CVE-2026-32778

Medium

Advisory

Published 16 Mar 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.002; 7th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,385; of 17,792 indexed, latest versions
Container images: 1,375; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,385 of 17,792 indexed charts deploy, on 1,375 images.

Affected package	Affected versions	Fixed in	Images
expatdeb	2.1.0-4ubuntu1, 2.1.0-4ubuntu1.4, 2.1.0-7ubuntu0.16.04.2, 2.1.0-7ubuntu0.16.04.3+33 more	2.8.2-1~deb13u1	1,143
expatapk	2.5.0-r4, 2.6.2-r0, 2.6.3-r0, 2.6.4-r0+8 more	2.7.5-r0	232

OSV records: ALPINE-CVE-2026-32778 DEBIAN-CVE-2026-32778 CGA-3g5h-mq9j-9hqh UBUNTU-CVE-2026-32778
Also known as: CGA-cgqf-mvmx-jpfr

Charts affected

1,385 by stars

Chart

Latest

Affected images

Radar Score

simple-prima-notavcnngr

0.5.3

2 of 4 See more

simple-prima-nota vcnngr 0.5.3

2 of the 4 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :9.2	52cb72a9e3da	expat@2.7.0-r0	2.7.5-r0
vcnngr/pnfrontend :latest	4e4979ab8c41	expat@2.7.1-r0	2.7.5-r0

Open the chart page →

4,777

tdarrvhdirk

5.0.5

2 of 2 See more

tdarr vhdirk 5.0.5

2 of the 2 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
haveagitgat/tdarr_node :2.17.01	3ff0913202dd	expat@2.2.9-1ubuntu0.6	no fix listed
ghcr.io/haveagitgat/tdarr :2.00.18.2	3fbe4c29d14c	expat@2.2.9-1ubuntu0.4	no fix listed

Open the chart page →

26,834

unmanicvhdirk

0.1.4

1 of 1 See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
josh5/unmanic :0.2.6	4d49c4816260	expat@2.4.7-1ubuntu0.2	no fix listed

Open the chart page →

9,495

maybe-financevicsufer

0.2.7

1 of 3 See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	expat@2.5.0-1+deb12u1	no fix listed

Open the chart page →

10,833

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	expat@2.6.1-2ubuntu0.4	no fix listed

Open the chart page →

4,337

colanodevictorlane

0.3.3

1 of 3 See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
ghcr.io/colanode/web :latest	bcad696f03ee	expat@2.7.0-r0	2.7.5-r0

Open the chart page →

2,080

n8nvictorlane

1.0.18

1 of 1 See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
n8nio/n8n :1.115.1	ed16e560c40e	expat@2.7.2-r0	2.7.5-r0

Open the chart page →

6,475

twenty-crmvictorlane

0.0.1

2 of 3 See more

twenty-crm victorlane 0.0.1

2 of the 3 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
redis/redis-stack-server :latest	798ab84d9f26	expat@2.4.7-1ubuntu0.6	no fix listed
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	expat@2.4.7-1ubuntu0.2	no fix listed

Open the chart page →

13,617

pagesvictor-pages

1.0.0

2 of 3 See more

pages victor-pages 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	expat@2.2.9-1build1	no fix listed
flyway/flyway :6.4.4	22d97ceb0c47	expat@2.2.5-3ubuntu0.2	no fix listed

Open the chart page →

20,262

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	expat@2.6.1-2ubuntu0.3	no fix listed

Open the chart page →

7,715

squawkvojtechpastyrik

0.1.10

1 of 1 See more

squawk vojtechpastyrik 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
ghcr.io/vojtechpastyrik/squawk :0.1.10	4005df5f7229	expat@2.7.4-r0	2.7.5-r0

Open the chart page →

402

vote-appvote-app

1.0.7

1 of 6 See more

vote-app vote-app 1.0.7

1 of the 6 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
thecloudspark/app-vote :1.0	c7da7417a86a	expat@2.6.2-r0	2.7.5-r0

Open the chart page →

3,032

kongwallarm

4.6.3

1 of 7 See more

kong wallarm 4.6.3

1 of the 7 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
wallarm/kong :3.1.0-ubuntu-4.6.0	ea9608c82e40	expat@2.2.9-1ubuntu0.6	no fix listed

Open the chart page →

11,451

pageswalter

1.0.0

2 of 3 See more

pages walter 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
dellcloud/pages :monitor	6ba7b22caacd	expat@2.2.9-1build1	no fix listed
flyway/flyway :6.4.4	22d97ceb0c47	expat@2.2.5-3ubuntu0.2	no fix listed

Open the chart page →

20,262

sirenwateim

1.0.2

1 of 1 See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
sigp/siren :v3.0.4	2c219b04758e	expat@2.5.0-1+deb12u1	no fix listed

Open the chart page →

6,015

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	expat@2.2.9-1ubuntu0.4	no fix listed

