StackRadar

CVE-2026-86140

High

Advisory

Published 5 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.0
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,056
of 17,790 indexed, latest versions
Container images
858
deployed by those charts
Fix available
1 of 1
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 1,056 of 17,790 indexed charts deploy, on 858 images.

Affected packageAffected versionsFixed inImages
libxml2deb2.9.1+dfsg1-3ubuntu4.3, 2.9.1+dfsg1-3ubuntu4.4, 2.9.1+dfsg1-3ubuntu4.12, 2.9.3+dfsg1-1ubuntu0.2+56 more2.12.7+dfsg+really2.9.14-2.1+deb13u3+e1858
OSV records
DEBIAN-CVE-2026-86140UBUNTU-CVE-2026-86140ECHO-a8a9-016d-71e9
Trending
Rank 29 in indexed charts, since 5 Sept 2026. See the ranking →

Charts affected

1,056 by stars
ChartLatestAffected imagesRadar Score
firecrawlobeoneVerified publisher3.0.42 of 5See more

firecrawl obeone 3.0.4

2 of the 5 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
ghcr.io/firecrawl/nuq-postgres:latestf9388bd25ae2
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u2
no fix listed
ghcr.io/firecrawl/playwright-service:latest1f6eba640320
libxml2@2.9.14+dfsg-1.3~deb12u5
no fix listed

Open the chart page →

10,060
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
library/postgres:134689940c6838
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u1
no fix listed

Open the chart page →

17,134
web-chartoje-ktcloudlab0.1.01 of 1See more

web-chart oje-ktcloudlab 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed

Open the chart page →

1,849
cmsmsoleds-helm-chartsVerified publisher0.1.61 of 1See more

cmsms oleds-helm-charts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
bitnamilegacy/mariadb:11.4.7-debian-12-r290dc6acb7b2e
libxml2@2.9.14+dfsg-1.3~deb12u1
no fix listed

Open the chart page →

2,861
pulsarolehrgfVerified publisher0.0.51 of 2See more

pulsar olehrgf 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.1.016f9fdab3fa6
libxml2@2.9.13+dfsg-1ubuntu0.3
no fix listed

Open the chart page →

9,062
laravel-appoli-the-devVerified publisher2.0.171 of 1See more

laravel-app oli-the-dev 2.0.17

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
serversideup/php:8.5-fpm-nginx8f8c2f010ac5
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed

Open the chart page →

2,728
paperless-ngxoli-the-devVerified publisher1.1.11 of 1See more

paperless-ngx oli-the-dev 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed

Open the chart page →

4,651
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
libxml2@2.9.14+dfsg-1.3ubuntu3.3
no fix listed

Open the chart page →

6,096
ontoserverontoserverVerified publisher0.5.21 of 2See more

ontoserver ontoserver 0.5.2

1 of the 2 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
library/postgres:16f1c3376c26f2
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed

Open the chart page →

1,649
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest473fdffe4e67
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed

Open the chart page →

6,392
commonground-gatewayopencatalogi1.5.31 of 7See more

commonground-gateway opencatalogi 1.5.3

1 of the 7 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/gateway-ui:stag6a5594b7b32c
libxml2@2.9.14+dfsg-1.2
no fix listed

Open the chart page →

9,747
opentickopenchartVerified publisher0.1.01 of 1See more

opentick openchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
library/nginx:1.25.5a484819eb602
libxml2@2.9.14+dfsg-1.3~deb12u1
no fix listed

Open the chart page →

5,699
cdn-remoteopencord0.2.42 of 3See more

cdn-remote opencord 0.2.4

2 of the 3 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
omecproject/cdn-antmedia:1.0.0b4ae7d0d6b74
libxml2@2.9.4+dfsg1-6.1ubuntu1.2
no fix listed
omecproject/cdn-video-repo:1.0.0d59ccb138ffb
libxml2@2.9.3+dfsg1-1ubuntu0.6
no fix listed

Open the chart page →

63,280
comacopencord1.0.03 of 9See more

comac opencord 1.0.0

3 of the 9 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
libxml2@2.9.3+dfsg1-1ubuntu0.6
no fix listed
omecproject/onos-progran:1.0.05715e5648aa0
libxml2@2.9.3+dfsg1-1ubuntu0.5
no fix listed
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
libxml2@2.9.3+dfsg1-1ubuntu0.6
no fix listed

Open the chart page →

88,653
comac-cuopencord0.1.11 of 4See more

comac-cu opencord 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
ngick8stesting/c3po-mmeinit:latest1e764eab77b4
libxml2@2.9.4+dfsg1-6.1ubuntu1
no fix listed

Open the chart page →

8,056
comac-platformopencord0.0.171 of 11See more

comac-platform opencord 0.0.17

1 of the 11 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
libxml2@2.9.3+dfsg1-1ubuntu0.6
no fix listed

