diff --git a/.trivyignore b/.trivyignore
index ade7d26..10823f2 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -29,3 +29,14 @@ GHSA-r7wm-3cxj-wff9 exp:2026-09-27
 # See: UID2-7662
 CVE-2026-40984 exp:2026-11-11
 
+# CVE-2026-66046 — libexpat (Alpine base-image OS library) (HIGH).
+# Not exploitable here: Dockerfile FROM eclipse-temurin:21-jre-alpine-3.23; pure-Java. No
+# JNI/native/expat references in src; XML handled by JVM JAXP.
+# See: UID2-7800
+CVE-2026-66046 exp:2026-12-02
+
+# CVE-2026-76641 — libexpat (Alpine base-image native C library) (HIGH).
+# Not exploitable here: Dockerfile FROM eclipse-temurin 21-jre-alpine-3.23; pure-Java jar; apk
+# adds libpng/libcrypto3/libssl3/musl/gnutls; no libexpat reference or JNI XML path
+# See: UID2-7801
+CVE-2026-76641 exp:2026-12-02