CVE-2026-32778

Medium

Advisory

Published 16 Mar 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.002; 7th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,372; of 17,792 indexed, latest versions
Container images: 1,359; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,372 of 17,792 indexed charts deploy, on 1,359 images.

Affected package	Affected versions	Fixed in	Images
expatdeb	2.1.0-4ubuntu1, 2.1.0-4ubuntu1.4, 2.1.0-7ubuntu0.16.04.2, 2.1.0-7ubuntu0.16.04.3+33 more	2.8.2-1~deb13u1	1,130
expatapk	2.5.0-r4, 2.6.2-r0, 2.6.3-r0, 2.6.4-r0+8 more	2.7.5-r0	229

OSV records: ALPINE-CVE-2026-32778 DEBIAN-CVE-2026-32778 CGA-3g5h-mq9j-9hqh UBUNTU-CVE-2026-32778
Also known as: CGA-cgqf-mvmx-jpfr

Charts affected

1,372 by stars

Chart

Latest

Affected images

Radar Score

kongwallarm

4.6.3

1 of 7 See more

kong wallarm 4.6.3

1 of the 7 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
wallarm/kong :3.1.0-ubuntu-4.6.0	ea9608c82e40	expat@2.2.9-1ubuntu0.6	no fix listed

Open the chart page →

11,448

pageswalter

1.0.0

2 of 3 See more

pages walter 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	expat@2.2.9-1build1	no fix listed
flyway/flyway :6.4.4	22d97ceb0c47	expat@2.2.5-3ubuntu0.2	no fix listed

Open the chart page →

20,242

sirenwateim

1.0.2

1 of 1 See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
sigp/siren :v3.0.4	2c219b04758e	expat@2.5.0-1+deb12u1	no fix listed

Open the chart page →

6,007

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	expat@2.2.9-1ubuntu0.4	no fix listed

Open the chart page →

11,171

supersetwbstack

0.1.0

1 of 1 See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
apache/superset :4.0.1	ab9467fd712c	expat@2.5.0-1	no fix listed

Open the chart page →

7,166

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	expat@2.6.1-2ubuntu0.3	no fix listed
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	expat@2.2.9-1ubuntu0.6	no fix listed

Open the chart page →

9,252

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	expat@2.6.1-2ubuntu0.3	no fix listed
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	expat@2.2.9-1ubuntu0.6	no fix listed

Open the chart page →

9,252

web-dvwaweb-dvwa

1.16.0

1 of 2 See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
gulacedia/web-dvwa-new :v3	67b467d961ca	expat@2.5.0-1	no fix listed

Open the chart page →

10,111

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	expat@2.2.9-1build1	no fix listed

Open the chart page →

14,414

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	expat@2.2.9-1build1	no fix listed

Open the chart page →

28,697

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	expat@2.2.5-3ubuntu0.2	no fix listed

Open the chart page →

10,859

kubernetes-dashboardwenerme

7.14.0

1 of 5 See more

kubernetes-dashboard wenerme 7.14.0

1 of the 5 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
library/kong :3.9	2a8cf3b110cd	expat@2.6.1-2ubuntu0.4	no fix listed

Open the chart page →

3,523

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	expat@2.2.9-1build1	no fix listed

Open the chart page →

15,288

wexa-studiowexa-studio

1.2.0

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	expat@2.7.1-r0	2.7.5-r0

Open the chart page →

15,044

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	expat@2.4.7-1ubuntu0.2	no fix listed

Open the chart page →

9,320

kibanawiremind

8.5.23

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	expat@2.2.9-1ubuntu0.8	no fix listed

Open the chart page →

6,326

marge-botwiremind

1.4.4

1 of 1 See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
hiboxsystems/marge-bot :0.14.0	dcffb926e563	expat@2.5.0-1	no fix listed

Open the chart page →

5,559

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	expat@2.4.7-1ubuntu0.3	no fix listed

Open the chart page →

14,173

tabbyxd

1.0.6

1 of 2 See more

7,697

xkopsxkops

0.1.0

2 of 5 See more

xkops xkops 0.1.0

2 of the 5 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	expat@2.5.0-1+deb12u1	no fix listed
hamzaarshad10/queryfrontend :1.1.5.14	cd359d9a78c3	expat@2.6.3-r0	2.7.5-r0

