StackRadar

CVE-2026-32776

Medium

Advisory

Published 16 Mar 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,385
of 17,792 indexed, latest versions
Container images
1,375
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,385 of 17,792 indexed charts deploy, on 1,375 images.

Affected packageAffected versionsFixed inImages
expatdeb2.1.0-4ubuntu1, 2.1.0-4ubuntu1.4, 2.1.0-7ubuntu0.16.04.2, 2.1.0-7ubuntu0.16.04.3+33 more2.8.2-1~deb13u11,143
expatapk2.5.0-r4, 2.6.2-r0, 2.6.3-r0, 2.6.4-r0+8 more2.7.5-r0232
OSV records
ALPINE-CVE-2026-32776CGA-mxh2-cg9w-8rh2DEBIAN-CVE-2026-32776UBUNTU-CVE-2026-32776
Also known as
CGA-r2qv-8vvf-wqph

Charts affected

1,385 by stars
ChartLatestAffected imagesRadar Score
jellyfinsb-helm-charts0.4.01 of 1See more

jellyfin sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
jellyfin/jellyfin:10.10.317c3a8d9dddb
expat@2.5.0-1+deb12u1
no fix listed

Open the chart page →

4,144
nextcloudsb-helm-charts0.4.01 of 2See more

nextcloud sb-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
library/nextcloud:31.0.10-apacheb7faa1653c39
expat@2.7.1-2
2.8.2-1~deb13u1

Open the chart page →

9,863
pgadminsb-helm-charts0.3.01 of 1See more

pgadmin sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
dpage/pgadmin4:8.13561c1f8f99f2
expat@2.6.4-r0
2.7.5-r0

Open the chart page →

1,713
phpmyadminsb-helm-charts0.3.01 of 1See more

phpmyadmin sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
library/phpmyadmin:5.2.16e75aa8f767c
expat@2.5.0-1+deb12u1
no fix listed

Open the chart page →

5,410
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
expat@2.5.0-1+deb12u2
no fix listed

Open the chart page →

4,715
wordpresssb-helm-charts0.4.01 of 2See more

wordpress sb-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
library/wordpress:6.4.3-apache8ae66efb09a2
expat@2.5.0-1
no fix listed

Open the chart page →

13,610
ed-deploymentscaleway-charts0.1.01 of 1See more

ed-deployment scaleway-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
nginxdemos/hello:plain-text751bf8933179
expat@2.7.1-r0
2.7.5-r0

Open the chart page →

1,294
scapyscapy-containerised0.3.41 of 2See more

scapy scapy-containerised 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
saidsef/scapy-containerised:v2025.02f17f7c435891
expat@2.6.4-r0
2.7.5-r0

Open the chart page →

2,820
gickupschichtelVerified publisher0.0.41 of 1See more

gickup schichtel 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
buddyspencer/gickup:0.10.386b656f19b0c1
expat@2.7.0-r0
2.7.5-r0

Open the chart page →

1,547
jdownloaderschichtelVerified publisher0.1.151 of 1See more

jdownloader schichtel 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
jlesage/jdownloader-2:v26.03.13d6cb102bd9b
expat@2.7.4-r0
2.7.5-r0

Open the chart page →

539
keycloak-webhook-routerschichtelVerified publisher0.1.01 of 1See more

keycloak-webhook-router schichtel 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
ghcr.io/pschichtel/keycloak-webhook-router:main285e226fe7f6
expat@2.6.4-r0
2.7.5-r0

Open the chart page →

704
mindustryschichtelVerified publisher0.1.11 of 1See more

mindustry schichtel 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
pschichtel/mindustry-server:v145.1b543e9c2d371
expat@2.4.7-1ubuntu0.4
no fix listed

Open the chart page →

3,276
photonschichtelVerified publisher0.2.01 of 1See more

photon schichtel 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
rtuszik/photon-docker:2.4.021549c60f9e6
expat@2.6.1-2ubuntu0.3
no fix listed

Open the chart page →

2,893
wordpressschichtelVerified publisher0.10.102 of 2See more

wordpress schichtel 0.10.10

2 of the 2 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
library/wordpress:6.9.4-fpmad4a8bae2eb4
expat@2.7.1-2
2.8.2-1~deb13u1
nginxinc/nginx-unprivileged:1.29.5c5b989ebc150
expat@2.7.1-2
2.8.2-1~deb13u1

Open the chart page →

8,316
otterwikischmitzis0.1.01 of 1See more

otterwiki schmitzis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
redimp/otterwiki:2778bf30da3da
expat@2.5.0-1+deb12u2
no fix listed

Open the chart page →

3,234
snipeitschmitzis6.1.01 of 2See more

snipeit schmitzis 6.1.0

1 of the 2 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
snipe/snipe-it:v8.3.1141ebf2386fe
expat@2.6.1-2ubuntu0.3
no fix listed

Open the chart page →

6,224
synapse-adminschoenwald1.0.11 of 1See more

synapse-admin schoenwald 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
awesometechnologies/synapse-admin:0.11.4a1c1f4662875
expat@2.7.4-r0
2.7.5-r0

