StackRadar

CVE-2026-76641

High

Advisory

Published 20 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,137
of 17,790 indexed, latest versions
Container images
1,055
deployed by those charts
Fix available
3 of 3
affected packages

CVE-2026-76641 affecting package expat for versions less than 2.8.3-2

Carried by container images the latest versions of 1,137 of 17,790 indexed charts deploy, on 1,055 images.

Affected packageAffected versionsFixed inImages
expatapk2.6.4-r0, 2.7.0-r0, 2.7.1-r0, 2.7.2-r0+7 more2.8.4-r0404
expatdeb2.1.0-4ubuntu1, 2.1.0-4ubuntu1.4, 2.1.0-7ubuntu0.16.04.2, 2.1.0-7ubuntu0.16.04.3+27 more2.8.4-1649
expatrpm2.8.2-1.azl32.8.3-22
OSV records
ALPINE-CVE-2026-76641UBUNTU-CVE-2026-76641AZL-96932ECHO-0ffe-8d46-73ca

Charts affected

1,137 by stars
ChartLatestAffected imagesRadar Score
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
expat@2.2.9-1ubuntu0.2
no fix listed

Open the chart page →

17,836
elastictranscoderluiscajl0.46.04 of 4See more

elastictranscoder luiscajl 0.46.0

4 of the 4 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
elastictranscoder/media:627e21dc963ab3858c6b
expat@2.2.5-3ubuntu0.2
no fix listed
elastictranscoder/media-storage:f6d861a026208b8c2359
expat@2.2.5-3ubuntu0.2
no fix listed
elastictranscoder/transcoder:627e21dcb4a0327029e6
expat@2.2.5-3ubuntu0.2
no fix listed
elastictranscoder/transcoder-handler:627e21dc5b75d19e2733
expat@2.2.5-3ubuntu0.2
no fix listed

Open the chart page →

58,225
decap-cmsm11sVerified publisher0.3.151 of 1See more

decap-cms m11s 0.3.15

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
m11s/decap-cms:0.2.11-s30cd6810c9885
expat@2.7.5-r0
2.8.4-r0

Open the chart page →

1,152
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
expat@2.4.7-1ubuntu0.2
no fix listed

Open the chart page →

24,488
docker-mailservermailserverVerified publisher0.2.652 of 9See more

docker-mailserver mailserver 0.2.65

2 of the 9 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
jeboehm/mailserver-filter:5.0.92e756949e537d
expat@2.7.0-r0
2.8.4-r0
jeboehm/mailserver-web:5.0.929da13edf5aa8
expat@2.7.1-r0
2.8.4-r0

Open the chart page →

10,908
novosgamarcusrepo0.1.11 of 2See more

novosga marcusrepo 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
novosga/novosga:latest34b9acbe6e51
expat@2.7.5-r0
2.8.4-r0

Open the chart page →

3,707
ejabberdmartialblog0.3.11 of 1See more

ejabberd martialblog 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
ghcr.io/processone/ejabberd:latest5aeb0faa39cf
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

386
mayastormayastorVerified publisher2.12.11 of 31See more

mayastor mayastor 2.12.1

1 of the 31 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
openebs/provisioner-localpv:4.6.099f5116f5cb8
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

21,178
eoloplantmca-eoloplaner0.1.02 of 7See more

eoloplant mca-eoloplaner 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
hugohg34/toposervice:0.0.2812a03b3f274
expat@2.2.9-1ubuntu0.4
no fix listed
library/rabbitmq:3.9-management8a279e9396a8
expat@2.4.7-1ubuntu0.2
no fix listed

Open the chart page →

29,712
dependency-trackmediamarktsaturn1.9.21 of 2See more

dependency-track mediamarktsaturn 1.9.2

1 of the 2 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
dependencytrack/frontend:4.14.200560b57a6cf
expat@2.7.5-r0
2.8.4-r0

Open the chart page →

3,797
profilarrmedia-servarrVerified publisher2.2.01 of 1See more

profilarr media-servarr 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
ghcr.io/dictionarry-hub/profilarr:2.2.0ddcdd0f34004
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

337
cameramedia-streaming-meshVerified publisher0.2.52 of 3See more

camera media-streaming-mesh 0.2.5

2 of the 3 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
ciscolabs/rtsp-client:latesta7b60ec88285
expat@2.2.9-1ubuntu0.4
no fix listed
ciscolabs/rtsp-server:latestb59fc10bb821
expat@2.2.9-1ubuntu0.4
no fix listed

Open the chart page →

18,712
msm-rtspmedia-streaming-meshVerified publisher0.0.22 of 2See more

msm-rtsp media-streaming-mesh 0.0.2

2 of the 2 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
ciscolabs/rtsp-client:latesta7b60ec88285
expat@2.2.9-1ubuntu0.4
no fix listed
ciscolabs/rtsp-server:latestb59fc10bb821
expat@2.2.9-1ubuntu0.4
no fix listed

