CVE-2026-16118

High

Advisory

Published 17 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.1; base score, highest
EPSS: 0.002; 16th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 811; of 17,787 indexed, latest versions
Container images: 920; deployed by those charts
Fix available: 2 of 2; affected packages

Red Hat Security Advisory: glib2 security update

Carried by container images the latest versions of 811 of 17,787 indexed charts deploy, on 920 images.

Affected package	Affected versions	Fixed in	Images
glib2.0deb	2.40.2-0ubuntu1, 2.48.2-0ubuntu1, 2.48.2-0ubuntu4.1, 2.48.2-0ubuntu4.4+44 more	2.84.4-3~deb13u5	488
glib2rpm	2.56.4-1.el8, 2.56.4-7.el8, 2.56.4-8.el8, 2.56.4-8.el8_2.1+33 more	0:2.56.4-178.el8_10, 0:2.68.4-19.el9_8.10, 0:2.80.4-12.el10_2.22	432

OSV records: DEBIAN-CVE-2026-16118 RHSA-2026:64799 RHSA-2026:64800 RHSA-2026:66451 RLSA-2026:64799 RLSA-2026:64800 RLSA-2026:66451 UBUNTU-CVE-2026-16118

Charts affected

811 by stars

Chart

Latest

Affected images

Radar Score

webhookie-allwebhookie

0.1.2

2 of 3 See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	glib2.0@2.64.6-1~ubuntu20.04.4	no fix listed
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	glib2@2.56.4-10.el8_4	0:2.56.4-178.el8_10

Open the chart page →

28,699

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	glib2.0@2.74.6-2+deb12u9	no fix listed

Open the chart page →

8,824

miniowenerme

8.0.10

1 of 1 See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2021-02-14T04-01-33Z	bd11edda91f3	glib2@2.56.4-8.el8	0:2.56.4-178.el8_10

Open the chart page →

6,915

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	glib2@2.56.4-156.el8	0:2.56.4-178.el8_10

Open the chart page →

6,138

wexa-studiowexa-studio

1.2.0

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
quay.io/mongodb/mongodb-kubernetes-operator :0.9.0	5ee4bd681085	glib2@2.56.4-166.el8_10	0:2.56.4-178.el8_10

Open the chart page →

14,618

Wordpresswordpress-mariadb

1.0.2

1 of 2 See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
library/wordpress :latest	5a93c470ae82	glib2.0@2.84.4-3~deb13u3	2.84.4-3~deb13u5

Open the chart page →

5,635

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	glib2.0@2.72.4-0ubuntu2.3	no fix listed

Open the chart page →

14,172

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	glib2@2.56.4-156.el8	0:2.56.4-178.el8_10

Open the chart page →

11,592

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	glib2@2.56.4-159.el8	0:2.56.4-178.el8_10

Open the chart page →

6,016

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	glib2@2.56.4-159.el8	0:2.56.4-178.el8_10

Open the chart page →

3,697

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	glib2.0@2.72.4-0ubuntu2.9	no fix listed

