StackRadar

CVE-2026-76956

High

Advisory

Published 20 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
774
of 17,787 indexed, latest versions
Container images
611
deployed by those charts
Fix available
3 of 3
affected packages

CVE-2026-76956 affecting package expat for versions less than 2.8.3-2

Carried by container images the latest versions of 774 of 17,787 indexed charts deploy, on 611 images.

Affected packageAffected versionsFixed inImages
expatapk2.6.4-r0, 2.7.0-r0, 2.7.1-r0, 2.7.2-r0+7 more2.8.4-r0412
expatdeb2.7.1-2, 2.7.1-2+dhi4, 2.7.5-1, 2.8.2-1+e1+2 more2.8.4-1197
expatrpm2.8.2-1.azl32.8.3-22
OSV records
ALPINE-CVE-2026-76956DEBIAN-CVE-2026-76956AZL-96848ECHO-8a36-8d53-bf0c

Charts affected

774 by stars
ChartLatestAffected imagesRadar Score
my-multi-chart-appmulti-chart-app0.1.01 of 2See more

my-multi-chart-app multi-chart-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

3,823
szurubooru-clientmy0nVerified publisher0.3.11 of 1See more

szurubooru-client my0n 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
szurubooru/client:2.5880a53ca446d
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

371
szurubooru-servermy0nVerified publisher0.2.51 of 3See more

szurubooru-server my0n 0.2.5

1 of the 3 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
szurubooru/server:2.5accf2ad9fbc3
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

1,044
nginx-chartmyk8scharts1.0.01 of 1See more

nginx-chart myk8scharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
nginx-appmy-nginx-app0.1.31 of 1See more

nginx-app my-nginx-app 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
nginx-chartmy-nginx-chart0.1.01 of 1See more

nginx-chart my-nginx-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
amaraiheanacho/nginx-site:latest5c86fccf5daa
expat@2.7.0-r0
2.8.4-r0

Open the chart page →

840
helloworldmysql2s3bk0.1.01 of 1See more

helloworld mysql2s3bk 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

1,039
my-nginxna-helm-chartsVerified publisher1.0.01 of 1See more

my-nginx na-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
dependency-tracknaj980.0.91 of 3See more

dependency-track naj98 0.0.9

1 of the 3 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
dependencytrack/frontend:latest8854a8320475
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

2,445
core-keeper-dedicatednerkho-helm-charts0.1.11 of 1See more

core-keeper-dedicated nerkho-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
escaping/core-keeper-dedicated:latest87fa79255962
expat@2.7.1-2
no fix listed

Open the chart page →

3,804
neuralbank-stackneuralbank-stack0.1.01 of 4See more

neuralbank-stack neuralbank-stack 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
nginxinc/nginx-unprivileged:latest4210a3296e7c
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

5,198
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
expat@2.7.5-r0
2.8.4-r0

Open the chart page →

3,799
nginx-appnginx-app0.1.21 of 1See more

nginx-app nginx-app 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
nginx-sitenginx-site0.1.01 of 1See more

nginx-site nginx-site 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
amaraiheanacho/nginx-site:latest5c86fccf5daa
expat@2.7.0-r0
2.8.4-r0

Open the chart page →

840
nginx-examplengrok-ingress-helm0.3.01 of 2See more

nginx-example ngrok-ingress-helm 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

2,960
basenn-coVerified publisher0.1.01 of 1See more

base nn-co 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
app1node-web-app10.1.31 of 1See more

app1 node-web-app1 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
app2node-web-app10.1.31 of 1See more

app2 node-web-app1 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
nginx-chartnomadshk-nginx0.1.01 of 1See more

nginx-chart nomadshk-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
nai-corenutanix-helm-releasesVerified publisher2.8.01 of 14See more

nai-core nutanix-helm-releases 2.8.0

1 of the 14 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
nutanix/nai-jobs:v2.8.09c373718e1b1
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

806
nai-operatorsnutanix-helm-releasesVerified publisher2.8.01 of 5See more

nai-operators nutanix-helm-releases 2.8.0

1 of the 5 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
nutanix/nai-jobs:v2.8.09c373718e1b1
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

806
firecrawlobeoneVerified publisher3.0.31 of 5See more

firecrawl obeone 3.0.3

1 of the 5 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/rabbitmq:3.13-management-alpine606d8c0d6b3c
expat@2.7.3-r0
2.8.4-r0

Open the chart page →

9,895
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
alpine/k8s:1.31.106dbe6f391eda
expat@2.7.1-r0
2.8.4-r0

Open the chart page →

17,085
ocisocis-community0.1.01 of 1See more

ocis ocis-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
owncloud/ocis:8.0.1b38fd8fdd58f
expat@2.7.4-r0
2.8.4-r0

Open the chart page →

2,346
octant-uioctant-ui0.0.1-testing1 of 1See more

octant-ui octant-ui 0.0.1-testing

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/mydecisive/octant-ui:0.0.1-testing61e4066b22fb
expat@2.7.5-r0
2.8.4-r0

Open the chart page →

1,110
web-chartoje-ktcloudlab0.1.01 of 1See more

web-chart oje-ktcloudlab 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
laravel-appoli-the-devVerified publisher2.0.171 of 1See more

laravel-app oli-the-dev 2.0.17

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
serversideup/php:8.5-fpm-nginx8f8c2f010ac5
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

