StackRadar

CVE-2026-76641

High

Advisory

Published 20 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,151
of 17,787 indexed, latest versions
Container images
1,069
deployed by those charts
Fix available
3 of 3
affected packages

CVE-2026-76641 affecting package expat for versions less than 2.8.3-2

Carried by container images the latest versions of 1,151 of 17,787 indexed charts deploy, on 1,069 images.

Affected packageAffected versionsFixed inImages
expatapk2.6.4-r0, 2.7.0-r0, 2.7.1-r0, 2.7.2-r0+7 more2.8.4-r0412
expatdeb2.1.0-4ubuntu1, 2.1.0-4ubuntu1.4, 2.1.0-7ubuntu0.16.04.2, 2.1.0-7ubuntu0.16.04.3+27 more2.8.4-1655
expatrpm2.8.2-1.azl32.8.3-22
OSV records
ALPINE-CVE-2026-76641UBUNTU-CVE-2026-76641AZL-96932ECHO-0ffe-8d46-73ca

Charts affected

1,151 by stars
ChartLatestAffected imagesRadar Score
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
expat@2.4.7-1ubuntu0.7
no fix listed

Open the chart page →

7,916

Container images carrying it

1,069 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
semaphoreui/semaphore:v2.18.3e9260bfa8255
expat@2.7.5-r0
2.8.4-r0
1
seyiogunniran/my-nginx:1.03a0ed39e5830
expat@2.7.1-r0
2.8.4-r0
1
shaowenchen/ops-controller-manager:latest26da43bb5b66
expat@2.4.7-1ubuntu0.7
no fix listed
1
shaowenchen/ops-server:latest315444f703f4
expat@2.4.7-1ubuntu0.6
no fix listed
1
shenxn/protonmail-bridge:1.8.7-1acf31af7c111
expat@2.2.5-3ubuntu0.2
no fix listed
1
shlinkio/shlink-web-client:4.8.1dc8bf3565a25
expat@2.8.2-r0
2.8.4-r0
1
siakhooi/query:1.0.0f1f4b5b1b870
expat@2.7.5-r0
2.8.4-r0
1
sigma2as/rstudio-proxy:20260818-1df6a44d899e81ee3eb
expat@2.8.2-r0
2.8.4-r0
1
signalen/frontend:2.27.81ab79cb7fe21
expat@2.8.1-r0
2.8.4-r0
1
sismics/docs:v1.10f4b0ef019cf1
expat@2.2.5-3
no fix listed
1
slagattollas/weatherservice-practica:latest68e7f56393fc
expat@2.2.5-3ubuntu0.2
no fix listed
1
snipe/snipe-it:v8.3.1141ebf2386fe
expat@2.6.1-2ubuntu0.3
no fix listed
1
snipe/snipe-it:v6.0.1455fb7636a98c
expat@2.2.9-1ubuntu0.4
no fix listed
1
snyk/kubernetes-monitor:2.23.26fb5ad76ce84e
expat@2.8.3-r0
2.8.4-r0
1
socialmediamacroscope/autophrase:0.1.570fb11d4f531
expat@2.2.9-1ubuntu0.6
no fix listed
1
socialmediamacroscope/collect_reddit_comment:0.1.219d3d26d53ee
expat@2.2.5-3ubuntu0.9
no fix listed
1
socialmediamacroscope/image_crawler:0.1.2f508216be63c
expat@2.2.5-3ubuntu0.9
no fix listed
1
softwaremill/bootzooka:latest845b5e8f8056
expat@2.7.4-1
no fix listed
1
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
expat@2.2.9-1ubuntu0.4
no fix listed
1
sondresjo/garge-api:v2.12.6f41e452800ff
expat@2.6.1-2ubuntu0.4
no fix listed
1
stackstorm/st2actionrunner:3.888235ba70cad
expat@2.2.9-1ubuntu0.6
no fix listed
1
stackstorm/st2api:3.86f56d239d280
expat@2.2.9-1ubuntu0.6
no fix listed
1
stackstorm/st2auth:3.833ecfda16608
expat@2.2.9-1ubuntu0.6
no fix listed
1
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
expat@2.2.9-1ubuntu0.6
no fix listed
1
stackstorm/st2notifier:3.8f190a6212195
expat@2.2.9-1ubuntu0.6
no fix listed
1
stackstorm/st2rulesengine:3.8259503496ff9
expat@2.2.9-1ubuntu0.6
no fix listed
1
stackstorm/st2scheduler:3.8b1de2055c362
expat@2.2.9-1ubuntu0.6
no fix listed
1
stackstorm/st2sensorcontainer:3.8b1a338f64773
expat@2.2.9-1ubuntu0.6
no fix listed
1
stackstorm/st2stream:3.81c8904a3bf67
expat@2.2.9-1ubuntu0.6
no fix listed
1
stackstorm/st2timersengine:3.81bf35bfaf00c
expat@2.2.9-1ubuntu0.6
no fix listed
1
stackstorm/st2workflowengine:3.819fdfffdbba8
expat@2.2.9-1ubuntu0.6
no fix listed
1
stashapp/stash:latest24dbd7607174
expat@2.2.9-1build1
no fix listed
1
stashapp/stash:v0.31.1df744af5a0c9
expat@2.7.5-r0
2.8.4-r0
1
stashapp/stash-box:latesta534c8afdf39
expat@2.6.1-2ubuntu0.3
no fix listed
1
statcan/ckan:2.93921305425b8
expat@2.2.9-1build1
no fix listed
1
streamnative/apache-pulsar-grafana-dashboard-k8s:0.0.1611bceacec8fb
expat@2.2.9-1build1
no fix listed
1
structurizr/onpremises:2025.11.094b5ffb5119c8
expat@2.6.1-2ubuntu0.3
no fix listed
1
supabase/storage-api:v1.60.4c8eb9858eafe
expat@2.7.5-r0
2.8.4-r0
1
supabase/storage-api:latestf6c42a04163d
expat@2.8.3-r0
2.8.4-r0
1
svcosti/cidrapp:latest8428d87bc5d0
expat@2.7.0-r0
2.8.4-r0
1
svtechnmaa/svtech_debuger:v1.0.3a934ffd63d25
expat@2.4.7-1ubuntu0.3
no fix listed
1
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
expat@2.2.9-1ubuntu0.6
no fix listed
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
expat@2.2.9-1ubuntu0.6
no fix listed
1
swaggerapi/swagger-ui:latest9ae209e3791e
expat@2.8.2-r0
2.8.4-r0
1
sysnet4admin/colosseum-agg:logbc25b152d88e
expat@2.4.7-1ubuntu0.7
no fix listed
1
szurubooru/client:2.5880a53ca446d
expat@2.8.2-r0
2.8.4-r0
1
szurubooru/server:2.5accf2ad9fbc3
expat@2.8.2-r0
2.8.4-r0
1
tchiotludo/akhq:0.28.0c2824dc2ae44
expat@2.7.4-1
no fix listed
1
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
expat@2.7.1-r0
2.8.4-r0
1
temporalio/admin-tools:1.28cfde8170c92f
expat@2.7.4-r0
2.8.4-r0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.