StackRadar

CVE-2026-10118

High

Advisory

Published 1 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.003
17th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
33
of 17,781 indexed, latest versions
Container images
30
deployed by those charts
Fix available
2 of 2
affected packages

Red Hat Security Advisory: poppler security update

Carried by container images the latest versions of 33 of 17,781 indexed charts deploy, on 30 images.

Affected packageAffected versionsFixed inImages
popplerdeb0.86.1-0ubuntu1, 22.02.0-2, 22.02.0-2ubuntu0.1, 22.02.0-2ubuntu0.3+11 more22.02.0-2ubuntu0.13, 22.12.0-2+deb12u2, 24.02.0-1ubuntu9.9, 25.03.0-5+deb13u3+2 more29
popplerrpm21.01.0-19.el90:21.01.0-24.el9_8.11
OSV records
DEBIAN-CVE-2026-10118RHSA-2026:25058UBUNTU-CVE-2026-10118
Also known as
RHSA-2026:27722, USN-8400-1

Charts affected

33 by stars
ChartLatestAffected imagesRadar Score
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
poppler@22.02.0-2ubuntu0.10
22.02.0-2ubuntu0.13

Open the chart page →

27,267
mattermostphntom3.24.01 of 2See more

mattermost phntom 3.24.0

1 of the 2 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
phntom/mattermost-team-edition:9.3.051cf9da4aa2e
poppler@22.02.0-2ubuntu0.3
22.02.0-2ubuntu0.13

Open the chart page →

8,722
codetogethercodetogether1.4.251 of 1See more

codetogether codetogether 1.4.25

1 of the 1 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
codetogether/codetogether:latest4348c8a38752
poppler@21.01.0-19.el9
0:21.01.0-24.el9_8.1

Open the chart page →

7,450
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
poppler@25.03.0-5+deb13u2
25.03.0-5+deb13u3

Open the chart page →

12,037
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
poppler@22.12.0-2+b1
22.12.0-2+deb12u2

Open the chart page →

13,761
games-on-whalesgeek-cookbookVerified publisher1.8.21 of 7See more

games-on-whales geek-cookbook 1.8.2

1 of the 7 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
poppler@0.86.1-0ubuntu1
no fix listed

Open the chart page →

35,305
photoprismmmontesVerified publisher0.14.01 of 1See more

photoprism mmontes 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
photoprism/photoprism:251130db16ee6b1ba3
poppler@25.03.0-10ubuntu0.1
25.03.0-10ubuntu0.2

Open the chart page →

11,103
games-on-whalesangelnu2.0.01 of 7See more

games-on-whales angelnu 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
poppler@0.86.1-0ubuntu1
no fix listed

Open the chart page →

42,126
platform-apiappscodeVerified publisher2026.9.111 of 3See more

platform-api appscode 2026.9.11

1 of the 3 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
poppler@25.03.0-5+deb13u2
25.03.0-5+deb13u3

Open the chart page →

37,268
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg15-latesta8e3322e1cf9
poppler@22.02.0-2ubuntu0.1
22.02.0-2ubuntu0.13

Open the chart page →

32,501
kube-acp-stackcloudentity2.28.01 of 7See more

kube-acp-stack cloudentity 2.28.0

1 of the 7 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
poppler@22.02.0-2ubuntu0.6
22.02.0-2ubuntu0.13

Open the chart page →

20,900
photoprismdjjudas21Verified publisher99.99.991 of 1See more

photoprism djjudas21 99.99.99

1 of the 1 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
photoprism/photoprism:240711-cefc6fd632ca74
poppler@24.02.0-1ubuntu9
24.02.0-1ubuntu9.9

Open the chart page →

16,954
codecovdoubanVerified publisher0.2.41 of 8See more

codecov douban 0.2.4

1 of the 8 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg14.6-ts2.9.1-p1cdb9ae118899
poppler@22.02.0-2ubuntu0.1
22.02.0-2ubuntu0.13

Open the chart page →

24,917
drogue-cloud-examplesdrogue-iotVerified publisher0.7.111 of 6See more

drogue-cloud-examples drogue-iot 0.7.11

1 of the 6 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg14-ts2.6-latested719c0cd19d
poppler@22.02.0-2
22.02.0-2ubuntu0.13