Open the chart page →

26,246
mcord-cdn-remoteopencord0.1.61 of 2See more

mcord-cdn-remote opencord 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:remote-v3d59ccb138ffb
libxml2@2.9.3+dfsg1-1ubuntu0.6
no fix listed

Open the chart page →

42,655
mcord-cdn-remote-freeopencord0.1.31 of 1See more

mcord-cdn-remote-free opencord 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:remote-v3d59ccb138ffb
libxml2@2.9.3+dfsg1-1ubuntu0.6
no fix listed

Open the chart page →

29,156
mcord-control-planeopencord0.2.22 of 5See more

mcord-control-plane opencord 0.2.2

2 of the 5 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
ngick8stesting/c3po-mme:mwca-mme-debug8dd6dea45be4
libxml2@2.9.3+dfsg1-1ubuntu0.6
no fix listed
ngick8stesting/c3po-mmeinit:latest1e764eab77b4
libxml2@2.9.4+dfsg1-6.1ubuntu1
no fix listed

Open the chart page →

15,666
oaisimopencord0.1.72 of 3See more

oaisim opencord 0.1.7

2 of the 3 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
omecproject/lte-softmodem:1.1.0b5ddd36ec20c
libxml2@2.9.4+dfsg1-6.1ubuntu1.3
no fix listed
omecproject/lte-uesoftmodem:1.1.0686f8bc37d8c
libxml2@2.9.4+dfsg1-6.1ubuntu1.3
no fix listed

Open the chart page →

14,556
omec-control-planeopencord0.1.313 of 8See more

omec-control-plane opencord 0.1.31

3 of the 8 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
omecproject/c3po-hssdb:master-latest28a90cc26716
libxml2@2.9.10+dfsg-5ubuntu0.20.04.1
no fix listed
omecproject/mme-exporter:paging-latestbcc5f19fd676
libxml2@2.9.4+dfsg1-6.1ubuntu1.3
no fix listed
omecproject/openmme:master-latest64776cb9edb3
libxml2@2.9.3+dfsg1-1ubuntu0.7
no fix listed

Open the chart page →

40,825
onos-progranopencord1.2.71 of 2See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
muluder/prograncontrollermcord:0.1.843b597a93da7
libxml2@2.9.3+dfsg1-1ubuntu0.5
no fix listed

Open the chart page →

38,902
opencost-parquet-exporteropencostVerified publisher0.3.11 of 1See more

opencost-parquet-exporter opencost 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
ghcr.io/opencost/opencost-parquet-exporter:v0.2.1ce85ef0ce665
libxml2@2.9.14+dfsg-1.3~deb12u1
no fix listed

Open the chart page →

11,051
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed

Open the chart page →

7,866
sohaopensohaVerified publisher0.1.91 of 2See more

soha opensoha 0.1.9

1 of the 2 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
pgvector/pgvector:0.8.5-pg18-trixie9d2e61c7352b
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u2
no fix listed

Open the chart page →

1,781
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
openwhisk/ow-utils:1.0.0c80dba0de3aa
libxml2@2.9.4+dfsg1-6.1ubuntu1.3
no fix listed

Open the chart page →

36,252
issuegenopsmxVerified publisher1.0.21 of 1See more

issuegen opsmx 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
opsmx11/issuegen:v2.1.05c50ca123d88
libxml2@2.9.1+dfsg1-3ubuntu4.12
no fix listed

Open the chart page →

26,364
hiveopstty0.1.91 of 4See more

hive opstty 0.1.9

1 of the 4 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:16233f361c5819
libxml2@2.9.14+dfsg-1.3~deb12u1
no fix listed

Open the chart page →

4,550
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.07 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

7 of the 40 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
yetiplatform/yeti-frontend:2.9.0873ef15d267b
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
libxml2@2.9.14+dfsg-1.3ubuntu3.8
no fix listed
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
libxml2@2.9.14+dfsg-1.3ubuntu3.8
no fix listed
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
libxml2@2.9.14+dfsg-1.3ubuntu3.8
no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
libxml2@2.9.14+dfsg-1.3ubuntu3.8
no fix listed
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
libxml2@2.9.14+dfsg-1.3ubuntu3.8
no fix listed
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
libxml2@2.9.14+dfsg-1.3ubuntu3.8
no fix listed

Open the chart page →

72,547
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
yetiplatform/yeti-frontend:latest709064278c7e
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed

Open the chart page →

6,679
webot-container-kit0.1.01 of 1See more

web ot-container-kit 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed

Open the chart page →

1,849
workerot-container-kit0.1.01 of 1See more

worker ot-container-kit 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed

Open the chart page →

1,849
lens-metric-proxyowan-charts0.1.01 of 1See more

lens-metric-proxy owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed

Open the chart page →

1,849
radiusp2p-avs0.1.01 of 1See more

radius p2p-avs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
theradius/loggia:0.463ba348546ec
libxml2@2.9.14+dfsg-1.3~deb12u1
no fix listed

