CVE-2026-1757

Medium

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.2; base score, highest
EPSS: 0.002; 10th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 404; of 17,787 indexed, latest versions
Container images: 375; deployed by those charts
Fix available: 1 of 1; affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 404 of 17,787 indexed charts deploy, on 375 images.

Affected package	Affected versions	Fixed in	Images
libxml2deb	2.9.14+dfsg-1.2, 2.9.14+dfsg-1.3~deb12u1, 2.9.14+dfsg-1.3~deb12u2, 2.9.14+dfsg-1.3~deb12u4+5 more	2.9.14+dfsg-1.3~deb12u6, 2.12.7+dfsg+really2.9.14-2.1+deb13u3, 2.14.5+dfsg-0.2ubuntu0.2	375

OSV records: DEBIAN-CVE-2026-1757 UBUNTU-CVE-2026-1757
Also known as: USN-8460-1

Charts affected

404 by stars

Chart

Latest

Affected images

Radar Score

giteawenerme

12.7.0

2 of 4 See more

gitea wenerme 12.7.0

2 of the 4 container images this version deploys carry CVE-2026-1757.

Container image	Digest	Package	Fixed in
bitnamilegacy/pgpool :4.6.3-debian-12-r0	d3bf3910f148	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u6
bitnamilegacy/postgresql-repmgr :17.6.0-debian-12-r2	f12387ec882b	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u6

Open the chart page →

8,811

keycloakwiremind

25.3.1

1 of 2 See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-1757.

Container image	Digest	Package	Fixed in
bitnamilegacy/postgresql :17.6.0-debian-12-r4	926356130b77	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u6

Open the chart page →

7,624

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-1757.

Container image	Digest	Package	Fixed in
ghcr.io/bat-bs/bitnami-pgvector :pg16	19ebe07b4daf	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6

Open the chart page →

11,577

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-1757.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6

Open the chart page →

7,673

Container images carrying it

375 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/paperless-ngx/paperless-ngx :2.0.1	ab255bea133e	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u2	2.12.7+dfsg+really2.9.14-2.1+deb13u3	1
ghcr.io/pschichtel/s3-backup :0.7.0	17666811f6a7	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u2	2.12.7+dfsg+really2.9.14-2.1+deb13u3	1
ghcr.io/qubiva/qubiva :v0.3.2	cdf1e3329bfe	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u2	2.12.7+dfsg+really2.9.14-2.1+deb13u3	1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
ghcr.io/substra/substra-frontend :1.0.0	e230e6ac0722	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
ghcr.io/wgbh-mla/pbcore-util :pr-6	6e04659a3baa	libxml2@2.9.14+dfsg-1.3~deb12u5	2.9.14+dfsg-1.3~deb12u6	1
ghcr.io/wiremind/grafana-pdf-exporter :v1.7	dbaa8527bf4c	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
ghcr.io/woodenmaiden/relfinderreformedfront :latest	344f53763b25	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
ghcr.io/yurymkomarov/docker/kubernetes-kiosk-chromium :0.1.2	7bff29dcec72	libxml2@2.9.14+dfsg-1.3~deb12u5	2.9.14+dfsg-1.3~deb12u6	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
public.ecr.aws/jtekt-corporation/image-storage-service-gui :v1.9.4	34823c8abe00	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
public.ecr.aws/jtekt-corporation/shinsei-manager-front :v1.5.5	f8fb4eea4071	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
quay.io/jupyterhub/k8s-hub :4.3.5	113e372cf71b	libxml2@2.9.14+dfsg-1.3~deb12u5	2.9.14+dfsg-1.3~deb12u6	1
quay.io/jupyterhub/k8s-hub :4.3.4	92f883d09270	libxml2@2.9.14+dfsg-1.3~deb12u5	2.9.14+dfsg-1.3~deb12u6	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u6	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend :1.0.31	66353ce9bf98	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u2	2.12.7+dfsg+really2.9.14-2.1+deb13u3	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	libxml2@2.9.14+dfsg-1.3~deb12u5	2.9.14+dfsg-1.3~deb12u6	1
registry.gitlab.com/school_guy/docker-typo3 :13.4.30-197d868e	d76185d7270d	libxml2@2.9.14+dfsg-1.3~deb12u5	2.9.14+dfsg-1.3~deb12u6	1