CVE-2026-41080

Low

Advisory

Published 16 Apr 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.9; base score, highest
EPSS: 0.004; 33rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,454; of 17,790 indexed, latest versions
Container images: 1,457; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,454 of 17,790 indexed charts deploy, on 1,457 images.

Affected package	Affected versions	Fixed in	Images
expatdeb	2.1.0-4ubuntu1, 2.1.0-4ubuntu1.4, 2.1.0-7ubuntu0.16.04.2, 2.1.0-7ubuntu0.16.04.3+33 more	2.1.0-7ubuntu0.16.04.5+esm12, 2.8.2-1~deb13u1	1,144
expatapk	2.5.0-r4, 2.6.2-r0, 2.6.3-r0, 2.6.4-r0+10 more	2.8.0-r0, 2.8.1-r0	313

OSV records: ALPINE-CVE-2026-41080 CGA-f542-4m97-5v2v DEBIAN-CVE-2026-41080 UBUNTU-CVE-2026-41080
Also known as: CGA-h7ph-x4mx-672f, USN-8520-1

Charts affected

1,454 by stars

Chart

Latest

Affected images

Radar Score

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-41080.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	expat@2.4.7-1ubuntu0.3	no fix listed

Open the chart page →

14,173

tabbyxd

1.0.6

1 of 2 See more

7,697

xkopsxkops

0.1.0

2 of 5 See more

xkops xkops 0.1.0

2 of the 5 container images this version deploys carry CVE-2026-41080.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	expat@2.5.0-1+deb12u1	no fix listed
hamzaarshad10/queryfrontend :1.1.5.14	cd359d9a78c3	expat@2.6.3-r0	2.8.1-r0

Open the chart page →

13,783

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-41080.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	expat@2.4.7-1ubuntu0.7	no fix listed