Open the chart page →

18,712
rtspmedia-streaming-meshVerified publisher0.0.142 of 2See more

rtsp media-streaming-mesh 0.0.14

2 of the 2 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
ciscolabs/rtsp-client:latesta7b60ec88285
expat@2.2.9-1ubuntu0.4
no fix listed
ciscolabs/rtsp-server:latestb59fc10bb821
expat@2.2.9-1ubuntu0.4
no fix listed

Open the chart page →

18,712
kubeaddons-catalogmesosphere0.1.161 of 2See more

kubeaddons-catalog mesosphere 0.1.16

1 of the 2 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
mesosphere/kubeaddons-catalog:v0.11.4073db43d0b8b
expat@2.2.9-1build1
no fix listed

Open the chart page →

12,049
kommandermesosphere-stable0.39.21 of 29See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
mesosphere/kubeaddons-catalog:v0.11.4073db43d0b8b
expat@2.2.9-1build1
no fix listed

Open the chart page →

68,330
localpathprovisionermesosphere-stable0.1.21 of 1See more

localpathprovisioner mesosphere-stable 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
rancher/local-path-provisioner:v0.0.5e66f32d19eb9
expat@2.1.0-7ubuntu0.16.04.3
no fix listed

Open the chart page →

17,966
metabase-k8smetabase-k8s1.0.01 of 1See more

metabase-k8s metabase-k8s 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
metabase/metabase:v0.53.4.17807bc5cad17
expat@2.6.4-r0
2.8.4-r0

Open the chart page →

2,589
alluremidokura-communityVerified publisher0.1.31 of 2See more

allure midokura-community 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
frankescobar/allure-docker-service:2.19.0cafa03b94dac
expat@2.2.5-3ubuntu0.7
no fix listed

Open the chart page →

12,862
unifimidokura-communityVerified publisher0.0.61 of 1See more

unifi midokura-community 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
linuxserver/unifi-controller:7.3.83ab105cc50322
expat@2.2.9-1ubuntu0.6
no fix listed

Open the chart page →

11,254
mini-blogmini-blog-helm0.1.01 of 3See more

mini-blog mini-blog-helm 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
beyzkaya/blog-frontend:v1.0.0bf412d75c510
expat@2.7.1-r0
2.8.4-r0

Open the chart page →

12,637
mo-backupmogeniusOfficialVerified publisher1.0.291 of 1See more

mo-backup mogenius 1.0.29

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
ghcr.io/mogenius/mo-backup:latest4f89afef9010
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

814
mo-backup-mysqlmogeniusVerified publisher1.0.291 of 1See more

mo-backup-mysql mogenius 1.0.29

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
ghcr.io/mogenius/mo-backup:latest4f89afef9010
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

814
account-lookup-servicemojaloop13.0.01 of 4See more

account-lookup-service mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
expat@2.2.9-1ubuntu0.4
no fix listed

Open the chart page →

11,734
account-lookup-service-adminmojaloop13.0.01 of 4See more

account-lookup-service-admin mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
expat@2.2.9-1ubuntu0.4
no fix listed

Open the chart page →

11,734
admin-api-svcmojaloop12.0.01 of 4See more

admin-api-svc mojaloop 12.0.0

1 of the 4 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
expat@2.2.9-1ubuntu0.4
no fix listed

Open the chart page →

12,147
fspiop-transfer-api-svcmojaloop12.0.11 of 3See more

fspiop-transfer-api-svc mojaloop 12.0.1

1 of the 3 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
expat@2.2.9-1ubuntu0.4
no fix listed

Open the chart page →

11,518
mojaloopmojaloop14.0.01 of 6See more

mojaloop mojaloop 14.0.0

1 of the 6 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
expat@2.2.9-1ubuntu0.4
no fix listed

Open the chart page →

19,265
camera-viewermoreillonVerified publisher0.2.11 of 4See more

camera-viewer moreillon 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
library/kong:3.6a42d2b4503e7
expat@2.4.7-1ubuntu0.6
no fix listed

Open the chart page →

11,694
group-managermoreillonVerified publisher0.4.41 of 3See more

group-manager moreillon 0.4.4

1 of the 3 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
library/kong:3.6a42d2b4503e7
expat@2.4.7-1ubuntu0.6
no fix listed

Open the chart page →

9,886
mqtt-loggermoreillonVerified publisher0.3.11 of 5See more

mqtt-logger moreillon 0.3.1

1 of the 5 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
library/kong:3.6a42d2b4503e7
expat@2.4.7-1ubuntu0.6
no fix listed

Open the chart page →

10,998
user-manager-mongodbmoreillonVerified publisher0.6.21 of 4See more

user-manager-mongodb moreillon 0.6.2

1 of the 4 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
library/kong:3.6a42d2b4503e7
expat@2.4.7-1ubuntu0.6
no fix listed

