StackRadar

CVE-2026-25210

High

Advisory

Published 30 Jan 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.002
9th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,209
of 17,787 indexed, latest versions
Container images
1,177
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,209 of 17,787 indexed charts deploy, on 1,177 images.

Affected packageAffected versionsFixed inImages
expatdeb2.1.0-4ubuntu1, 2.1.0-4ubuntu1.4, 2.1.0-7ubuntu0.16.04.2, 2.1.0-7ubuntu0.16.04.3+30 more2.1.0-4ubuntu1.4+esm11, 2.1.0-7ubuntu0.16.04.5+esm11, 2.2.5-3ubuntu0.9+esm3, 2.2.9-1ubuntu0.8+esm1+4 more979
expatapk2.5.0-r4, 2.6.2-r0, 2.6.3-r0, 2.6.4-r0+6 more2.7.4-r0198
OSV records
ALPINE-CVE-2026-25210DEBIAN-CVE-2026-25210CGA-5v3h-h3q3-xg43UBUNTU-CVE-2026-25210
Also known as
CGA-mf53-85qx-vr2x, USN-8022-1, USN-8022-2

Charts affected

1,209 by stars
ChartLatestAffected imagesRadar Score
juicefs-csi-driverwenerme0.32.51 of 5See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-25210.

Container imageDigestPackageFixed in
juicedata/juicefs-csi-driver:v0.32.595008ba63318
expat@2.5.0-1+deb12u2
no fix listed

Open the chart page →

8,824
longhornwenerme1.2.31 of 2See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-25210.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.2.3dca34321452c
expat@2.2.9-1build1
2.2.9-1ubuntu0.8+esm1

Open the chart page →

15,287
wexa-studiowexa-studio1.2.01 of 15See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-25210.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
expat@2.7.1-r0
2.7.4-r0

Open the chart page →

14,618
jaegerwikimedia3.1.21 of 4See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-25210.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
expat@2.4.7-1ubuntu0.2
2.4.7-1ubuntu0.7

Open the chart page →

9,296
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-25210.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
expat@2.2.9-1ubuntu0.8
2.2.9-1ubuntu0.8+esm1

Open the chart page →

6,323
marge-botwiremindVerified publisher1.4.41 of 1See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2026-25210.

Container imageDigestPackageFixed in
hiboxsystems/marge-bot:0.14.0dcffb926e563
expat@2.5.0-1
no fix listed

Open the chart page →

5,548
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-25210.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
expat@2.4.7-1ubuntu0.3
2.4.7-1ubuntu0.7

Open the chart page →

14,172
tabbyxdVerified publisher1.0.61 of 2See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-25210.

Container imageDigestPackageFixed in
library/nginx:1.25a484819eb602
expat@2.5.0-1
no fix listed

Open the chart page →

7,685
xkopsxkops0.1.02 of 5See more

xkops xkops 0.1.0

2 of the 5 container images this version deploys carry CVE-2026-25210.

Container imageDigestPackageFixed in
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
expat@2.5.0-1+deb12u1
no fix listed
hamzaarshad10/queryfrontend:1.1.5.14cd359d9a78c3
expat@2.6.3-r0
2.7.4-r0