Open the chart page →

13,783

changedetection-iozekker6

1.99.0

1 of 1 See more

changedetection-io zekker6 1.99.0

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.4	7bb6963b730d	expat@2.5.0-1+deb12u3	no fix listed

Open the chart page →

2,612

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	expat@2.4.7-1ubuntu0.7	no fix listed

Open the chart page →

7,929

Container images carrying it

1,359 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/radar-base/managementportal/management-portal :3.0.0	c1b37e821f72	expat@2.7.4-1	no fix listed	1
ghcr.io/radar-base/radar-app-config/radar-app-config :0.6.2	4431db7b486b	expat@2.6.1-2ubuntu0.4	no fix listed	1
ghcr.io/radar-base/radar-app-config/radar-app-config-frontend :0.6.2	c5f1e2ca5781	expat@2.6.4-r0	2.7.5-r0	1
ghcr.io/radar-base/radar-data-dashboard-backend/radar-data-dashboard-backend :0.2.4	d1e55350923c	expat@2.6.1-2ubuntu0.4	no fix listed	1
ghcr.io/radar-base/radar-gateway/radar-gateway :0.9.4	219d894aa7a6	expat@2.6.1-2ubuntu0.4	no fix listed	1
ghcr.io/radar-base/radar-home/radar-home :0.1.7	1cfe3da9d812	expat@2.6.4-r0	2.7.5-r0	1
ghcr.io/radar-base/radar-output-restructure/radar-output-restructure :3.0.6	7fb9c70e96a4	expat@2.6.1-2ubuntu0.4	no fix listed	1
ghcr.io/radar-base/radar-rest-source-auth/radar-rest-source-authorizer :4.4.15	3e096497f7db	expat@2.6.4-r0	2.7.5-r0	1
ghcr.io/radar-base/radar-schemas/radar-schemas-tools :0.8.16	c442e8bfe6b4	expat@2.6.1-2ubuntu0.4	no fix listed	1
ghcr.io/radar-base/radar-upload-source-connector/radar-upload-connect-backend :0.6.4	6a04b43b8d9a	expat@2.6.1-2ubuntu0.3	no fix listed	1
ghcr.io/radar-base/radar-upload-source-connector/radar-upload-connect-frontend :0.6.4	7e27863545fc	expat@2.7.0-r0	2.7.5-r0	1
ghcr.io/rodg/rtmp-controller :latest	67f99a5beab7	expat@2.5.0-1	no fix listed	1
ghcr.io/samr037/node-debug-dashboard :0.3.0	c79b2e64a211	expat@2.5.0-1+deb12u2	no fix listed	1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	expat@2.5.0-1+deb12u1	no fix listed	1
ghcr.io/serenita-org/vero :v0.8.3	e5a7ec714acc	expat@2.5.0-1	no fix listed	1
ghcr.io/smarter-project/audio-client :v3.1.2	3c8375dc5487	expat@2.2.9-1ubuntu0.4	no fix listed	1
ghcr.io/smarter-project/gstreamer :v1.0.2	5ecb16015aa8	expat@2.2.9-1ubuntu0.4	no fix listed	1
ghcr.io/smarter-project/image-detector :v2.5.3	1dcca70c6446	expat@2.2.9-1ubuntu0.4	no fix listed	1
ghcr.io/stac-utils/titiler-pgstac :3.1.0	788173c5876d	expat@2.7.1-2	2.8.2-1~deb13u1	1
ghcr.io/star-whale/server :0.6.15	8368359c8dd0	expat@2.2.9-1ubuntu0.4	no fix listed	1
ghcr.io/stirling-tools/stirling-pdf :2.14.3	3b3670fce70b	expat@2.6.1-2ubuntu0.4	no fix listed	1
