diff --git a/.trivyignore b/.trivyignore
index 80537e9..6df4830 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -30,3 +30,16 @@ GHSA-r7wm-3cxj-wff9 exp:2026-09-27
 # See: UID2-7662
 CVE-2026-40984 exp:2026-11-11
 
+# CVE-2026-66046 — libexpat (Alpine base-image OS library) (HIGH).
+# Not exploitable here: Dockerfile FROM eclipse-temurin:21-jre-alpine-3.23; pure-Java service.
+# No JNI/native/expat references in src; libexpat present only as a transitive OS package of
+# the base image, not invoked by Java XML parsing.
+# See: UID2-7800
+CVE-2026-66046 exp:2026-12-02
+
+# CVE-2026-76641 — libexpat (Alpine base-image native C library) (HIGH).
+# Not exploitable here: Dockerfile FROM eclipse-temurin 21-jre-alpine-3.23; runs `java -jar
+# uid2-core...jar`; pom.xml XML is Maven build metadata (Jackson deps), not runtime libexpat
+# usage; no loadLibrary/JNI in source
+# See: UID2-7801
+CVE-2026-76641 exp:2026-12-02