Open the chart page →

30,699
scanservjsgabe565Verified publisher0.9.21 of 1See more

scanservjs gabe565 0.9.2

1 of the 1 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
poppler@22.12.0-2+b1
22.12.0-2+deb12u2

Open the chart page →

13,241
openkmgeek-cookbookVerified publisher4.2.01 of 1See more

openkm geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
openkm/openkm-ce:6.3.113bc465a7461b
poppler@0.86.1-0ubuntu1
no fix listed

Open the chart page →

27,949
nominatimheywood8-helm-chartsVerified publisher3.10.81 of 3See more

nominatim heywood8-helm-charts 3.10.8

1 of the 3 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
mediagis/nominatim:4.2d0eae7b51374
poppler@22.02.0-2ubuntu0.3
22.02.0-2ubuntu0.13

Open the chart page →

14,290
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
poppler@22.12.0-2+b1
22.12.0-2+deb12u2

Open the chart page →

16,384
opencloudjacobcolvinVerified publisher0.2.31 of 13See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
poppler@24.02.0-1ubuntu9
24.02.0-1ubuntu9.9

Open the chart page →

45,239
paperlessk8s-home-lab-repo11.0.11 of 1See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
poppler@25.03.0-5+deb13u2
25.03.0-5+deb13u3

Open the chart page →

9,103
kbot-self-hostedkbot-self-hostedVerified publisher0.1.81 of 7See more

kbot-self-hosted kbot-self-hosted 0.1.8

1 of the 7 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.30206a6c708fc6
poppler@25.03.0-5+deb13u2
25.03.0-5+deb13u3

Open the chart page →

32,509
penpotkubitodevVerified publisher1.2.11 of 5See more

penpot kubitodev 1.2.1

1 of the 5 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
penpotapp/exporter:2.2.15c835ffd87ab
poppler@22.02.0-2ubuntu0.5
22.02.0-2ubuntu0.13

Open the chart page →

16,877
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
poppler@25.03.0-5+deb13u2
25.03.0-5+deb13u3

Open the chart page →

11,950
nominatimnominatim-chart1.3.01 of 3See more

nominatim nominatim-chart 1.3.0

1 of the 3 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
mediagis/nominatim:3.7c15e941485ef
poppler@0.86.1-0ubuntu1
no fix listed

Open the chart page →

22,658
cupsr2dlan-helm-chartsVerified publisher0.1.01 of 1See more

cups r2dlan-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
anujdatar/cups:25.07.01685df04a643b
poppler@22.12.0-2+deb12u1
22.12.0-2+deb12u2

Open the chart page →

7,685
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
poppler@25.03.0-5+deb13u2
25.03.0-5+deb13u3

Open the chart page →

10,605
stirling-pdfrubxkubeVerified publisher0.1.21 of 1See more

stirling-pdf rubxkube 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
poppler@24.02.0-1ubuntu9.8
24.02.0-1ubuntu9.9

Open the chart page →

6,207
photoprismschoolguys-helmcharts0.3.81 of 1See more

photoprism schoolguys-helmcharts 0.3.8

1 of the 1 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
photoprism/photoprism:260601650c6ad5a651
poppler@26.01.0-2build2
26.01.0-2ubuntu0.1

Open the chart page →

10,348
kurento_webrtc_demostunner0.1.01 of 2See more

kurento_webrtc_demo stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
kurento/kurento-media-server:latest03c0d34d0828
poppler@24.02.0-1ubuntu9.8
24.02.0-1ubuntu9.9

Open the chart page →

12,460
stunner-kurento-one2one-callstunner0.1.01 of 2See more

stunner-kurento-one2one-call stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
kurento/kurento-media-server:latest03c0d34d0828
poppler@24.02.0-1ubuntu9.8
24.02.0-1ubuntu9.9

Open the chart page →

12,460
stash-boxswuuper-githubVerified publisher0.1.11 of 2See more

stash-box swuuper-github 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
stashapp/stash-box:latesta534c8afdf39
poppler@24.02.0-1ubuntu9.4
24.02.0-1ubuntu9.9