Open the chart page →

11,191

supersetwbstack

0.1.0

1 of 1 See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
apache/superset :4.0.1	ab9467fd712c	expat@2.5.0-1	no fix listed

Open the chart page →

7,169

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	expat@2.6.1-2ubuntu0.3	no fix listed
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	expat@2.2.9-1ubuntu0.6	no fix listed

Open the chart page →

9,291

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	expat@2.6.1-2ubuntu0.3	no fix listed
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	expat@2.2.9-1ubuntu0.6	no fix listed

Open the chart page →

9,291

web-dvwaweb-dvwa

1.16.0

1 of 2 See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
gulacedia/web-dvwa-new :v3	67b467d961ca	expat@2.5.0-1	no fix listed

Open the chart page →

10,149

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	expat@2.2.9-1build1	no fix listed

Open the chart page →

14,438

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	expat@2.2.9-1build1	no fix listed

Open the chart page →

28,729

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	expat@2.2.5-3ubuntu0.2	no fix listed

Open the chart page →

10,879

juicefs-csi-driverwenerme

0.33.0

1 of 5 See more

juicefs-csi-driver wenerme 0.33.0

1 of the 5 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.33.0	f918e7331c05	expat@2.5.0-1+deb12u3	no fix listed

Open the chart page →

8,944

kubernetes-dashboardwenerme

7.14.0

1 of 5 See more

kubernetes-dashboard wenerme 7.14.0

1 of the 5 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
library/kong :3.9	2a8cf3b110cd	expat@2.6.1-2ubuntu0.4	no fix listed

Open the chart page →

3,536

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	expat@2.2.9-1build1	no fix listed

Open the chart page →

15,310

wexa-studiowexa-studio

1.2.0

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	expat@2.7.1-r0	2.7.5-r0

Open the chart page →

15,056

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	expat@2.4.7-1ubuntu0.2	no fix listed

Open the chart page →

9,340

kibanawiremind

8.5.23

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	expat@2.2.9-1ubuntu0.8	no fix listed

Open the chart page →

6,336

marge-botwiremind

1.4.4

1 of 1 See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
hiboxsystems/marge-bot :0.14.0	dcffb926e563	expat@2.5.0-1	no fix listed

Open the chart page →

5,566

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	expat@2.4.7-1ubuntu0.3	no fix listed

Open the chart page →

14,218

tabbyxd

1.0.6

1 of 2 See more

7,714

xkopsxkops

0.1.0

2 of 5 See more

xkops xkops 0.1.0

2 of the 5 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	expat@2.5.0-1+deb12u1	no fix listed
hamzaarshad10/queryfrontend :1.1.5.14	cd359d9a78c3	expat@2.6.3-r0	2.7.5-r0

Open the chart page →

13,813

changedetection-iozekker6

1.99.0

1 of 1 See more

changedetection-io zekker6 1.99.0

1 of the 1 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.4	7bb6963b730d	expat@2.5.0-1+deb12u3	no fix listed

Open the chart page →

2,630

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-32778.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	expat@2.4.7-1ubuntu0.7	no fix listed