2,692
paperless-ngxoli-the-devVerified publisher1.1.11 of 1See more

paperless-ngx oli-the-dev 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

4,644
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest473fdffe4e67
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

6,252
opencost-lensopencost-lens1.0.01 of 2See more

opencost-lens opencost-lens 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/opencost/opencost-ui:1.118.0571f87e528ea
expat@2.7.3-r0
2.8.4-r0

Open the chart page →

1,110
pro-builderopenfaas0.6.131 of 2See more

pro-builder openfaas 0.6.13

1 of the 2 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
moby/buildkit:v0.32.2-rootless504731e577c2
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

2,728
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

7,848
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
expat@2.8.2-r0
2.8.4-r0

Open the chart page →

1,039
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.03 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

3 of the 40 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
yetiplatform/yeti:2.9.09bcbe2650a14
expat@2.8.3-1~deb13u1
no fix listed
yetiplatform/yeti-frontend:2.9.0873ef15d267b
expat@2.8.3-1~deb13u1
no fix listed
ghcr.io/openrelik/openrelik-ui:latest7f91594d5eb3
expat@2.7.5-r0
2.8.4-r0

Open the chart page →

72,154
timesketchosdfir-infrastructureVerified publisher1.0.81 of 6See more

timesketch osdfir-infrastructure 1.0.8

1 of the 6 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
alpine/git:latest6f3b5029566d
expat@2.8.3-r0
2.8.4-r0

Open the chart page →

1,754
yetiosdfir-infrastructureVerified publisher1.0.52 of 4See more

yeti osdfir-infrastructure 1.0.5

2 of the 4 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
yetiplatform/yeti:latest9c3006cedcca
expat@2.8.3-1~deb13u1
no fix listed
yetiplatform/yeti-frontend:latest709064278c7e
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

6,544
loki-standaloneot-container-kit1.0.21 of 5See more

loki-standalone ot-container-kit 1.0.2

1 of the 5 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
nginxinc/nginx-unprivileged:1.29-alpine0c79d56aee56
expat@2.7.5-r0
2.8.4-r0

Open the chart page →

3,593
webot-container-kit0.1.01 of 1See more

web ot-container-kit 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
workerot-container-kit0.1.01 of 1See more

worker ot-container-kit 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
lens-metric-proxyowan-charts0.1.01 of 1See more

lens-metric-proxy owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
parcial-1parcial-1-chart1.0.01 of 5See more

parcial-1 parcial-1-chart 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
esteban1930/frontend-1:1.8.0f9078279632c
expat@2.7.1-r0
2.8.4-r0

Open the chart page →

3,852
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
expat@2.7.3-r0
2.8.4-r0

Open the chart page →

4,788
examplepauls-helm-charts0.1.21 of 1See more

example pauls-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
kubeconpauls-helm-charts0.1.01 of 1See more

kubecon pauls-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
stk-fluent-bit-loki-s3paxtecnologia0.2.01 of 6See more

stk-fluent-bit-loki-s3 paxtecnologia 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
nginxinc/nginx-unprivileged:1.29-alpine0c79d56aee56
expat@2.7.5-r0
2.8.4-r0

Open the chart page →

3,742
web-chartpjw-ktcloudlab0.1.01 of 1See more

web-chart pjw-ktcloudlab 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
k8s-oidc-discovery-providerpnnl-miscscripts0.1.21 of 2See more

k8s-oidc-discovery-provider pnnl-miscscripts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:1.29.49dd288848f44
expat@2.7.1-2
no fix listed

Open the chart page →

4,273
nginx-apppnnl-miscscripts0.1.21 of 1See more

nginx-app pnnl-miscscripts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839
pixiecore-simpleconfigpnnl-miscscripts0.1.51 of 1See more

pixiecore-simpleconfig pnnl-miscscripts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-76956.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
expat@2.8.3-1~deb13u1
no fix listed

Open the chart page →

1,839

Container images carrying it

611 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/invidious/invidious:latest6f5c81c1e29d
expat@2.8.2-r0
2.8.4-r0
1
quay.io/kannika/kannika-api:0.18.0bcf9906d5a3c
expat@2.8.3-1~deb13u1
no fix listed
1
quay.io/poundex/tekton-ci-environment-injector:0.2.46dd65f22949c
expat@2.8.1-r0
2.8.4-r0
1
quay.io/shesselink81/anna-nginx:v1.31.1120c19fa8a918
expat@2.8.2-r0
2.8.4-r0
1
quay.io/shesselink81/hesselinkme-nginx:v1.31.114f43beb13fc2
expat@2.8.2-r0
2.8.4-r0
1
quay.io/underndog/samba:1.2.0-not-recyclecca801de9fa5
expat@2.7.0-r0
2.8.4-r0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
expat@2.7.1-2
no fix listed
1
registry.gitlab.com/gitlab-ci-utils/curl-jq:latestb564745b6cb0
expat@2.8.2-r0
2.8.4-r0
1
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
expat@2.7.5-r0
2.8.4-r0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
expat@2.8.2-r0
2.8.4-r0
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
expat@2.7.1-2
no fix listed
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.