Open the chart page →

13,197

Container images carrying it

1,177 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
gpappsoft/privacyidea-docker:3.12.2af7841adad26
expat@2.7.3-r0
2.7.4-r0
1
grafana/oncall:v1.16.5499851658393
expat@2.7.0-r0
2.7.4-r0
1
graylog/graylog:6.1.1019de1aff48c2
expat@2.4.7-1ubuntu0.5
2.4.7-1ubuntu0.7
1
grpl/grapple-cli:0.2.127c00aafee6629
expat@2.6.1-2build1
2.6.1-2ubuntu0.4
1
guacamole/guacamole:1.5.50f62f6d17ab3
expat@2.4.7-1ubuntu0.2
2.4.7-1ubuntu0.7
1
guillh/web3-prometheus-exporter:0.3.04fb99dbc32b2
expat@2.5.0-1+deb12u1
no fix listed
1
gulacedia/web-dvwa-new:v367b467d961ca
expat@2.5.0-1
no fix listed
1
hamidyousefi93/saam-test:latestc34f071f6ed0
expat@2.5.0-1
no fix listed
1
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
expat@2.5.0-1+deb12u1
no fix listed
1
hamzaarshad10/queryfrontend:1.1.5.14cd359d9a78c3
expat@2.6.3-r0
2.7.4-r0
1
hashicorp/terraform:1.9.7b77efab1a448
expat@2.6.3-r0
2.7.4-r0
1
hasura/graphql-engine:v2.34.0-ce0111b0204136
expat@2.4.7-1ubuntu0.2
2.4.7-1ubuntu0.7
1
hasura/graphql-engine:v2.48.10f6c1c4b957d2
expat@2.4.7-1ubuntu0.6
2.4.7-1ubuntu0.7
1
haugene/transmission-openvpn:4.0059216cfae4b
expat@2.2.9-1build1
2.2.9-1ubuntu0.8+esm1
1
haveagitgat/tdarr:2.00.181256348872ce
expat@2.2.9-1ubuntu0.4
2.2.9-1ubuntu0.8+esm1
1
haveagitgat/tdarr_node:2.00.101e3f9328327d
expat@2.2.9-1build1
2.2.9-1ubuntu0.8+esm1
1
haveagitgat/tdarr_node:2.17.013ff0913202dd
expat@2.2.9-1ubuntu0.6
2.2.9-1ubuntu0.8+esm1
1
hazegoodlife/haaze:veggiesite50f02d2d5d4d
expat@2.5.0-1+deb12u1
no fix listed
1
hazegoodlife/haaze:milksite8d4c63169e14
expat@2.5.0-1+deb12u1
no fix listed
1
hecrom/myweatherangularclient:1.3.11bb0372939c19
expat@2.5.0-1
no fix listed
1
helicone/clickhouse-migration-runner:v2025.03.05-14c69b971a7e4
expat@2.2.9-1ubuntu0.7
2.2.9-1ubuntu0.8+esm1
1
helicone/supabase-migration-runner:v2025.03.05-14a913936c97b
expat@2.5.0-1
no fix listed
1
helmforge/fastmcp-server:0.2.061f759a1421f
expat@2.7.1-2
2.8.2-1~deb13u1
1
helmforge/fastmcp-server:0.11.2fcb7017327d6
expat@2.7.1-2
2.8.2-1~deb13u1
1
hiboxsystems/marge-bot:0.16.0b59f01bc0418
expat@2.7.1-2
2.8.2-1~deb13u1
1
hiboxsystems/marge-bot:0.14.0dcffb926e563
expat@2.5.0-1
no fix listed
1
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
expat@2.5.0-1+deb12u2
no fix listed
1
hivemq/hivemq-operator:4.7.10241d6a8e1963
expat@2.4.7-1ubuntu0.2
2.4.7-1ubuntu0.7
1
hjacobs/kube-janitor:23.7.0fbb303ed463c
expat@2.5.0-1
no fix listed
1
hjacobs/kube-web-view:23.8.0431f1bf013d0
expat@2.5.0-1
no fix listed
1
hmediade/printserver:latest481a552c8e1c
expat@2.4.7-1ubuntu0.2
2.4.7-1ubuntu0.7
1
hmediade/printserver-init:latest7f005eb6c718
expat@2.4.7-1ubuntu0.2
2.4.7-1ubuntu0.7
1
housewrecker/gaps:latestf417dd0a7547
expat@2.2.9-1ubuntu0.4
2.2.9-1ubuntu0.8+esm1
1
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
expat@2.2.5-3ubuntu0.2
2.2.5-3ubuntu0.9+esm3
1
hugohg34/toposervice:0.0.2812a03b3f274
expat@2.2.9-1ubuntu0.4
2.2.9-1ubuntu0.8+esm1
1
hyperledger/fabric-couchdb:0.4.10c65891b6c237
expat@2.1.0-7ubuntu0.16.04.3
2.1.0-7ubuntu0.16.04.5+esm11
1
ibmcom/ibm-workload-scheduler-agent-dynamic-dev:9.4.0.047e4dc1e27cdf
expat@2.1.0-7ubuntu0.16.04.3
2.1.0-7ubuntu0.16.04.5+esm11
1
ibmcom/icp-swift-sample:latestb5d8c6714dbc
expat@2.1.0-7ubuntu0.16.04.3
2.1.0-7ubuntu0.16.04.5+esm11
1
ibmcom/microclimate-theia:lateste17bdccc5030
expat@2.1.0-7ubuntu0.16.04.3
2.1.0-7ubuntu0.16.04.5+esm11
1
ibmcom/skydive:0.22.0395e60cc6e3d
expat@2.2.5-3
2.2.5-3ubuntu0.9+esm3
1
ildarmukhametzyanov/priceapp:0.115d23720a3ee
expat@2.5.0-1
no fix listed
1
inseefrlab/shelly:cloudshell31f04ca7436b
expat@2.4.7-1ubuntu0.2
2.4.7-1ubuntu0.7
1
instill/artifact-backend:b28766ac4a393e601ed
expat@2.7.1-2
2.8.2-1~deb13u1
1
instill/mgmt-backend:d0933d4ebe12f77a3f9
expat@2.7.1-2
2.8.2-1~deb13u1
1
instill/model-backend:611f0f2e980125e5ba5
expat@2.7.1-2
2.8.2-1~deb13u1
1
intel/dlstreamer-pipeline-server:2022.1.1-ubuntu20aa8f5483a2ef
expat@2.2.9-1ubuntu0.4
2.2.9-1ubuntu0.8+esm1
1
intel/multimodal-data-visualization-streaming:3.01a89327e499b
expat@2.2.9-1ubuntu0.4
2.2.9-1ubuntu0.8+esm1
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
expat@2.5.0-1
no fix listed
1
intelowlproject/intelowl_nginx:v6.6.12f01e79b8064
expat@2.7.3-r0
2.7.4-r0
1
iofog/router:2.0.17260cf861479
expat@2.2.5-3ubuntu0.2
2.2.5-3ubuntu0.9+esm3
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.