Open the chart page →

1,798
jellyfinschoolguys-helmcharts0.4.21 of 1See more

jellyfin schoolguys-helmcharts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
jellyfin/jellyfin:10.11.81694ff069f0c
expat@2.7.1-2
2.8.2-1~deb13u1

Open the chart page →

3,035
photoprismschoolguys-helmcharts0.3.81 of 1See more

photoprism schoolguys-helmcharts 0.3.8

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
photoprism/photoprism:260601650c6ad5a651
expat@2.7.4-1
no fix listed

Open the chart page →

10,464
restic-serverschoolguys-helmcharts0.3.11 of 1See more

restic-server schoolguys-helmcharts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
restic/rest-server:0.14.0d2aff06f47eb
expat@2.7.1-r0
2.7.5-r0

Open the chart page →

2,260
typo3schoolguys-helmcharts0.4.21 of 1See more

typo3 schoolguys-helmcharts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
expat@2.5.0-1+deb12u2
no fix listed

Open the chart page →

4,931
unboundschoolguys-helmcharts0.1.11 of 1See more

unbound schoolguys-helmcharts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
mvance/unbound:1.20.04bf67b567f39
expat@2.5.0-1
no fix listed

Open the chart page →

3,136
wyoming-faster-whisperschoolguys-helmcharts0.1.41 of 1See more

wyoming-faster-whisper schoolguys-helmcharts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
rhasspy/wyoming-whisper:3.5.0308b7959a925
expat@2.5.0-1+deb12u2
no fix listed

Open the chart page →

2,298
wyoming-piperschoolguys-helmcharts0.1.41 of 1See more

wyoming-piper schoolguys-helmcharts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
rhasspy/wyoming-piper:2.3.169b7f797ae3a
expat@2.5.0-1+deb12u2
no fix listed

Open the chart page →

1,872
smartsuggestsearchhub0.1.01 of 1See more

smartsuggest searchhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
commerceexperts/searchhub-smartsuggest-service:1.3.0341eebe7239b
expat@2.6.2-r0
2.7.5-r0

Open the chart page →

1,236
seed-audio-ai-pwa-toolkitseed-audio-ai-pwa-helm-chartsVerified publisher0.1.01 of 1See more

seed-audio-ai-pwa-toolkit seed-audio-ai-pwa-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
library/nginx:1.27-alpine65645c7bb6a0
expat@2.7.0-r0
2.7.5-r0

Open the chart page →

843
pagessekharpkube1.0.02 of 3See more

pages sekharpkube 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
expat@2.2.9-1build1
no fix listed
flyway/flyway:6.4.422d97ceb0c47
expat@2.2.5-3ubuntu0.2
no fix listed

Open the chart page →

20,262
seldon-core-loadtestingseldon0.2.01 of 1See more

seldon-core-loadtesting seldon 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
seldonio/locust-core:0.81d0da98a2d76
expat@2.1.0-7ubuntu0.16.04.3
no fix listed

Open the chart page →

23,099
guacamolesergiotocaliniVerified publisher1.0.01 of 2See more

guacamole sergiotocalini 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
guacamole/guacamole:1.5.50f62f6d17ab3
expat@2.4.7-1ubuntu0.2
no fix listed

Open the chart page →

5,510
return-nginx-chartseture0.1.01 of 1See more

return-nginx-chart seture 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
seyiogunniran/my-nginx:1.03a0ed39e5830
expat@2.7.1-r0
2.7.5-r0

Open the chart page →

1,294
link-uishortlink0.7.51 of 1See more

link-ui shortlink 0.7.5

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/ui:main9bdb1062d960
expat@2.7.4-r0
2.7.5-r0

Open the chart page →

1,317
uishortlink0.7.51 of 1See more

ui shortlink 0.7.5

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/ui:main9bdb1062d960
expat@2.7.4-r0
2.7.5-r0

Open the chart page →

1,317
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
expat@2.7.4-r4
2.7.5-r0

Open the chart page →

5,254
pagesshrutiujlan-pages1.0.02 of 3See more

pages shrutiujlan-pages 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
expat@2.2.9-1build1
no fix listed
flyway/flyway:6.4.422d97ceb0c47
expat@2.2.5-3ubuntu0.2
no fix listed

Open the chart page →

20,262
backendsignalen4.24.01 of 4See more

backend signalen 4.24.0

1 of the 4 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
signalen/backend:2.50.14760256000738
expat@2.5.0-1+deb12u2
no fix listed

Open the chart page →

11,719
teamcitysinextraVerified publisher1.0.21 of 3See more

teamcity sinextra 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
library/docker:26.1-dinddd43b430341a
expat@2.6.2-r0
2.7.5-r0

Open the chart page →

2,439
sistas-chatbotsistas-chatbot5.0.21 of 6See more

sistas-chatbot sistas-chatbot 5.0.2

1 of the 6 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
jhipster/jhipster-registry:latest7184525acd4d
expat@2.2.9-1ubuntu0.8
no fix listed