Open the chart page →

7,929

Container images carrying it

1,457 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
onosproject/onos :2.2.1	44914a8d4b3f	expat@2.2.5-3ubuntu0.2	no fix listed	1
opea/asr :1.0	25dd26d9cd09	expat@2.5.0-1	no fix listed	1
opea/chatqna :1.0	38c51b791efa	expat@2.5.0-1	no fix listed	1
opea/chatqna-conversation-ui :v0.9	bdb9ec215872	expat@2.6.2-r0	2.8.1-r0	1
opea/codegen :1.0	58f91683892d	expat@2.5.0-1	no fix listed	1
opea/codegen-ui :1.0	2bee4eb66f3e	expat@2.5.0-1	no fix listed	1
opea/codetrans :1.0	e2436483b73d	expat@2.5.0-1	no fix listed	1
opea/codetrans-ui :1.0	3ef121f34610	expat@2.5.0-1	no fix listed	1
opea/docsum :1.0	3eaa91849512	expat@2.5.0-1	no fix listed	1
opea/docsum-ui :1.0	7f854e9bffaf	expat@2.5.0-1	no fix listed	1
opea/guardrails-tgi :1.0	262c6048aab8	expat@2.5.0-1	no fix listed	1
opea/guardrails-tgi :latest	f68bec6a1271	expat@2.5.0-1+deb12u1	no fix listed	1
opea/llm-docsum-tgi :1.0	02f9e8fa5d71	expat@2.5.0-1	no fix listed	1
opea/speecht5 :1.0	249afad3d268	expat@2.5.0-1	no fix listed	1
opea/tts :1.0	257ae94709e9	expat@2.5.0-1	no fix listed	1
opea/web-retriever-chroma :1.0	fe08165d7770	expat@2.5.0-1	no fix listed	1
openaev/platform :3.260904.0	0a12ce8b3db9	expat@2.6.1-2ubuntu0.4	no fix listed	1
openbas/caldera-server :5.1.0	a277796d9724	expat@2.5.0-1+deb12u1	no fix listed	1
openbas/platform :2.0.5	d986d80b0a75	expat@2.6.1-2ubuntu0.3	no fix listed	1
opencsghq/agenticflow :ee-v0.6-5	2f03fead54db	expat@2.5.0-1+deb12u2	no fix listed	1
opencsghq/csgship-portal :v1.2.1	865814dc87a1	expat@2.7.0-r0	2.8.1-r0	1
opencsghq/kubectl :latest	b6d87e1048c2	expat@2.5.0-1+deb12u1	no fix listed	1
opendatacube/explorer :latest	120457ffcd69	expat@2.6.1-2ubuntu0.3	no fix listed	1
opendatacube/pipelines :wofs-1.22	5d810e8504b8	expat@2.2.5-3	no fix listed	1
opendatacube/restcube :latest	91870111837c	expat@2.2.5-3	no fix listed	1
opendatacube/wms :latest	1b90cdf68831	expat@2.2.5-3	no fix listed	1
opendatacube/wps :latest	80df355a660b	expat@2.4.7-1ubuntu0.6	no fix listed	1
openelevation/open-elevation :latest	82fb21612e86	expat@2.2.9-1build1	no fix listed	1
openkm/openkm-ce :6.3.11	3bc465a7461b	expat@2.2.9-1ubuntu0.4	no fix listed	1
openmined/syft-backend :0.9.5	b72f74a68b32	expat@2.6.4-r1	2.8.0-r0	1
openproject/hocuspocus :release-338001b2	88dc1359dfb5	expat@2.5.0-1+deb12u1	no fix listed	1
openresty/openresty :1.31.1.1-1-alpine-fat	acd832254d9c	expat@2.7.5-r0	2.8.1-r0	1
openstackhelm/heat :wallaby-ubuntu_focal	f728510bab3c	expat@2.2.9-1ubuntu0.6	no fix listed	1
openstackhelm/keystone :wallaby-ubuntu_focal	e07d75953d2e	expat@2.2.9-1ubuntu0.6	no fix listed	1
openthread/otbr :latest	f307f59f6432	expat@2.2.5-3ubuntu0.9	no fix listed	1
openvino/model_server :2025.2.1	1e7cd1d70cc1	expat@2.6.1-2ubuntu0.3	no fix listed	1
openvpn/openvpn-as :latest	2253c10ec652	expat@2.6.1-2ubuntu0.4	no fix listed	1
openwhisk/ow-utils :1.0.0	c80dba0de3aa	expat@2.2.5-3ubuntu0.2	no fix listed	1
opsmx11/issuegen :v2.1.0	5c50ca123d88	expat@2.1.0-4ubuntu1.4	no fix listed	1
orbitalreg/orbitalreg-frontend :0.1.0	4fd449582a3c	expat@2.7.0-r0	2.8.1-r0	1
owncloud/ocis :7.1.3	88e7c854517d	expat@2.7.0-r0	2.8.1-r0	1
owncloud/ocis :8.0.1	b38fd8fdd58f	expat@2.7.4-r0	2.8.1-r0	1
owncloud/server :10.15.0	51d9b74fc2a8	expat@2.2.9-1ubuntu0.6	no fix listed	1
owncloud/server :10.16.2	74c53d341076	expat@2.4.7-1ubuntu0.7	no fix listed	1
owncloud/server :10.16.3	b3f9efdcd7f7	expat@2.4.7-1ubuntu0.7	no fix listed	1
passbolt/passbolt :5.13.0-1-ce	af3a620902a0	expat@2.7.1-2	2.8.2-1~deb13u1	1
payara/server-full :7.2026.2-jdk25	31f1253f0cf8	expat@2.4.7-1ubuntu0.7	no fix listed	1
penpotapp/backend :2.2.1	47853d9bb9dd	expat@2.4.7-1ubuntu0.4	no fix listed	1
penpotapp/exporter :2.2.1	5c835ffd87ab	expat@2.4.7-1ubuntu0.4	no fix listed	1
penpotapp/exporter :2.17.2	72a8061e8806	expat@2.7.4-1	no fix listed	1