CVE-2026-41080

Low

Advisory

Published 16 Apr 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.9; base score, highest
EPSS: 0.004; 33rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,454; of 17,790 indexed, latest versions
Container images: 1,457; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,454 of 17,790 indexed charts deploy, on 1,457 images.

Affected package	Affected versions	Fixed in	Images
expatdeb	2.1.0-4ubuntu1, 2.1.0-4ubuntu1.4, 2.1.0-7ubuntu0.16.04.2, 2.1.0-7ubuntu0.16.04.3+33 more	2.1.0-7ubuntu0.16.04.5+esm12, 2.8.2-1~deb13u1	1,144
expatapk	2.5.0-r4, 2.6.2-r0, 2.6.3-r0, 2.6.4-r0+10 more	2.8.0-r0, 2.8.1-r0	313

OSV records: ALPINE-CVE-2026-41080 CGA-f542-4m97-5v2v DEBIAN-CVE-2026-41080 UBUNTU-CVE-2026-41080
Also known as: CGA-h7ph-x4mx-672f, USN-8520-1

Charts affected

1,454 by stars

Chart

Latest

Affected images

Radar Score

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-41080.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	expat@2.4.7-1ubuntu0.3	no fix listed

Open the chart page →

14,173

tabbyxd

1.0.6

1 of 2 See more

7,697

xkopsxkops

0.1.0

2 of 5 See more

xkops xkops 0.1.0

2 of the 5 container images this version deploys carry CVE-2026-41080.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	expat@2.5.0-1+deb12u1	no fix listed
hamzaarshad10/queryfrontend :1.1.5.14	cd359d9a78c3	expat@2.6.3-r0	2.8.1-r0

Open the chart page →

13,783

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-41080.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	expat@2.4.7-1ubuntu0.7	no fix listed

