40ab18
expat@2.8.3-1~deb13u1
no fix listed
1
sslhep/servicex-did-finder-xrootd:v1.8.69a9fb17458f1
expat@2.8.3-1~deb13u1
no fix listed
1
substratusai/verba:v0.4.0-baseURL261695be635eb
expat@2.5.0-1
no fix listed
1
supabase/realtime:latest7a6d995635f7
expat@2.7.1-2
no fix listed
1
supabase/realtime:v2.102.3aa1c92c0cf32
expat@2.5.0-1+deb12u2
no fix listed
1
supabase/studio:20241021-9f9b08326d8070c55e9
expat@2.5.0-1+deb12u1
no fix listed
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
expat@2.5.0-1+deb12u2
no fix listed
1
supabase/studio:latestfdb56cfa1705
expat@2.5.0-1+deb12u3
no fix listed
1
svtechnmaa/svtech_nagvis:v1.2.118394b08e6c3
expat@2.5.0-1
no fix listed
1
swimmwatch/cloakbrowser-mcp:1.14.1f6986203a121
expat@2.5.0-1+deb12u3
no fix listed
1
sysnet4admin/colosseum-cms:loge74b43c7f492
expat@2.5.0-1+deb12u1
no fix listed
1
sysnet4admin/colosseum-prm:log5802bfcd7fed
expat@2.5.0-1+deb12u1
no fix listed
1
teknas09/bird-pod:latest12a1fa85c4aa
expat@2.5.0-1
no fix listed
1
tenureai/tenure:v1.0.285f5b222df9a5
expat@2.7.1-2+dhi4
no fix listed
1
theradius/loggia:0.463ba348546ec
expat@2.5.0-1
no fix listed
1
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
expat@2.7.1-2
no fix listed
1
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
expat@2.7.1-2
no fix listed
1
thingsboard/tb-postgres:latest2d17e4e36edc
expat@2.5.0-1+deb12u2
no fix listed
1
thongngo3301/stakefish:latesta341af5976e3
expat@2.5.0-1
no fix listed
1
tianon/exim4:latestaa8ddf38e160
expat@2.8.3-1~deb13u1
no fix listed
1
tinymediamanager/tinymediamanager:5.3.36f332431a2ae
expat@2.7.1-2
no fix listed
1
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
expat@2.7.1-2
no fix listed
1
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
expat@2.5.0-1+deb12u1
no fix listed
1
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
expat@2.7.1-2
no fix listed
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
expat@2.5.0-1+deb12u1
no fix listed
1
vlebediantsev/notes-admin-front:latest007c6670ff48
expat@2.5.0-1
no fix listed
1
vlebediantsev/notes-project-front:latest945675fd2636
expat@2.5.0-1
no fix listed
1
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
expat@2.5.0-1
no fix listed
1
voska/hass-mcp:latest7142a431e2c5
expat@2.5.0-1+deb12u1
no fix listed
1
wallarm/aih-scanner:2.9.0b39795d50e83
expat@2.8.3-1~deb13u1
no fix listed
1
wiktorn/overpass-api:latest9bb5f4a9b54c
expat@2.5.0-1+deb12u2
no fix listed
1
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
expat@2.5.0-1
no fix listed
1
xom4ekp2p/infini-route-attestators-public-mainnet-avs-webapi:latest2745b5fd8785
expat@2.5.0-1
no fix listed
1
yetiplatform/yeti:2.9.09bcbe2650a14
expat@2.8.3-1~deb13u1
no fix listed
1
yetiplatform/yeti:latest9c3006cedcca
expat@2.8.3-1~deb13u1
no fix listed
1
yetiplatform/yeti-frontend:latest709064278c7e
expat@2.8.3-1~deb13u1
no fix listed
1
yetiplatform/yeti-frontend:2.9.0873ef15d267b
expat@2.8.3-1~deb13u1
no fix listed
1
gcr.io/ml-pipeline/metadata-writer:2.3.09bcfd2abc361
expat@2.5.0-1
no fix listed
1
ghcr.io/aeharding/voyager:latest8e9d9ed499e3
expat@2.8.3-1~deb13u1
no fix listed
1
ghcr.io/afairgiant/medikeep:v0.71.0086579173033
expat@2.5.0-1+deb12u3
no fix listed
1
ghcr.io/amoylab/unla/web:latesteac1df1c5e66
expat@2.5.0-1+deb12u1
no fix listed
1
ghcr.io/angelscloud/prometheus-optimizer:latest744bc929a579
expat@2.5.0-1+deb12u1
no fix listed
1
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
expat@2.7.1-2
no fix listed
1
ghcr.io/argonix-io/argonix-api:0.5.5aa0e3efe5840
expat@2.8.3-1~deb13u1
no fix listed
1
ghcr.io/astradns/astradns-agent:v0.2.9-unbound6ba69487f1b0
expat@2.5.0-1+deb12u2
no fix listed
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
expat@2.5.0-1
no fix listed
1
ghcr.io/avistotelecom/docker-wazuh-agent:4.12.08766ba08bf1a
expat@2.5.0-1+deb12u1
no fix listed
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.