StackRadar

CVE-2026-76956

High

Advisory

Published 20 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
774
of 17,787 indexed, latest versions
Container images
611
deployed by those charts
Fix available
3 of 3
affected packages

CVE-2026-76956 affecting package expat for versions less than 2.8.3-2

Carried by container images the latest versions of 774 of 17,787 indexed charts deploy, on 611 images.

Affected packageAffected versionsFixed inImages
expatapk2.6.4-r0, 2.7.0-r0, 2.7.1-r0, 2.7.2-r0+7 more2.8.4-r0412
expatdeb2.7.1-2, 2.7.1-2+dhi4, 2.7.5-1, 2.8.2-1+e1+2 more2.8.4-1197
expatrpm2.8.2-1.azl32.8.3-22
OSV records
ALPINE-CVE-2026-76956DEBIAN-CVE-2026-76956AZL-96848ECHO-8a36-8d53-bf0c

Charts affected

774 by stars
ChartLatestAffected imagesRadar Score
video-analytics-demo-l4tgpu-operator0.1.31 of 3See more

video-analytics-demo-l4t gpu-operator 0.1.3

1 of the 3 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
grafana-dashboard-convertergrafana-dashboard-converterVerified publisher0.3.101 of 1See more

grafana-dashboard-converter grafana-dashboard-converter 0.3.10

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
kenchrcum/grafana-dashboard-converter:0.3.105310497aea3f
expat@2.7.4-r0
2.8.4-r0

Open the chart page →

907
temporalgroundcover1.12.3591 of 2See more

temporal groundcover 1.12.359

1 of the 2 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
public.ecr.aws/groundcovercom/temporalio/admin-tools:1.29.7-20260730-1af8cea3b8538
expat@2.8.2-1+e1
2.8.4-1

Open the chart page →

2,001
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
expat@2.7.0-r0
2.8.4-r0

Open the chart page →

2,949
rag-apihajowielandVerified publisher1.0.01 of 1See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latestf9f34c8ed688
expat@2.8.2-1~deb13u1
no fix listed

Open the chart page →

1,635
octoboxhalkeye0.1.11 of 1See more

octobox halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
octoboxio/octobox:latestd909041c46eb
expat@2.7.3-r0
2.8.4-r0

Open the chart page →

3,256
web-charthcpark-ktcloudlab0.1.01 of 1See more

web-chart hcpark-ktcloudlab 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
test-apphellnet0.1.11 of 1See more

test-app hellnet 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
my_web1helm-chart-by-piyush0.1.01 of 1See more

my_web1 helm-chart-by-piyush 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/httpd:latest979c38c2228d
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,693
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
expat@2.6.4-r0
2.8.4-r0

Open the chart page →

4,646
hello-world-charthelm-chart-test-hello-world0.1.01 of 1See more

hello-world-chart helm-chart-test-hello-world 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
mywebhelmchartwebapp0.0.51 of 1See more

myweb helmchartwebapp 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/httpd:latest979c38c2228d
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,693
my-apphelm-demo85640.2.71 of 2See more

my-app helm-demo8564 0.2.7

1 of the 2 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
helmfile-gitops-agenthelmfile-gitops-agentVerified publisher1.1.962 of 3See more

helmfile-gitops-agent helmfile-gitops-agent 1.1.96

2 of the 3 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
alpine/git:v2.54.06f3b5029566d
expat@2.8.3-r0
2.8.4-r0
ghcr.io/helmfile/helmfile:v1.7.4f20e612d5a98
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

2,597
apachehelmforgeVerified publisher1.0.61 of 1See more

apache helmforge 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/httpd:2.4.68979c38c2228d
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,693
appwritehelmforgeVerified publisher1.3.42 of 5See more

appwrite helmforge 1.3.4

2 of the 5 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.6adc7d0e7ec23
expat@2.7.5-r0
2.8.4-r0
appwrite/console:8.7.383dcdc8492ac6
expat@2.7.4-r0
2.8.4-r0

Open the chart page →

7,010
booklorehelmforgeVerified publisher2.0.11 of 3See more

booklore helmforge 2.0.1

1 of the 3 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/booklore-app/booklore:v2.3.1d3d3af34bc2c
expat@2.8.1-r0
2.8.4-r0

Open the chart page →

2,324
castopodhelmforgeVerified publisher1.2.71 of 3See more

castopod helmforge 1.2.7

1 of the 3 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
castopod/castopod:1.15.54e4f0440520f
expat@2.7.1-2
no fix listed

Open the chart page →

9,422
chiefonboardinghelmforgeVerified publisher1.1.141 of 3See more

chiefonboarding helmforge 1.1.14

1 of the 3 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
expat@2.7.1-2
no fix listed

Open the chart page →

10,898
dawarichhelmforgeVerified publisher1.0.01 of 4See more

dawarich helmforge 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
postgis/postgis:18-3.67e00e8c3539f
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

4,698
discount-bandithelmforgeVerified publisher2.0.81 of 3See more

discount-bandit helmforge 2.0.8

1 of the 3 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
cybrarist/discount-bandit:v4.0.4e9e2447ac666
expat@2.7.1-2
no fix listed

Open the chart page →

29,852
entehelmforgeVerified publisher1.0.21 of 4See more

ente helmforge 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/ente/web:5ab0c5b4c7a89c4e470ef6f793600da33cebf35d3f4864eb7f11
expat@2.8.2-1~deb13u1
no fix listed

Open the chart page →

4,227
fastmcp-serverhelmforgeVerified publisher1.7.41 of 1See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.11.2fcb7017327d6
expat@2.7.1-2
no fix listed