Open the chart page →

23,263
user-manager-neo4jmoreillonVerified publisher0.9.71 of 6See more

user-manager-neo4j moreillon 0.9.7

1 of the 6 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
library/kong:3.6a42d2b4503e7
expat@2.4.7-1ubuntu0.6
no fix listed

Open the chart page →

30,195
chirpstackmosquitto-helm-chart0.5.01 of 8See more

chirpstack mosquitto-helm-chart 0.5.0

1 of the 8 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.9.0d056c89b7131
expat@2.2.9-1build1
no fix listed

Open the chart page →

25,989
pulsarmosquitto-helm-chart0.2.01 of 1See more

pulsar mosquitto-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.10.03b262ab7a7d9
expat@2.2.9-1build1
no fix listed

Open the chart page →

15,731
crowdmoxVerified publisher2.4.31 of 3See more

crowd mox 2.4.3

1 of the 3 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
atlassian/crowd:5.2.2ebf761c7d437
expat@2.6.1-2ubuntu0.4
no fix listed

Open the chart page →

5,713
radicalemt1905024.1.11 of 1See more

radicale mt190502 4.1.1

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
tomsquest/docker-radicale:3.6.1.0a594c624c5a6
expat@2.7.4-r0
2.8.4-r0

Open the chart page →

1,546
devops-demomungari-development-charts1.0.41 of 4See more

devops-demo mungari-development-charts 1.0.4

1 of the 4 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
ghcr.io/perceptolab/devops-demo-app:0.0.2cdc0658c40fb
expat@2.2.5-3ubuntu0.7
no fix listed

Open the chart page →

8,946
pagesmuthu-pages1.0.02 of 3See more

pages muthu-pages 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
expat@2.2.9-1build1
no fix listed
flyway/flyway:6.4.422d97ceb0c47
expat@2.2.5-3ubuntu0.2
no fix listed

Open the chart page →

20,233
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
expat@2.4.7-1
no fix listed

Open the chart page →

12,861
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
expat@2.4.7-1
no fix listed

Open the chart page →

12,861
szurubooru-clientmy0nVerified publisher0.3.11 of 1See more

szurubooru-client my0n 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
szurubooru/client:2.5880a53ca446d
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

371
szurubooru-servermy0nVerified publisher0.2.51 of 3See more

szurubooru-server my0n 0.2.5

1 of the 3 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
szurubooru/server:2.5accf2ad9fbc3
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

1,044
Practica_4_helmmy-heml-appVerified publisher0.1.02 of 7See more

Practica_4_helm my-heml-app 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
expat@2.2.5-3ubuntu0.9
no fix listed
library/rabbitmq:3.9-management8a279e9396a8
expat@2.4.7-1ubuntu0.2
no fix listed

Open the chart page →

27,812
nginx-chartmy-nginx-chart0.1.01 of 1See more

nginx-chart my-nginx-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
amaraiheanacho/nginx-site:latest5c86fccf5daa
expat@2.7.0-r0
2.8.4-r0

Open the chart page →

840
myweatherhelmmyweather1.3.112 of 7See more

myweatherhelm myweather 1.3.11

2 of the 7 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
library/rabbitmq:3-managemente582c0bc7766
expat@2.6.1-2ubuntu0.3
no fix listed
mcr.microsoft.com/mssql/server:2017-latestfbf79e0fea59
expat@2.2.5-3ubuntu0.9
no fix listed

Open the chart page →

17,411
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

1,039
dependency-tracknaj980.0.91 of 3See more

dependency-track naj98 0.0.9

1 of the 3 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
dependencytrack/frontend:latest8854a8320475
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

2,445
pagesnarain1.0.02 of 3See more

pages narain 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
expat@2.2.9-1build1
no fix listed
flyway/flyway:6.4.422d97ceb0c47
expat@2.2.5-3ubuntu0.2
no fix listed

Open the chart page →

20,233
pagesnarasimha-pages1.0.02 of 3See more

pages narasimha-pages 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-76641.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
expat@2.2.9-1build1
no fix listed
flyway/flyway:6.4.422d97ceb0c47
expat@2.2.5-3ubuntu0.2
no fix listed

Open the chart page →

20,233

Container images carrying it

1,055 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
registry.gitlab.com/dyff/workflows-aggregator:0.16.9b7984253b128
expat@2.7.4-1
no fix listed
1
registry.gitlab.com/gitlab-ci-utils/curl-jq:latestb564745b6cb0
expat@2.8.2-r0
2.8.4-r0
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
expat@2.2.9-1build1
no fix listed
1
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
expat@2.7.5-r0
2.8.4-r0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
expat@2.8.2-r0
2.8.4-r0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.