Open the chart page →

7,936

Container images carrying it

1,375 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/topolvm/topolvm-with-sidecar :0.35.0	b354978c440d	expat@2.4.7-1ubuntu0.4	no fix listed	1
ghcr.io/vojtechpastyrik/squawk :0.1.10	4005df5f7229	expat@2.7.4-r0	2.7.5-r0	1
ghcr.io/voxpupuli/container-puppetdb :7.18.0-v1.5.0	a56dfe91f5b1	expat@2.4.7-1ubuntu0.3	no fix listed	1
ghcr.io/voxpupuli/container-puppetserver :7.17.0-v1.5.0	916746209ac5	expat@2.4.7-1ubuntu0.3	no fix listed	1
ghcr.io/voxpupuli/puppetserver :8.7.0-main	63873f3f698e	expat@2.4.7-1ubuntu0.5	no fix listed	1
ghcr.io/wgbh-mla/pbcore-util :pr-6	6e04659a3baa	expat@2.5.0-1+deb12u2	no fix listed	1
ghcr.io/wiremind/grafana-pdf-exporter :v1.7	dbaa8527bf4c	expat@2.5.0-1	no fix listed	1
ghcr.io/wittdennis/calibre-web :1.1.1	aa7d5d5dd6be	expat@2.5.0-1+deb12u2	no fix listed	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	expat@2.5.0-1	no fix listed	1
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	expat@2.5.0-1+deb12u1	no fix listed	1
ghcr.io/wyrihaximusnet/redirect :random	bf5983d754d7	expat@2.6.3-r0	2.7.5-r0	1
ghcr.io/yurymkomarov/docker/kubernetes-kiosk-chromium :0.1.2	7bff29dcec72	expat@2.5.0-1+deb12u2	no fix listed	1
ghcr.io/zazukoians/qlever-server :v0.10.1	1de7869ab46e	expat@2.6.1-2ubuntu0.4	no fix listed	1
ghcr.io/zazukoians/qlever-ui :v0.10.1	51a7ec1c2de4	expat@2.6.2-r0	2.7.5-r0	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	expat@2.5.0-1+deb12u1	no fix listed	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	expat@2.5.0-1+deb12u1	no fix listed	1
ghcr.io/zystem-io/zymtrace-pub-ui :26.9.2	9a32b89c0c19	expat@2.7.1-r0	2.7.5-r0	1
mcr.microsoft.com/mssql/server :2017-latest	13221ac5f673	expat@2.2.5-3ubuntu0.9	no fix listed	1
mcr.microsoft.com/mssql/server :2019-CU16-ubuntu-20.04	49a57dc220b1	expat@2.2.9-1ubuntu0.4	no fix listed	1
mcr.microsoft.com/mssql/server :latest	4bab24f36c1e	expat@2.6.1-2ubuntu0.4	no fix listed	1
mcr.microsoft.com/mssql/server :2022-latest	ba4c8329f48f	expat@2.4.7-1ubuntu0.7	no fix listed	1
mcr.microsoft.com/mssql/server :2025-CU5-ubuntu-24.04	cee0f4db03b5	expat@2.6.1-2ubuntu0.4	no fix listed	1
mcr.microsoft.com/mssql/server :2017-latest	fbf79e0fea59	expat@2.2.5-3ubuntu0.9	no fix listed	1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor :1.66.9	138c8b82c398	expat@2.6.1-2ubuntu0.4	no fix listed	1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor :latest	f669a6eacf8c	expat@2.6.1-2ubuntu0.4	no fix listed	1
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime :latest	5d55a742a2bc	expat@2.7.4-1	no fix listed	1
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime :latest	8be3ed26f746	expat@2.7.4-1	no fix listed	1
public.ecr.aws/aktosecurity/akto-api-security-mini-testing :1.72.6_local	43316f900242	expat@2.7.4-1	no fix listed	1
public.ecr.aws/aktosecurity/akto-api-security-mini-testing :1.74.4_local	5bda14f66e8e	expat@2.7.4-1	no fix listed	1
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer :1.74.4_local	1ed844ecab29	expat@2.6.1-2ubuntu0.3	no fix listed	1
public.ecr.aws/aktosecurity/akto-api-testing :latest	97d830d5538a	expat@2.6.1-2ubuntu0.4	no fix listed	1
public.ecr.aws/aktosecurity/akto-threat-detection :latest	3f103ce347ce	expat@2.7.4-1	no fix listed	1
public.ecr.aws/aktosecurity/akto-threat-detection :1.16.2	a47eb6cc17ea	expat@2.7.4-1	no fix listed	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	expat@2.5.0-1+deb12u1	no fix listed	1
public.ecr.aws/jtekt-corporation/image-storage-service-gui :v1.9.4	34823c8abe00	expat@2.5.0-1+deb12u1	no fix listed	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	expat@2.5.0-1	no fix listed	1
public.ecr.aws/jtekt-corporation/shinsei-manager-front :v1.5.5	f8fb4eea4071	expat@2.5.0-1	no fix listed	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	expat@2.5.0-1	no fix listed	1
public.ecr.aws/outerbounds/metaflow_metadata_service :v2.4.13	f7567ce3419d	expat@2.5.0-1	no fix listed	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	expat@2.2.9-1build1	no fix listed	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	expat@2.5.0-1	no fix listed	1
quay.io/argoproj/argocd :v3.5.1	0deb1a1c9176	expat@2.7.4-1	no fix listed	1
quay.io/argoproj/argocd :v2.4.11	5b6701d8fb31	expat@2.4.7-1	no fix listed	1
quay.io/argoproj/argocd :v3.0.3	95b5cf7ba6fe	expat@2.6.1-2ubuntu0.3	no fix listed	1
quay.io/argoproj/argocd :v3.1.1	a36ab0c0860c	expat@2.6.1-2ubuntu0.3	no fix listed	1
quay.io/argoproj/argocd :v2.8.6	acaf37352569	expat@2.4.7-1ubuntu0.2	no fix listed	1
quay.io/codefresh/redis :7.4.3-debian-12-r0	935f97598255	expat@2.5.0-1+deb12u1	no fix listed	1
quay.io/deployhub/ms-nginx :svccat-v11.0.815-g717581	d2d3400664e8	expat@2.7.3-r0	2.7.5-r0	1
quay.io/evryfs/docker-mcrouter :0.40.0-9	a2d3a4c67b0f	expat@2.2.5-3ubuntu0.7	no fix listed	1
quay.io/fiware/waltid :1.14.1-SNAPSHOT	93889c3d8a34	expat@2.4.7-1	no fix listed	1