CVE-2026-76641
HighAdvisory
Published 20 Aug 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.7
- base score, highest
- EPSS
- 0.004
- 29th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,151
- of 17,787 indexed, latest versions
- Container images
- 1,069
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
CVE-2026-76641 affecting package expat for versions less than 2.8.3-2
Carried by container images the latest versions of 1,151 of 17,787 indexed charts deploy, on 1,069 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| expatapk | 2.6.4-r0, 2.7.0-r0, 2.7.1-r0, 2.7.2-r0+7 more | 2.8.4-r0 | 412 |
| expatdeb | 2.1.0-4ubuntu1, 2.1.0-4ubuntu1.4, 2.1.0-7ubuntu0.16.04.2, 2.1.0-7ubuntu0.16.04.3+27 more | 2.8.4-1 | 655 |
| expatrpm | 2.8.2-1.azl3 | 2.8.3-2 | 2 |
Charts affected
1,151 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| nzbhydra2geek-cookbookVerified publisher | 10.4.2 | 1 of 1See more | 17,758 |
| openkmgeek-cookbookVerified publisher | 4.2.0 | 1 of 1See more | 28,039 |
| photoprismgeek-cookbookVerified publisher | 7.2.0 | 1 of 1See more | 19,560 |
| puppeteergeek-cookbookVerified publisher | 1.2.2 | 1 of 1See more | 15,792 |
| qbittorrentgeek-cookbookVerified publisher | 13.5.2 | 1 of 1See more | 11,855 |
| seafilegeek-cookbookVerified publisher | 3.2.0 | 1 of 1See more | 24,355 |
| teedygeek-cookbookVerified publisher | 6.2.0 | 1 of 1See more | 26,996 |
| transmissiongeek-cookbookVerified publisher | 8.4.3 | 1 of 1See more | 11,909 |
| xtevegeek-cookbookVerified publisher | 8.4.2 | 1 of 1See more | 17,996 |
| dispatchoor-uigeneral-helm-chartsVerified publisher | 0.1.0 | 1 of 1See more | 1,339 |
| panda-pulsegeneral-helm-chartsVerified publisher | 1.0.5 | 1 of 1See more | 704 |
| rocketmqgengxiankun-charts | 0.3.0 | 1 of 1See more | 4,961 |
| geonetwork-k8sgeonetwork-k8sVerified publisher | 4.2.8 | 3 of 5See more | 34,879 |
| knativegitlabVerified publisher | 0.10.0 | 3 of 10See more | 36,145 |
| jaegergpg-dev | 3.3.3 | 2 of 5See more | 19,291 |
| kubernetes-dashboardgpg-dev | 7.5.0 | 1 of 5See more | 6,075 |
| opentelemetry-demogpg-dev | 0.33.8 | 1 of 27See more | 47,117 |
| video-analytics-demogpu-operator | 0.1.9 | 1 of 3See more | 15,780 |
| grafana-dashboard-convertergrafana-dashboard-converterVerified publisher | 0.3.10 | 1 of 1See more | 907 |
| grapple-installergrapple-installer | 0.3.22 | 1 of 1See more | 7,935 |
| gravitino-iceberg-rest-server-helmgravitino-iceberg-rest-server | 1.3.11 | 1 of 1See more | 4,604 |
| grayloggraylogVerified publisher | 1.0.2 | 1 of 4See more | 5,339 |
| temporalgroundcover | 1.12.359 | 1 of 2See more | 2,001 |
| librechathajowielandVerified publisher | 1.1.0 | 1 of 1See more | 2,949 |
| octoboxhalkeye | 0.1.1 | 1 of 1See more | 3,256 |
| hawk-envoy-pluginhawk | 0.1.0 | 1 of 4See more | 9,151 |
| heliconehelicone | 0.1.42 | 1 of 14See more | 23,472 |
| 7dtdhelm-7dtd | 0.1.0 | 1 of 1See more | 10,655 |
| pageshelm-chart-repos-camden | 1.0.0 | 2 of 3See more | 20,233 |
| home-assistanthelm-chart-roeiVerified publisher | 2025.3.0 | 1 of 1See more | 4,646 |
| iofoghelm-chartsVerified publisher | 0.1.1 | 1 of 3See more | 24,174 |
| nginx-charthelm-chart-sample-app | 0.1.0 | 1 of 1See more | 4,596 |
| helmfile-gitops-agenthelmfile-gitops-agentVerified publisher | 1.1.96 | 2 of 3See more | 2,597 |
| appwritehelmforgeVerified publisher | 1.3.4 | 2 of 5See more | 7,010 |
| booklorehelmforgeVerified publisher | 2.0.1 | 1 of 3See more | 2,324 |
| ckanhelmforgeVerified publisher | 1.3.8 | 1 of 6See more | 9,991 |
| countlyhelmforgeVerified publisher | 1.2.6 | 1 of 3See more | 18,923 |
| druidhelmforgeVerified publisher | 1.3.6 | 1 of 4See more | 8,598 |