Open the chart page →

8,193
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
poppler@24.02.0-1ubuntu9
24.02.0-1ubuntu9.9

Open the chart page →

45,239
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-10118.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
poppler@22.12.0-2+b1
22.12.0-2+deb12u2

Open the chart page →

10,795

Container images carrying it

30 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
apache/tika:2.9.2.1-fullae0b86d3c4d0
poppler@24.02.0-1ubuntu9
24.02.0-1ubuntu9.9
2
kurento/kurento-media-server:latest03c0d34d0828
poppler@24.02.0-1ubuntu9.8
24.02.0-1ubuntu9.9
2
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
poppler@0.86.1-0ubuntu1
no fix listed
2
anujdatar/cups:25.07.01685df04a643b
poppler@22.12.0-2+deb12u1
22.12.0-2+deb12u2
1
codetogether/codetogether:latest4348c8a38752
poppler@21.01.0-19.el9
0:21.01.0-24.el9_8.1
1
datamate/seafile-professional:11.0.202dd66b722464
poppler@22.02.0-2ubuntu0.10
22.02.0-2ubuntu0.13
1
gotenberg/gotenberg:8.30206a6c708fc6
poppler@25.03.0-5+deb13u2
25.03.0-5+deb13u3
1
mediagis/nominatim:3.7c15e941485ef
poppler@0.86.1-0ubuntu1
no fix listed
1
mediagis/nominatim:4.2d0eae7b51374
poppler@22.02.0-2ubuntu0.3
22.02.0-2ubuntu0.13
1
openkm/openkm-ce:6.3.113bc465a7461b
poppler@0.86.1-0ubuntu1
no fix listed
1
penpotapp/exporter:2.2.15c835ffd87ab
poppler@22.02.0-2ubuntu0.5
22.02.0-2ubuntu0.13
1
phntom/mattermost-team-edition:9.3.051cf9da4aa2e
poppler@22.02.0-2ubuntu0.3
22.02.0-2ubuntu0.13
1
photoprism/photoprism:260601650c6ad5a651
poppler@26.01.0-2build2
26.01.0-2ubuntu0.1
1
photoprism/photoprism:251130db16ee6b1ba3
poppler@25.03.0-10ubuntu0.1
25.03.0-10ubuntu0.2
1
photoprism/photoprism:240711-cefc6fd632ca74
poppler@24.02.0-1ubuntu9
24.02.0-1ubuntu9.9
1
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
poppler@22.12.0-2+b1
22.12.0-2+deb12u2
1
stashapp/stash-box:latesta534c8afdf39
poppler@24.02.0-1ubuntu9.4
24.02.0-1ubuntu9.9
1
timescale/timescaledb-ha:pg15-latesta8e3322e1cf9
poppler@22.02.0-2ubuntu0.1
22.02.0-2ubuntu0.13
1
timescale/timescaledb-ha:pg14.6-ts2.9.1-p1cdb9ae118899
poppler@22.02.0-2ubuntu0.1
22.02.0-2ubuntu0.13
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
poppler@22.02.0-2ubuntu0.6
22.02.0-2ubuntu0.13
1
timescale/timescaledb-ha:pg14-ts2.6-latested719c0cd19d
poppler@22.02.0-2
22.02.0-2ubuntu0.13
1
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
poppler@25.03.0-5+deb13u2
25.03.0-5+deb13u3
1
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
poppler@22.12.0-2+b1
22.12.0-2+deb12u2
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
poppler@22.12.0-2+b1
22.12.0-2+deb12u2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
poppler@25.03.0-5+deb13u2
25.03.0-5+deb13u3
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
poppler@25.03.0-5+deb13u2
25.03.0-5+deb13u3
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
poppler@25.03.0-5+deb13u2
25.03.0-5+deb13u3
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
poppler@22.12.0-2+b1
22.12.0-2+deb12u2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
poppler@25.03.0-5+deb13u2
25.03.0-5+deb13u3
1
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
poppler@24.02.0-1ubuntu9.8
24.02.0-1ubuntu9.9
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.