Open the chart page →

7,929

Container images carrying it

1,457 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ddosify/selfhosted_hammermanager :2.0.2	b796b8c73011	expat@2.5.0-1	no fix listed	1
deconzcommunity/deconz :2.29.2	062de2362641	expat@2.5.0-1+deb12u1	no fix listed	1
deimosfr/dnsmasq-k8s :1.4.1	284c4040fc6d	expat@2.7.1-2	2.8.2-1~deb13u1	1
dellcloud/category :distributed	02fc234353a9	expat@2.2.9-1build1	no fix listed	1
dellcloud/pages :1.0	4d2eb25b9225	expat@2.2.9-1build1	no fix listed	1
deluan/navidrome :0.61.2	9fa40b3d8dec	expat@2.7.5-r0	2.8.1-r0	1
dependencytrack/frontend :4.14.2	00560b57a6cf	expat@2.7.5-r0	2.8.1-r0	1
devkrishan001/frontend :latest	a0ad60836e6b	expat@2.7.5-r0	2.8.1-r0	1
devopstales/kubedash :3.1.0	8bb837da5aec	expat@2.7.0-r0	2.8.1-r0	1
dgraziotin/nginx-webdav-nononsense :1.23.1	38f2de42bed0	expat@2.2.9-1ubuntu0.4	no fix listed	1
diygod/rsshub :2025-11-09	7a6312cac0d5	expat@2.5.0-1+deb12u2	no fix listed	1
djjudas21/bearhugmugs :0.1.1	4fa898a52d97	expat@2.6.4-r0	2.8.1-r0	1
docuseal/docuseal :2.4.1	7493fd7f6728	expat@2.7.5-r0	2.8.1-r0	1
dokuwiki/dokuwiki :2025-05-14a	f08ecfdda239	expat@2.7.1-2	2.8.2-1~deb13u1	1
dolibarr/dolibarr :24.0.0	69ec52e3b7ef	expat@2.5.0-1+deb12u2	no fix listed	1
dolibarr/dolibarr :22.0.4	7ad88fc9b13c	expat@2.5.0-1+deb12u2	no fix listed	1
domainmod/domainmod :4.23.0	4017bfe4c597	expat@2.5.0-1	no fix listed	1
dongjiang1989/lxcfs :v6.0.3	4bf9ae391948	expat@2.2.9-1ubuntu0.8	no fix listed	1
dpage/pgadmin4 :9.2	52cb72a9e3da	expat@2.7.0-r0	2.8.1-r0	1
dpage/pgadmin4 :8.13	561c1f8f99f2	expat@2.6.4-r0	2.8.1-r0	1
dragonflyoss/client :v1.5.4	a1b52779c4dd	expat@2.5.0-1+deb12u3	no fix listed	1
dragonflyoss/client :v0.1.82	edf3e921f4e0	expat@2.5.0-1	no fix listed	1
dremio/dremio-oss :24.1.0	80ed2e3b7c43	expat@2.4.7-1ubuntu0.2	no fix listed	1
drpcorg/dshackle :0.54.0	8858fae1859d	expat@2.4.7-1ubuntu0.2	no fix listed	1
drumsergio/genieacs :1.2.16.0	28244054e1bf	expat@2.5.0-1+deb12u2	no fix listed	1
dserio83/velero-api :0.3.1	6b3d9115fee2	expat@2.5.0-1+deb12u1	no fix listed	1
dserio83/velero-watchdog :0.1.8	d5deae589229	expat@2.5.0-1+deb12u1	no fix listed	1
dzikoysk/reposilite :3.5.26	4128c2d7a6ba	expat@2.6.1-2ubuntu0.3	no fix listed	1
dzikoysk/reposilite :3.6.3	90de4c8e6c0e	expat@2.6.1-2ubuntu0.4	no fix listed	1
eclipseaerios/entrypoint-balancer :1.3.0	43cd999a008d	expat@2.7.4-r0	2.8.1-r0	1
eclipseaerios/iota-messages-api :latest	e7f5ba0bc64d	expat@2.7.1-2	2.8.2-1~deb13u1	1
eclipseaerios/management-portal-backend :1.2.2	15fba526a4f8	expat@2.7.4-r0	2.8.1-r0	1
eclipseaerios/management-portal-frontend :1.2.2	3a8e4cf60629	expat@2.7.5-r0	2.8.1-r0	1
eftechcombr/glpi :php-fpm-12.0.0-rc1	f3d0ed01709e	expat@2.7.4-r0	2.8.1-r0	1
elastictranscoder/media :627e21dc	963ab3858c6b	expat@2.2.5-3ubuntu0.2	no fix listed	1
elastictranscoder/media-storage :f6d861a0	26208b8c2359	expat@2.2.5-3ubuntu0.2	no fix listed	1
elastictranscoder/transcoder :627e21dc	b4a0327029e6	expat@2.2.5-3ubuntu0.2	no fix listed	1
elastictranscoder/transcoder-handler :627e21dc	5b75d19e2733	expat@2.2.5-3ubuntu0.2	no fix listed	1
elautoestopista/aeneabot :4.2.1	125ba620d528	expat@2.7.3-r0	2.8.1-r0	1
elautoestopista/raponchi :0.3.0	b6f74db9fc81	expat@2.6.2-r0	2.8.1-r0	1
emqx/ecp-ui :2.5.1	e33e9816f147	expat@2.5.0-1+deb12u1	no fix listed	1
erenozcan17/react_frontend :v4.5	6e1b14973f9b	expat@2.7.1-r0	2.8.1-r0	1
erudikaltd/para :latest_stable	235e0bc53da2	expat@2.7.4-1	no fix listed	1
erudikaltd/scoold :1.66.0	949c56b57e8f	expat@2.7.3-r0	2.8.1-r0	1
escaping/core-keeper-dedicated :latest	87fa79255962	expat@2.7.1-2	2.8.2-1~deb13u1	1
esphome/esphome :2026.7.4	4866347cb5b4	expat@2.7.1-2	2.8.2-1~deb13u1	1
esphome/esphome :2026.8.2	85abea33854b	expat@2.7.1-2	2.8.2-1~deb13u1	1
esphome/esphome :2024.3.0	9ab8cc88b28c	expat@2.5.0-1	no fix listed	1
esphome/esphome :2024.12.2	b2c6322700ac	expat@2.5.0-1+deb12u1	no fix listed	1
esphome/esphome :2025.3.0	def8b6e4f517	expat@2.5.0-1+deb12u1	no fix listed	1