Open the chart page →

5,908
gitlab-runnerslamdev0.0.11 of 1See more

gitlab-runner slamdev 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
gitlab/gitlab-runner:v15.3.0860d4a3fec7a
expat@2.2.9-1ubuntu0.4
no fix listed

Open the chart page →

9,256
slothsloth0.16.01 of 2See more

sloth sloth 0.16.0

1 of the 2 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
expat@2.7.1-2
2.8.2-1~deb13u1

Open the chart page →

3,988
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
expat@2.5.0-1
no fix listed

Open the chart page →

5,592
aafsmo-helm-chart6.0.01 of 14See more

aaf smo-helm-chart 6.0.0

1 of the 14 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
expat@2.1.0-7ubuntu0.16.04.3
no fix listed

Open the chart page →

25,874
aaismo-helm-chart6.0.01 of 14See more

aai smo-helm-chart 6.0.0

1 of the 14 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
expat@2.1.0-7ubuntu0.16.04.3
no fix listed

Open the chart page →

25,908
dgbuildersmo-helm-chart6.0.01 of 3See more

dgbuilder smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.07daa08b81954
expat@2.1.0-7ubuntu0.16.04.3
no fix listed

Open the chart page →

28,576
dmaap-listenersmo-helm-chart6.0.01 of 3See more

dmaap-listener smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
expat@2.1.0-7ubuntu0.16.04.3
no fix listed

Open the chart page →

25,874
elasticsearchsmo-helm-chart6.0.01 of 5See more

elasticsearch smo-helm-chart 6.0.0

1 of the 5 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
expat@2.1.0-7ubuntu0.16.04.3
no fix listed

Open the chart page →

24,881
logsmo-helm-chart6.0.01 of 6See more

log smo-helm-chart 6.0.0

1 of the 6 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.07daa08b81954
expat@2.1.0-7ubuntu0.16.04.3
no fix listed

Open the chart page →

29,328
mariadb-initsmo-helm-chart6.0.01 of 2See more

mariadb-init smo-helm-chart 6.0.0

1 of the 2 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
expat@2.1.0-7ubuntu0.16.04.3
no fix listed

Open the chart page →

24,881
msbsmo-helm-chart6.0.01 of 6See more

msb smo-helm-chart 6.0.0

1 of the 6 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.07daa08b81954
expat@2.1.0-7ubuntu0.16.04.3
no fix listed

Open the chart page →

27,583
pndasmo-helm-chart6.0.01 of 3See more

pnda smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.07daa08b81954
expat@2.1.0-7ubuntu0.16.04.3
no fix listed

Open the chart page →

27,583
pombasmo-helm-chart6.0.01 of 17See more

pomba smo-helm-chart 6.0.0

1 of the 17 container images this version deploys carry CVE-2026-32776.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.07daa08b81954
expat@2.1.0-7ubuntu0.16.04.3
no fix listed

Open the chart page →

29,328

Container images carrying it

1,375 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/go-skynet/local-ai:latestd78cd113b2bc
expat@2.6.1-2ubuntu0.4
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
expat@2.5.0-1+deb12u3
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
expat@2.5.0-1+deb12u2
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
expat@2.5.0-1+deb12u2
no fix listed
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
expat@2.5.0-1+deb12u3
no fix listed
1
quay.io/mittwald/kube-httpcache:stable2169032c5840
expat@2.5.0-1+deb12u1
no fix listed
1
quay.io/opsmxpublic/rabbitmq:4.2-management3408107e5cc4
expat@2.6.1-2ubuntu0.3
no fix listed
1
quay.io/opsmxpublic/spin-sample-pipeline:v1.0.1c6a934439421
expat@2.1.0-7ubuntu0.16.04.4
no fix listed
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
expat@2.7.3-r0
2.7.5-r0
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
expat@2.7.3-r0
2.7.5-r0
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
expat@2.7.3-r0
2.7.5-r0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
expat@2.7.3-r0
2.7.5-r0
1
quay.io/poundex/tekton-stash-and-cache:0.2.2e854423caa09
expat@2.7.4-1
no fix listed
1
quay.io/underndog/samba:1.2.0-not-recyclecca801de9fa5
expat@2.7.0-r0
2.7.5-r0
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
expat@2.5.0-1
no fix listed
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
expat@2.6.1-2ubuntu0.4
no fix listed
1
registry.gitlab.com/dyff/workflows-aggregator:0.16.9b7984253b128
expat@2.7.4-1
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
expat@2.7.1-2
2.8.2-1~deb13u1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
expat@2.5.0-1+deb12u2
no fix listed
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
expat@2.2.9-1build1
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
expat@2.5.0-1+deb12u2
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
expat@2.7.1-2
2.8.2-1~deb13u1
1
registry.k8s.io/git-sync/git-sync:v4.1.0fd9722fd02e3
expat@2.5.0-1
no fix listed
1
registry.k8s.io/sig-storage/nfsplugin:v4.13.41eb5a85180a4
expat@2.5.0-1+deb12u2
no fix listed
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
expat@2.5.0-1+deb12u1
no fix listed
1

syft 1.42.1 · advisories as of 17 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.