Open the chart page →

12,440
ungatep2p-avs0.1.02 of 3See more

ungate p2p-avs 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
libxml2@2.9.14+dfsg-1.3~deb12u1
no fix listed
xom4ekp2p/infini-route-attestators-public-mainnet-avs-webapi:latest2745b5fd8785
libxml2@2.9.14+dfsg-1.3~deb12u1
no fix listed

Open the chart page →

27,597
minecraftpaul1365972-mc3.0.11 of 1See more

minecraft paul1365972-mc 3.0.1

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
itzg/minecraft-server:latest8672e335dbef
libxml2@2.9.14+dfsg-1.3ubuntu3.8
no fix listed

Open the chart page →

4,303
examplepauls-helm-charts0.1.21 of 1See more

example pauls-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed

Open the chart page →

1,849
kubeconpauls-helm-charts0.1.01 of 1See more

kubecon pauls-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed

Open the chart page →

1,849
matomopetbattle11.0.12 of 2See more

matomo petbattle 11.0.1

2 of the 2 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
bitnamilegacy/mariadb:12.0.2-debian-12-r0888cdaae3cb9
libxml2@2.9.14+dfsg-1.3~deb12u2
no fix listed
bitnamilegacy/matomo:5.3.2-debian-12-r13f02c000c54b1
libxml2@2.9.14+dfsg-1.3~deb12u2
no fix listed

Open the chart page →

11,101
mariadbpetersandor15.2.51 of 1See more

mariadb petersandor 15.2.5

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
bitnami/mariadb:11.7.216a7dae804fb
libxml2@2.9.14+dfsg-1.3~deb12u1
no fix listed

Open the chart page →

2,905
dummy-servicephanVerified publisher0.3.41 of 1See more

dummy-service phan 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
phan2410/dummy-service:0.0.89c6ed6de26ca
libxml2@2.9.14+dfsg-1.3~deb12u1
no fix listed

Open the chart page →

5,778
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
knspar/phronetis-operator:0.1.60c4f0543ee58
libxml2@2.9.14+dfsg-1.3~deb12u1
no fix listed

Open the chart page →

16,321
seafilephybros-helm-charts4.0.11 of 1See more

seafile phybros-helm-charts 4.0.1

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.97ac833196f60
libxml2@2.9.10+dfsg-5
no fix listed

Open the chart page →

22,156
firehose-ethereumpinaxVerified publisher0.3.21 of 2See more

firehose-ethereum pinax 0.3.2

1 of the 2 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/firehose-ethereum:v2.12.4-gethd7bdfa7b41da
libxml2@2.9.14+dfsg-1.3ubuntu3.3
no fix listed

Open the chart page →

7,165
subgraph-oraclepinaxVerified publisher0.0.11 of 1See more

subgraph-oracle pinax 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
ghcr.io/graphprotocol/availability-oracle:sha-28312fd472a25038957
libxml2@2.9.14+dfsg-1.3~deb12u1
no fix listed

Open the chart page →

11,420
substreams-sink-kvpinaxVerified publisher0.0.41 of 1See more

substreams-sink-kv pinax 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/substreams-sink-kv:v2.3.026953ec68d5d
libxml2@2.9.10+dfsg-5ubuntu0.20.04.7
no fix listed

Open the chart page →

6,720
substreams-sink-nooppinaxVerified publisher0.0.31 of 1See more

substreams-sink-noop pinax 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/substreams-sink-noop:v1.4.0d7c43c3135c6
libxml2@2.9.10+dfsg-5ubuntu0.20.04.7
no fix listed

Open the chart page →

6,665
substreams-tier-2pinaxVerified publisher0.0.81 of 1See more

substreams-tier-2 pinax 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/firehose-ethereum:v2.12.489969b78fb07
libxml2@2.9.14+dfsg-1.3ubuntu3.3
no fix listed

Open the chart page →

4,950
pingdom-operatorpingdom-operator0.0.201 of 1See more

pingdom-operator pingdom-operator 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
libxml2@2.9.14+dfsg-1.3~deb12u1
no fix listed

Open the chart page →

11,996
web-chartpjw-ktcloudlab0.1.01 of 1See more

web-chart pjw-ktcloudlab 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86140.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3
no fix listed

Open the chart page →

1,849

Container images carrying it

858 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
libxml2@2.9.14+dfsg-1.3~deb12u6
no fix listed
1
quay.io/opsmxpublic/spin-sample-pipeline:v1.0.1c6a934439421
libxml2@2.9.3+dfsg1-1ubuntu0.6
no fix listed
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
libxml2@2.9.14+dfsg-1.3~deb12u1
no fix listed
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
libxml2@2.9.14+dfsg-1.3ubuntu3.8
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u2
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
libxml2@2.9.14+dfsg-1.3~deb12u5
no fix listed
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
libxml2@2.9.10+dfsg-5
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
libxml2@2.9.14+dfsg-1.3~deb12u5
no fix listed
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.