| giteahelmforgeVerified publisher | 1.1.20 | 1 of 1See more | 536 |
| minecrafthelmforgeVerified publisher | 1.5.3 | 1 of 1See more | 4,702 |
| netboxhelmforgeVerified publisher | 2.0.1 | 1 of 4See more | 4,321 |
| opencloudhelmforgeVerified publisher | 1.0.0 | 1 of 1See more | 663 |
| openreel-videohelmforgeVerified publisher | 1.0.3 | 1 of 1See more | 1,086 |
| poznotehelmforgeVerified publisher | 2.0.2 | 1 of 1See more | 483 |
| strapihelmforgeVerified publisher | 2.3.14 | 1 of 3See more | 2,073 |
| tomcathelmforgeVerified publisher | 1.0.6 | 1 of 2See more | 1,224 |
| zookeeperhelmforgeVerified publisher | 1.0.2 | 1 of 1See more | 3,142 |
| openaevhelm-openbasVerified publisher | 2.0.5 | 1 of 7See more | 7,502 |
| openbashelm-openbasVerified publisher | 1.8.14 | 1 of 7See more | 25,099 |
| release-cleanerhelm-release-cleanerVerified publisher | 1.0.0 | 1 of 1See more | 2,001 |
Container images carrying it
1,069 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| linuxserver/ | f93d2560e233 | expat | no fix listed | 1 |
| linuxserver/ | a00b6a597a38 | expat | 2.8.4-r0 | 1 |
| linuxserver/ | dd24a5f3db32 | expat | 2.8.4-r0 | 1 |
| linuxserver/ | 0ae315a3a456 | expat | no fix listed | 1 |
| linuxserver/ | ab105cc50322 | expat | no fix listed | 1 |
| livekit/ | 1ab01641b366 | expat | no fix listed | 1 |
| loeken/ | 7efbc24e47b0 | expat | 2.8.4-r0 | 1 |
| longhornio/ | dca34321452c | expat | no fix listed | 1 |
| longhornio/ | ede61fe2a472 | expat | no fix listed | 1 |
| lsstsqre/ | b75bf8aaafa4 | expat | no fix listed | 1 |
| m11s/ | 0cd6810c9885 | expat | 2.8.4-r0 | 1 |
| maksymhencha/ | 7f096a681192 | expat | no fix listed | 1 |
| maptiler/ | 7e206140057b | expat | no fix listed | 1 |
| mauricenino/ | 236997816917 | expat | 2.8.4-r0 | 1 |
| mavrick1/ | 45ca0429a1d4 | expat | 2.8.4-r0 | 1 |
| mavrick1/ | 56bd8eaa53a4 | expat | 2.8.4-r0 | 1 |
| mbround18/ | 70bd4da591cd | expat | no fix listed | 1 |
| mediagis/ | 7923a8e67197 | expat | no fix listed | 1 |
| mediagis/ | c15e941485ef | expat | no fix listed | 1 |
| mediagis/ | d0eae7b51374 | expat | no fix listed | 1 |
| metabase/ | 4f150effd484 | expat | 2.8.4-r0 | 1 |
| metabase/ | 7807bc5cad17 | expat | 2.8.4-r0 | 1 |
| mlikiowa/ | 1336a777f9a4 | expat | no fix listed | 1 |
| moby/ | a095b3d11ce1 | expat | 2.8.4-r0 | 1 |
| mrasif/ | 375a1ed8fdc0 | expat | 2.8.4-r0 | 1 |
| mrnim94/ | 86c4807a4bca | expat | 2.8.4-r0 | 1 |
| mshanley80/ | 5b189a70c0fb | expat | no fix listed | 1 |
| muluder/ | 43b597a93da7 | expat | no fix listed | 1 |
| n8nio/ | 761374d4eb84 | expat | 2.8.4-r0 | 1 |
| n8nio/ | cfe2704ff858 | expat | 2.8.4-r0 | 1 |
| n8nio/ | ed16e560c40e | expat | 2.8.4-r0 | 1 |
| netbirdio/ | aae926912ca4 | expat | 2.8.4-r0 | 1 |
| netboxcommunity/ | 3d652dca5351 | expat | no fix listed | 1 |
| netboxcommunity/ | 91b823a05cb5 | expat | no fix listed | 1 |
| nethermind/ | 15517708c3b6 | expat | no fix listed | 1 |
| netrisai/ | 8c5074f55ae5 | expat | 2.8.4-r0 | 1 |
| netskopeprivateaccess/ | 93e2fd164a93 | expat | no fix listed | 1 |
| nginxdemos/ | 751bf8933179 | expat | 2.8.4-r0 | 1 |
| nginxdemos/ | b28d1e16c676 | expat | 2.8.4-r0 | 1 |
| nginxinc/ | 62a904036bfc | expat | 2.8.4-r0 | 1 |
| nginxinc/ | 6320020c7da8 | expat | 2.8.4-r0 | 1 |
| nginxinc/ | 82dcf28da5a8 | expat | 2.8.4-r0 | 1 |
| nginxinc/ | b37d9945be77 | expat | 2.8.4-r0 | 1 |
| nginxinc/ | e93571f3d083 | expat | 2.8.4-r0 | 1 |
| nginxinc/ | f972e5322b97 | expat | 2.8.4-r0 | 1 |
| nodered/ | 10f40d0a83e7 | expat | 2.8.4-r0 | 1 |
| nodered/ | 216e7403aab9 | expat | 2.8.4-r0 | 1 |
| nodered/ | d73ae167cb9b | expat | 2.8.4-r0 | 1 |
| novosga/ | 34b9acbe6e51 | expat | 2.8.4-r0 | 1 |
| octoboxio/ | d909041c46eb | expat | 2.8.4-r0 | 1 |