CVE-2026-86142

Medium

Advisory

Published 5 Sept 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.9; base score, highest
EPSS: 0.001; 3rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,056; of 17,790 indexed, latest versions
Container images: 858; deployed by those charts
Fix available: 1 of 1; affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 1,056 of 17,790 indexed charts deploy, on 858 images.

Affected package	Affected versions	Fixed in	Images
libxml2deb	2.9.1+dfsg1-3ubuntu4.3, 2.9.1+dfsg1-3ubuntu4.4, 2.9.1+dfsg1-3ubuntu4.12, 2.9.3+dfsg1-1ubuntu0.2+56 more	2.12.7+dfsg+really2.9.14-2.1+deb13u3+e1	858

OSV records: DEBIAN-CVE-2026-86142 UBUNTU-CVE-2026-86142 ECHO-b0a3-292d-bbe7
Trending: Rank 34 in indexed charts, since 5 Sept 2026. See the ranking →

Charts affected

1,056 by stars

Chart

Latest

Affected images

Radar Score

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-86142.

Container image	Digest	Package	Fixed in
ghcr.io/bat-bs/bitnami-pgvector :pg16	19ebe07b4daf	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed

Open the chart page →

11,603

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-86142.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed

Open the chart page →

7,697

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86142.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3	no fix listed

Open the chart page →

1,849

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86142.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3	no fix listed

Open the chart page →

1,849

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-86142.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u3	no fix listed

Open the chart page →

1,849

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-86142.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	libxml2@2.9.13+dfsg-1ubuntu0.12	no fix listed

Open the chart page →

7,929

Container images carrying it

858 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/jupyterhub/k8s-singleuser-sample :4.4.2	65e1b09fc8c9	libxml2@2.9.14+dfsg-1.3~deb12u6	no fix listed	1
quay.io/opsmxpublic/spin-sample-pipeline :v1.0.1	c6a934439421	libxml2@2.9.3+dfsg1-1ubuntu0.6	no fix listed	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	libxml2@2.9.14+dfsg-1.3~deb12u1	no fix listed	1
registry.gitlab.com/crafty-controller/crafty-4 :latest	166a06f73d8c	libxml2@2.9.14+dfsg-1.3ubuntu3.8	no fix listed	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend :1.0.31	66353ce9bf98	libxml2@2.12.7+dfsg+really2.9.14-2.1+deb13u2	no fix listed	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	libxml2@2.9.14+dfsg-1.3~deb12u5	no fix listed	1
registry.gitlab.com/infinitydon/registry/open5gs-aio :v2.2.2	f6385712935f	libxml2@2.9.10+dfsg-5	no fix listed	1
registry.gitlab.com/school_guy/docker-typo3 :13.4.30-197d868e	d76185d7270d	libxml2@2.9.14+dfsg-1.3~deb12u5	no fix listed	1