CVE-2026-113351
HighAdvisory
Published 20 Oct 2026In the index since 24 Oct 2026
- Severity
- High
- worst across findings
- CVSS
- 8.2
- base score, highest
- EPSS
- 0.005
- 40th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 801
- of 18,232 indexed, latest versions
- Container images
- 676
- deployed by those charts
- Fix available
- None
- affected packages
CVE-2026-113351 affecting package expat 2.8.3-2
Carried by container images the latest versions of 801 of 18,232 indexed charts deploy, on 676 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| expatdeb | 2.5.0-1, 2.5.0-1+deb12u1, 2.5.0-1+deb12u2, 2.5.0-1+deb12u3+11 more | no fix listed | 674 |
| expatrpm | 2.8.2-1.azl3 | no fix listed | 2 |
Charts affected
801 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| castopodhelmforgeVerified publisher | 1.2.13 | 1 of 3See more | 11,481 |
| changedetectionhelmforgeVerified publisher | 1.1.20 | 1 of 1See more | 3,129 |
| chiefonboardinghelmforgeVerified publisher | 1.1.17 | 1 of 3See more | 9,393 |
| dawarichhelmforgeVerified publisher | 1.0.8 | 2 of 4See more | 12,886 |
| discount-bandithelmforgeVerified publisher | 2.0.12 | 1 of 3See more | 41,958 |
| druidhelmforgeVerified publisher | 1.3.9 | 1 of 4See more | 8,810 |
| drupalhelmforgeVerified publisher | 1.2.18 | 1 of 2See more | 18,488 |
| entehelmforgeVerified publisher | 1.0.4 | 1 of 4See more | 5,392 |
| fastmcp-serverhelmforgeVerified publisher | 1.7.5 | 1 of 1See more | 4,077 |
| generichelmforgeVerified publisher | 3.1.7 | 1 of 1See more | 1,785 |
| hermes-agenthelmforgeVerified publisher | 1.0.2 | 1 of 1See more | 8,093 |
| immichhelmforgeVerified publisher | 1.2.13 | 2 of 5See more | 13,985 |
| jenkinshelmforgeVerified publisher | 1.0.11 | 1 of 1See more | 2,306 |
| jupyterhubhelmforgeVerified publisher | 1.0.7 | 1 of 3See more | 6,536 |
| mcp-serverhelmforgeVerified publisher | 1.0.0 | 1 of 1See more | 4,214 |
| medikeephelmforgeVerified publisher | 2.0.5 | 1 of 3See more | 7,094 |
| middlewarehelmforgeVerified publisher | 1.2.11 | 1 of 4See more | 64,802 |
| moodlehelmforgeVerified publisher | 1.1.5 | 1 of 2See more | 35,755 |
| nextcloudhelmforgeVerified publisher | 2.0.4 | 1 of 3See more | 7,214 |
| opensignhelmforgeVerified publisher | 1.0.0 | 1 of 3See more | 70,650 |
| paperless-ngxhelmforgeVerified publisher | 1.1.1 | 1 of 4See more | 8,878 |
| phpmyadminhelmforgeVerified publisher | 2.1.2 | 1 of 1See more | 5,716 |
| mywebhelm-httpdVerified publisher | 0.3.0 | 1 of 1See more | 1,520 |
| myapphelmingapp | 0.1.0 | 1 of 1See more | 84,323 |
| jellyfinhelm-l3st86Verified publisher | 0.1.8 | 1 of 1See more | 1,660 |
| openaevhelm-openbasVerified publisher | 2.0.17 | 1 of 7See more | 80,323 |
| openbashelm-openbasVerified publisher | 1.8.14 | 1 of 7See more | 85,165 |
| my-nginxhelmtaiwo | 0.1.0 | 1 of 1See more | 1,712 |
| samplehelmapphelmtraining | 3.0.0 | 1 of 1See more | 6,585 |
| paperlesshomelabcihelmchartstestVerified publisher | 9.1.9 | 1 of 1See more | 19,601 |
| paperlesshpVerified publisher | 0.1.2 | 2 of 5See more | 42,418 |
| hydrahydraVerified publisher | 0.9.5 | 1 of 2See more | 10,539 |
| isolated-vmhydraVerified publisher | 0.9.4 | 1 of 1See more | 9,064 |
| nginx-charthyomin-nginx | 0.1.0 | 1 of 1See more | 1,712 |
| nginx-charthyun-nginx | 0.1.0 | 1 of 1See more | 1,712 |
| ibexaibexaVerified publisher | 3.11.1 | 1 of 10See more | 8,060 |
| ibm-microclimateibm-charts | 0.1.0 | 1 of 8See more | 114,272 |
| nextjsicoretechVerified publisher | 1.2.0 | 1 of 1See more | 1,712 |
| ilum-unity-catalogilumVerified publisher | 0.1.0 | 1 of 4See more | 68,389 |
| web-chartimcherry5778 | 0.1.0 | 1 of 1See more | 1,965 |