ghcr.io/streamingfast/firehose-core :v1.12.3	91fca773a63f	expat@2.6.1-2ubuntu0.3	no fix listed	1
ghcr.io/streamingfast/firehose-ethereum :v2.12.4	89969b78fb07	expat@2.6.1-2ubuntu0.3	no fix listed	1
ghcr.io/streamingfast/firehose-ethereum :v2.14.3	bf816072380e	expat@2.6.1-2ubuntu0.3	no fix listed	1
ghcr.io/streamingfast/firehose-ethereum :v2.12.4-geth	d7bdfa7b41da	expat@2.6.1-2ubuntu0.3	no fix listed	1
ghcr.io/streamingfast/go-ethereum :geth-v1.16.9-fh3.0	8e3cb38953a3	expat@2.6.1-2ubuntu0.3	no fix listed	1
ghcr.io/streamingfast/substreams-sink-kv :v2.3.0	26953ec68d5d	expat@2.2.9-1ubuntu0.7	no fix listed	1
ghcr.io/streamingfast/substreams-sink-noop :v1.4.0	d7c43c3135c6	expat@2.2.9-1ubuntu0.7	no fix listed	1
ghcr.io/streamvisor/streamvisor :4.1.4	0bc598b2ac9a	expat@2.6.1-2ubuntu0.4	no fix listed	1
ghcr.io/suwayomi/suwayomi-server :v2.3.2320	d2c3218c7f9f	expat@2.6.1-2ubuntu0.4	no fix listed	1
ghcr.io/tauffer-consulting/domino-rest :latest	8bf880fe8c73	expat@2.5.0-1	no fix listed	1
ghcr.io/theconnman/docker-hub-rss :0.6.2	38eba84b2be8	expat@2.7.3-r0	2.7.5-r0	1
ghcr.io/thoroslives/zilean :v3.10.1	bce6aca0f6ca	expat@2.7.0-r0	2.7.5-r0	1
ghcr.io/topolvm/pie :0.18.0	aa467443e407	expat@2.4.7-1ubuntu0.7	no fix listed	1
ghcr.io/topolvm/topolvm-with-sidecar :0.41.1	70548dbe0c6a	expat@2.4.7-1ubuntu0.7	no fix listed	1
ghcr.io/topolvm/topolvm-with-sidecar :0.35.0	b354978c440d	expat@2.4.7-1ubuntu0.4	no fix listed	1
ghcr.io/vojtechpastyrik/squawk :0.1.10	4005df5f7229	expat@2.7.4-r0	2.7.5-r0	1
ghcr.io/voxpupuli/container-puppetdb :7.18.0-v1.5.0	a56dfe91f5b1	expat@2.4.7-1ubuntu0.3	no fix listed	1
ghcr.io/voxpupuli/container-puppetserver :7.17.0-v1.5.0	916746209ac5	expat@2.4.7-1ubuntu0.3	no fix listed	1
ghcr.io/voxpupuli/puppetserver :8.7.0-main	63873f3f698e	expat@2.4.7-1ubuntu0.5	no fix listed	1
ghcr.io/wgbh-mla/pbcore-util :pr-6	6e04659a3baa	expat@2.5.0-1+deb12u2	no fix listed	1
ghcr.io/wiremind/grafana-pdf-exporter :v1.7	dbaa8527bf4c	expat@2.5.0-1	no fix listed	1
ghcr.io/wittdennis/calibre-web :1.1.1	aa7d5d5dd6be	expat@2.5.0-1+deb12u2	no fix listed	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	expat@2.5.0-1	no fix listed	1
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	expat@2.5.0-1+deb12u1	no fix listed	1
ghcr.io/wyrihaximusnet/redirect :random	bf5983d754d7	expat@2.6.3-r0	2.7.5-r0	1
ghcr.io/yurymkomarov/docker/kubernetes-kiosk-chromium :0.1.2	7bff29dcec72	expat@2.5.0-1+deb12u2	no fix listed	1
ghcr.io/zazukoians/qlever-server :v0.10.1	1de7869ab46e	expat@2.6.1-2ubuntu0.4	no fix listed	1
ghcr.io/zazukoians/qlever-ui :v0.10.1	51a7ec1c2de4	expat@2.6.2-r0	2.7.5-r0	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	expat@2.5.0-1+deb12u1	no fix listed	1