Open the chart page →

7,916

Container images carrying it

920 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/drogue-iot/drogue-event-source :0.2.1	e2e812a4cf8e	glib2@2.56.4-156.el8	0:2.56.4-178.el8_10	1
ghcr.io/drogue-iot/http-endpoint :0.11.0	b612c18479e0	glib2@2.68.4-5.el9	0:2.68.4-19.el9_8.10	1
ghcr.io/drogue-iot/knative-operator :0.11.0	e2d927639f6e	glib2@2.68.4-5.el9	0:2.68.4-19.el9_8.10	1
ghcr.io/drogue-iot/mqtt-endpoint :0.11.0	32c6d2f5eab9	glib2@2.68.4-5.el9	0:2.68.4-19.el9_8.10	1
ghcr.io/drogue-iot/mqtt-integration :0.11.0	7ac2adb6ca49	glib2@2.68.4-5.el9	0:2.68.4-19.el9_8.10	1
ghcr.io/drogue-iot/outbox-controller :0.11.0	1a958edafdb1	glib2@2.68.4-5.el9	0:2.68.4-19.el9_8.10	1
ghcr.io/drogue-iot/postgresql-pusher :0.2.1	c6bb121ced90	glib2@2.56.4-156.el8	0:2.56.4-178.el8_10	1
ghcr.io/drogue-iot/test-cert-generator :0.11.0	6ba7e1608286	glib2@2.56.4-159.el8	0:2.56.4-178.el8_10	1
ghcr.io/drogue-iot/topic-strimzi-operator :0.11.0	5253fbf8d04c	glib2@2.68.4-5.el9	0:2.68.4-19.el9_8.10	1
ghcr.io/drogue-iot/ttn-operator :0.11.0	7dd5ac80c8f1	glib2@2.68.4-5.el9	0:2.68.4-19.el9_8.10	1
ghcr.io/drogue-iot/user-auth-service :0.11.0	adebc40ddf98	glib2@2.68.4-5.el9	0:2.68.4-19.el9_8.10	1
ghcr.io/drogue-iot/websocket-integration :0.11.0	372dcd370945	glib2@2.68.4-5.el9	0:2.68.4-19.el9_8.10	1
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	glib2@2.56.4-177.el8_10	0:2.56.4-178.el8_10	1
ghcr.io/edgelesssys/coordinator :v0.5.0	bcd5b8d4c45c	glib2.0@2.56.4-0ubuntu0.18.04.8	no fix listed	1
ghcr.io/firecrawl/playwright-service :latest	1f6eba640320	glib2.0@2.74.6-2+deb12u9	no fix listed	1
ghcr.io/flaresolverr/flaresolverr :v3.4.0	ab535d1fef5d	glib2.0@2.74.6-2+deb12u6	no fix listed	1
ghcr.io/getsentry/snuba :26.7.2	10f8d164109b	glib2.0@2.84.4-3~deb13u3	2.84.4-3~deb13u5	1
ghcr.io/grafana/alloy-operator :1.3.0	2088dcb22aaa	glib2@2.68.4-16.el9	0:2.68.4-19.el9_8.10	1
ghcr.io/grafana/alloy-operator :1.7.0	2ce23f948e02	glib2@2.68.4-16.el9_6.2	0:2.68.4-19.el9_8.10	1
ghcr.io/grafana/alloy-operator :1.12.1	4ee4b71cf16a	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
ghcr.io/grafana/alloy-operator :1.8.1	ae85d68749c7	glib2@2.68.4-18.el9_7.1	0:2.68.4-19.el9_8.10	1
ghcr.io/graphprotocol/availability-oracle :sha-28312fd	472a25038957	glib2.0@2.74.6-2+deb12u3	no fix listed	1
ghcr.io/haveagitgat/tdarr :2.00.18.2	3fbe4c29d14c	glib2.0@2.64.6-1~ubuntu20.04.4	no fix listed	1
ghcr.io/immich-app/immich-machine-learning :v2.3.1	379e31b8c751	glib2.0@2.74.6-2+deb12u7	no fix listed	1
ghcr.io/immich-app/immich-machine-learning :v3.1.0	5a0839dc5303	glib2.0@2.74.6-2+deb12u9	no fix listed	1
ghcr.io/immich-app/immich-server :v3.2.1	2ab6a6273755	glib2.0@2.84.4-3~deb13u3	2.84.4-3~deb13u5	1
ghcr.io/immich-app/immich-server :v3.1.0	b434cb9287ee	glib2.0@2.84.4-3~deb13u3	2.84.4-3~deb13u5	1
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	glib2.0@2.84.4-3~deb13u1	2.84.4-3~deb13u5	1
ghcr.io/it-at-m/dave-admin-portal/dave-adminportal :10.0.0	cbff8141302f	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
ghcr.io/it-at-m/dave-backend/dave-backend :10.0.0	f66413e62afc	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
ghcr.io/it-at-m/dave-document-storage/dave-document-storage :10.0.0	9c7fc07330c9	glib2@2.68.4-18.el9_7	0:2.68.4-19.el9_8.10	1
ghcr.io/it-at-m/dave-eai/dave-eai :10.0.0	fd93e0d125b3	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
ghcr.io/it-at-m/dave-frontend/dave-frontend :10.0.0	a49fdb8d6f1b	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
ghcr.io/it-at-m/dave-geodata-eai/dave-geodata-eai :10.0.0	6a3fe3136856	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
ghcr.io/it-at-m/dave-selfservice-portal/dave-selfserviceportal :10.0.0	d352df1b94b6	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
ghcr.io/it-at-m/kf-app-eai :1.0.6	5de339b3d537	glib2@2.68.4-16.el9_6.2	0:2.68.4-19.el9_8.10	1
ghcr.io/it-at-m/wjh-rechner :1.0.0	bc70cdb5a01a	glib2@2.68.4-11.el9	0:2.68.4-19.el9_8.10	1
ghcr.io/it-at-m/zammad-ldap-sync :dev	10de22c8cbce	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
ghcr.io/itzg/minecraft-server :latest	c1a267d9ed6d	glib2.0@2.80.0-6ubuntu3.8	no fix listed	1
ghcr.io/jenkins-x/nexus :0.1.37	8caf5289fe73	glib2@2.56.4-8.el8	0:2.56.4-178.el8_10	1
ghcr.io/jfwenisch/discord-experiencebot :latest	b52ff07f9f0c	glib2.0@2.56.4-0ubuntu0.18.04.9	no fix listed	1
ghcr.io/jfwenisch/steamcmd-manager :v0.4.5	dab685e668d9	glib2.0@2.80.0-6ubuntu3.2	no fix listed	1
ghcr.io/jfwenisch/webtools :v0.1.4	4569cae83c70	glib2.0@2.80.0-6ubuntu3.2	no fix listed	1
ghcr.io/jr0dd/puppeteer :v13.3.2	6047599cd78e	glib2.0@2.64.6-1~ubuntu20.04.4	no fix listed	1
ghcr.io/k8s-at-home/bazarr :v1.0.3	fdb5501cdfb9	glib2.0@2.64.6-1~ubuntu20.04.4	no fix listed	1
ghcr.io/k8s-at-home/lidarr :v1.0.0.2255	54ebc1f90963	glib2.0@2.64.6-1~ubuntu20.04.4	no fix listed	1
ghcr.io/k8s-at-home/nzbhydra2 :v3.14.2	ef3670f7e0a8	glib2.0@2.64.6-1~ubuntu20.04.3	no fix listed	1
ghcr.io/k8s-at-home/sonarr :v3.0.8.1507	0eb230e2381a	glib2.0@2.72.1-1	no fix listed	1
ghcr.io/k8s-at-home/xteve :v2.2.0.200	292b3614670f	glib2.0@2.64.6-1~ubuntu20.04.4	no fix listed	1
ghcr.io/k8snetworkplumbingwg/multus-dynamic-networks-controller :v0.3.7	2a2bb32c0ea8	glib2@2.56.4-165.el8_10	0:2.56.4-178.el8_10	1