CVE-2026-76641

High

Advisory

Published 20 Aug 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.004; 29th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,151; of 17,787 indexed, latest versions
Container images: 1,069; deployed by those charts
Fix available: 3 of 3; affected packages

CVE-2026-76641 affecting package expat for versions less than 2.8.3-2

Carried by container images the latest versions of 1,151 of 17,787 indexed charts deploy, on 1,069 images.

Affected package	Affected versions	Fixed in	Images
expatapk	2.6.4-r0, 2.7.0-r0, 2.7.1-r0, 2.7.2-r0+7 more	2.8.4-r0	412
expatdeb	2.1.0-4ubuntu1, 2.1.0-4ubuntu1.4, 2.1.0-7ubuntu0.16.04.2, 2.1.0-7ubuntu0.16.04.3+27 more	2.8.4-1	655
expatrpm	2.8.2-1.azl3	2.8.3-2	2

OSV records: ALPINE-CVE-2026-76641 UBUNTU-CVE-2026-76641 AZL-96932 ECHO-0ffe-8d46-73ca

Charts affected

1,151 by stars

Chart

Latest

Affected images

Radar Score

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-76641.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	expat@2.4.7-1ubuntu0.7	no fix listed

Open the chart page →

7,916

Container images carrying it

1,069 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
allegroai/clearml-agent-k8s-base :1.24-21	772827a01bb5	expat@2.2.5-3ubuntu0.7	no fix listed	1
alpine/git :v2.49.1	c0280cf95723	expat@2.7.3-r0	2.8.4-r0	1
alpine/helm :4.1.0	905a068da431	expat@2.7.3-r0	2.8.4-r0	1
alpine/k8s :1.36.2	44ef4942e171	expat@2.8.1-r0	2.8.4-r0	1
alpine/k8s :1.31.10	6dbe6f391eda	expat@2.7.1-r0	2.8.4-r0	1
alpine/k8s :1.31.13	7a319b15cfc9	expat@2.7.2-r0	2.8.4-r0	1
alpine/k8s :1.32.4	7e1e7d5b7a96	expat@2.7.0-r0	2.8.4-r0	1
alpine/k8s :1.31.4	9c4976d47656	expat@2.6.4-r0	2.8.4-r0	1
alpine/k8s :1.35.6	b7a12c5ddf26	expat@2.8.1-r0	2.8.4-r0	1
alpine/k8s :1.35.5	d870622d0040	expat@2.8.1-r0	2.8.4-r0	1
alpine/k8s :1.32.3	eec354133193	expat@2.6.4-r0	2.8.4-r0	1
andrcuns/dependabot-gitlab :7.7.0-alpha.1	43060f159f4c	expat@2.6.1-2ubuntu0.4	no fix listed	1
andrewgaul/s3proxy :sha-85b0f98	7dc1d34174a5	expat@2.6.1-2ubuntu0.1	no fix listed	1
andrewgolikov55/intel-gpu-exporter :latest	fcc001b61c0e	expat@2.4.7-1ubuntu0.2	no fix listed	1
andrewmackrodt/firefox-x11 :142.0.1-r1	33f9080470c9	expat@2.4.7-1ubuntu0.6	no fix listed	1
anguda/ant-media :2.5	c435285fc241	expat@2.2.9-1ubuntu0.6	no fix listed	1
antiantiops/vscode-browser-docker :1.137.0	eeff80a99d92	expat@2.6.1-2ubuntu0.4	no fix listed	1
antrea/antrea-agent-ubuntu :v2.7.0	c10bc45c6272	expat@2.6.1-2ubuntu0.4	no fix listed	1
apache/activemq-artemis :2.44.0	0305c26f19ed	expat@2.6.1-2ubuntu0.3	no fix listed	1
apache/activemq-artemis :2.37.0	bae523439ee3	expat@2.6.1-2build1	no fix listed	1
apache/camel-k :2.11.0	d173e7efe258	expat@2.7.4-1	no fix listed	1
apache/gravitino-iceberg-rest :1.3.0	80136ae753ee	expat@2.4.7-1ubuntu0.6	no fix listed	1
apache/hertzbeat :1.8.0	75d48a62748f	expat@2.6.1-2ubuntu0.3	no fix listed	1
apache/hertzbeat-collector :1.8.0	a2bab1be574c	expat@2.6.1-2ubuntu0.3	no fix listed	1
apache/iotdb :0.13.3-node	afa47bf1692a	expat@2.2.9-1ubuntu0.4	no fix listed	1
apache/kafka :4.1.0	bff074a5d005	expat@2.7.1-r0	2.8.4-r0	1
apache/nifi-registry :1.27.0	63b8e3e40742	expat@2.4.7-1ubuntu0.3	no fix listed	1
apachepulsar/pulsar :3.1.0	16f9fdab3fa6	expat@2.4.7-1ubuntu0.2	no fix listed	1
apachepulsar/pulsar :2.10.0	3b262ab7a7d9	expat@2.2.9-1build1	no fix listed	1
apachepulsar/pulsar :3.0.7	9c9947de139d	expat@2.4.7-1ubuntu0.4	no fix listed	1
apachepulsar/pulsar :2.9.0	d056c89b7131	expat@2.2.9-1build1	no fix listed	1
apachepulsar/pulsar :2.8.2	d538416d5afe	expat@2.2.9-1build1	no fix listed	1
apache/ranger :2.7.0	76c176e8a0e4	expat@2.4.7-1ubuntu0.6	no fix listed	1
apache/rocketmq :5.3.0	434d8398f996	expat@2.6.1-2build1	no fix listed	1
apache/rocketmq-exporter :0.0.2	c8fb51195444	expat@2.4.7-1ubuntu0.2	no fix listed	1
apache/skywalking-oap-server :9.2.0	133d35d2c263	expat@2.4.7-1	no fix listed	1
apache/skywalking-oap-server :8.9.1	b4ec8c18d079	expat@2.2.9-1build1	no fix listed	1
apache/skywalking-ui :9.2.0	295f1dc87d98	expat@2.4.7-1	no fix listed	1
apache/skywalking-ui :8.9.1	80530f0308a5	expat@2.2.9-1build1	no fix listed	1
apache/tika :latest-full	80072bb73dd3	expat@2.7.4-1	no fix listed	1
apache/tika :2.9.0.0	92d055a84e9e	expat@2.4.7-1ubuntu0.2	no fix listed	1
appwrite/appwrite :1.9.0	1aaa70127114	expat@2.7.4-r0	2.8.4-r0	1
appwrite/appwrite :1.9.6	adc7d0e7ec23	expat@2.7.5-r0	2.8.4-r0	1
appwrite/console :8.7.38	3dcdc8492ac6	expat@2.7.4-r0	2.8.4-r0	1
aquasec/trivy :0.74.0	62b1e65e8869	expat@2.8.2-r0	2.8.4-r0	1
aquasec/trivy :0.69.3	bcc376de8d77	expat@2.7.4-r0	2.8.4-r0	1
arunvelsriram/utils :latest	655ad18fd8d6	expat@2.6.1-2ubuntu0.3	no fix listed	1
assistiot/cybersecurity-monitoring_ir-cas :latest	6a107f224c34	expat@2.2.9-1ubuntu0.6	no fix listed	1
assistiot/location_processing :latest	e9bae124095f	expat@2.4.7-1	no fix listed	1
assistiot/open_api_backend :1.1.2	30812ba93555	expat@2.4.7-1ubuntu0.2	no fix listed	1