Open the chart page →

3,294
generichelmforgeVerified publisher3.1.51 of 1See more

generic helmforge 3.1.5

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:1.31.505b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
giteahelmforgeVerified publisher1.1.201 of 1See more

gitea helmforge 1.1.20

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
gitea/gitea:1.27.3-rootless1c17ecaead42
expat@2.8.3-r0
2.8.4-r0

Open the chart page →

536
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
expat@2.7.1-2
no fix listed

Open the chart page →

11,080
jenkinshelmforgeVerified publisher1.0.91 of 1See more

jenkins helmforge 1.0.9

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
jenkins/jenkins:2.568.3-lts-jdk21c1e4c349365f
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

2,487
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
expat@2.7.1-2
no fix listed

Open the chart page →

3,442
nextcloudhelmforgeVerified publisher1.0.01 of 3See more

nextcloud helmforge 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nextcloud:34.0.4-apachede4ad9389386
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

7,041
opencloudhelmforgeVerified publisher1.0.01 of 1See more

opencloud helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
opencloudeu/opencloud:7.2.46d992ccc5f1c
expat@2.8.3-r0
2.8.4-r0

Open the chart page →

663
openreel-videohelmforgeVerified publisher1.0.31 of 1See more

openreel-video helmforge 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
helmforge/openreel-video:v0.5.07ba0d47b943f
expat@2.7.5-r0
2.8.4-r0

Open the chart page →

1,086
phpmyadminhelmforgeVerified publisher2.0.11 of 1See more

phpmyadmin helmforge 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
phpmyadmin/phpmyadmin:5.2.342a200db07b4
expat@2.7.1-2
no fix listed

Open the chart page →

4,741
poznotehelmforgeVerified publisher2.0.21 of 1See more

poznote helmforge 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/timothepoznanski/poznote:6.80.0045035db3a20
expat@2.8.3-r0
2.8.4-r0

Open the chart page →

483
strapihelmforgeVerified publisher2.3.141 of 3See more

strapi helmforge 2.3.14

1 of the 3 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.270e9143d6d92
expat@2.8.3-r0
2.8.4-r0

Open the chart page →

2,073
jellyfinhelm-l3st86Verified publisher0.1.81 of 1See more

jellyfin helm-l3st86 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
jellyfin/jellyfin:latestaefb67e6a7ff
expat@2.7.1-2
no fix listed

Open the chart page →

2,615
release-cleanerhelm-release-cleanerVerified publisher1.0.01 of 1See more

release-cleaner helm-release-cleaner 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
alpine/helm:4.1.0905a068da431
expat@2.7.3-r0
2.8.4-r0

Open the chart page →

2,001
my-nginxhelmtaiwo0.1.01 of 1See more

my-nginx helmtaiwo 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
webserverhongshaoyangVerified publisher0.1.31 of 1See more

webserver hongshaoyang 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/httpd:alpine1b766f17b840
expat@2.8.1-r0
2.8.4-r0

Open the chart page →

902
paperlesshpVerified publisher0.1.12 of 5See more

paperless hp 0.1.1

2 of the 5 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.3467097317623a
expat@2.7.1-2
no fix listed
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

26,579
townsquarehuscker-chartsVerified publisher1.0.41 of 2See more

townsquare huscker-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/huscker/townsquare-frontend:2.15.2dc6384d10cc8
expat@2.7.0-r0
2.8.4-r0

Open the chart page →

3,355
nginx-charthyomin-nginx0.1.01 of 1See more

nginx-chart hyomin-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
nginx-charthyun-nginx0.1.01 of 1See more

nginx-chart hyun-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

57,728
nextjsicoretechVerified publisher1.2.01 of 1See more

nextjs icoretech 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
web-chartimcherry57780.1.01 of 1See more

web-chart imcherry5778 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
onechartimioVerified publisher0.76.01 of 1See more

onechart imio 0.76.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
plausible-analyticsimioVerified publisher0.4.21 of 5See more

plausible-analytics imio 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/plausible/community-edition:v3.0.114c1afde21d6
expat@2.7.0-r0
2.8.4-r0

Open the chart page →

10,152
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
infisical/infisical:latest02082bf13163
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

2,954
op-stackinfradao0.0.11 of 1See more

op-stack infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
label-studioinseefrlab2.3.11 of 3See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
heartexlabs/label-studio:latestaa461572e8f9
expat@2.7.4-r0
2.8.4-r0

Open the chart page →

3,157

Container images carrying it

611 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/invidious/invidious:latest6f5c81c1e29d
expat@2.8.2-r0
2.8.4-r0
1
quay.io/kannika/kannika-api:0.18.0bcf9906d5a3c
expat@2.8.3-1~deb13u1
no fix listed
1
quay.io/poundex/tekton-ci-environment-injector:0.2.46dd65f22949c
expat@2.8.1-r0
2.8.4-r0
1
quay.io/shesselink81/anna-nginx:v1.31.1120c19fa8a918
expat@2.8.2-r0
2.8.4-r0
1
quay.io/shesselink81/hesselinkme-nginx:v1.31.114f43beb13fc2
expat@2.8.2-r0
2.8.4-r0
1
quay.io/underndog/samba:1.2.0-not-recyclecca801de9fa5
expat@2.7.0-r0
2.8.4-r0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
expat@2.7.1-2
no fix listed
1
registry.gitlab.com/gitlab-ci-utils/curl-jq:latestb564745b6cb0
expat@2.8.2-r0
2.8.4-r0
1
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
expat@2.7.5-r0
2.8.4-r0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
expat@2.8.2-r0
2.8.4-r0
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
expat@2.7.1-2
no fix listed
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.