| onechartimioVerified publisher | 0.76.0 | 1 of 1See more | 1,712 |
| infisicalinfisical-charts | 0.4.2 | 1 of 3See more | 2,830 |
| infisical-standaloneinfisical-charts | 1.11.1 | 1 of 5See more | 2,830 |
| guardrails-usvcinfracloud-chartsVerified publisher | 1.0.1 | 1 of 1See more | 6,141 |
| op-stackinfradao | 0.0.1 | 1 of 1See more | 1,712 |
| intelowlintelowl-helm | 6.6.1-01-06-2026 | 1 of 5See more | 98,094 |
| inventreeinventreeOfficialVerified publisher | 0.4.34 | 2 of 2See more | 6,610 |
| tekton-git-listeneritsmethemojoVerified publisher | 0.1.1 | 1 of 1See more | 1,939 |
| thehiveittrident-oss | 0.1.0 | 1 of 6See more | 5,327 |
| opencloudjacobcolvinVerified publisher | 0.2.3 | 6 of 13See more | 50,645 |
Container images carrying it
676 by charts deploying them
A fixed version is listed for 0 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | 4c41e2d0a3a5 | expat | no fix listed | 54 |
| jenkins/ | a660310e39ad | expat | no fix listed | 19 |
| library/ | a7675fcee220 | expat | no fix listed | 17 |
| library/ | 7be37bf763b4 | expat | no fix listed | 13 |
| library/ | bc4cad49969a | expat | no fix listed | 13 |
| library/ | f9ea18bfa4fa | expat | no fix listed | 12 |
| library/ | 8632b3314d74 | expat | no fix listed | 11 |
| quay.io/ | 95d6f0e05636 | expat | no fix listed | 6 |
| bitnamilegacy/ | c74b703deed2 | expat | no fix listed | 5 |
| jellyfin/ | aefb67e6a7ff | expat | no fix listed | 5 |
| library/ | 956eac231bb3 | expat | no fix listed | 5 |
| postgis/ | e84455a058f6 | expat | no fix listed | 5 |
| ghcr.io/ | c80ae007ce2c | expat | no fix listed | 5 |
| flaresolverr/ | 139dfee1c6f8 | expat | no fix listed | 4 |
| library/ | 287ff321f9e3 | expat | no fix listed | 4 |
| library/ | 9bf97bd7714f | expat | no fix listed | 4 |
| library/ | 62a50b1419fe | expat | no fix listed | 4 |
| opea/ | 0c25aab3f106 | expat | no fix listed | 4 |
| ghcr.io/ | 04eaae7915ba | expat | no fix listed | 4 |
| bitnamilegacy/ | cd354d5b2556 | expat | no fix listed | 3 |
| dnationcloud/ | 78fed4f3c130 | expat | no fix listed | 3 |
| freikin/ | b533e6eac446 | expat | no fix listed | 3 |
| library/ | a30cd4cd57f3 | expat | no fix listed | 3 |
| library/ | c842ac797bd1 | expat | no fix listed | 3 |
| library/ | a588aa535370 | expat | no fix listed | 3 |
| library/ | 332d0beea97c | expat | no fix listed | 3 |
| library/ | a484819eb602 | expat | no fix listed | 3 |
| library/ | da3c72f9886f | expat | no fix listed | 3 |
| ghcr.io/ | 6a5594b7b32c | expat | no fix listed | 3 |
| ghcr.io/ | 9bc6e8248891 | expat | no fix listed | 3 |
| ghcr.io/ | d232cba37cc0 | expat | no fix listed | 3 |
| quay.io/ | 6545dac92173 | expat | no fix listed | 3 |
| quay.io/ | 709c7da19c5a | expat | no fix listed | 3 |
| cagriekin/ | 44ec6f90669f | expat | no fix listed | 2 |
| chromedp/ | 313ed7255ae1 | expat | no fix listed | 2 |
| frinx/ | 9cd0147a09bd | expat | no fix listed | 2 |
| frinx/ | 7832e3589dba | expat | no fix listed | 2 |
| gjeanmart/ | 926264c8f2d1 | expat | no fix listed | 2 |
| gotenberg/ | aa552cc115db | expat | no fix listed | 2 |
| graviteeio/ | 5ff7976c6355 | expat | no fix listed | 2 |
| graviteeio/ | 44d1d17ff3b1 | expat | no fix listed | 2 |
| hjacobs/ | 4b2147f47425 | expat | no fix listed | 2 |
| infisical/ | dbc5be2079b6 | expat | no fix listed | 2 |
| jenkins/ | b470bcdc4ecd | expat | no fix listed | 2 |
| jenkins/ | c4098086090c | expat | no fix listed | 2 |
| juicedata/ | 103ac60b6b9c | expat | no fix listed | 2 |
| langgenius/ | 09b7e8705673 | expat | no fix listed | 2 |
| library/ | 6e23479198b9 | expat | no fix listed | 2 |
| library/ | 98f8ec75657d | expat | no fix listed | 2 |
| library/ | 9dd288848f44 | expat | no fix listed | 2 |