CVE-2026-16118

High

Advisory

Published 17 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.1; base score, highest
EPSS: 0.002; 16th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 811; of 17,787 indexed, latest versions
Container images: 920; deployed by those charts
Fix available: 2 of 2; affected packages

Red Hat Security Advisory: glib2 security update

Carried by container images the latest versions of 811 of 17,787 indexed charts deploy, on 920 images.

Affected package	Affected versions	Fixed in	Images
glib2.0deb	2.40.2-0ubuntu1, 2.48.2-0ubuntu1, 2.48.2-0ubuntu4.1, 2.48.2-0ubuntu4.4+44 more	2.84.4-3~deb13u5	488
glib2rpm	2.56.4-1.el8, 2.56.4-7.el8, 2.56.4-8.el8, 2.56.4-8.el8_2.1+33 more	0:2.56.4-178.el8_10, 0:2.68.4-19.el9_8.10, 0:2.80.4-12.el10_2.22	432

OSV records: DEBIAN-CVE-2026-16118 RHSA-2026:64799 RHSA-2026:64800 RHSA-2026:66451 RLSA-2026:64799 RLSA-2026:64800 RLSA-2026:66451 UBUNTU-CVE-2026-16118

Charts affected

811 by stars

Chart

Latest

Affected images

Radar Score

webhookie-allwebhookie

0.1.2

2 of 3 See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	glib2.0@2.64.6-1~ubuntu20.04.4	no fix listed
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	glib2@2.56.4-10.el8_4	0:2.56.4-178.el8_10

Open the chart page →

28,699

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	glib2.0@2.74.6-2+deb12u9	no fix listed

Open the chart page →

8,824

miniowenerme

8.0.10

1 of 1 See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2021-02-14T04-01-33Z	bd11edda91f3	glib2@2.56.4-8.el8	0:2.56.4-178.el8_10

Open the chart page →

6,915

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	glib2@2.56.4-156.el8	0:2.56.4-178.el8_10

Open the chart page →

6,138

wexa-studiowexa-studio

1.2.0

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
quay.io/mongodb/mongodb-kubernetes-operator :0.9.0	5ee4bd681085	glib2@2.56.4-166.el8_10	0:2.56.4-178.el8_10

Open the chart page →

14,618

Wordpresswordpress-mariadb

1.0.2

1 of 2 See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
library/wordpress :latest	5a93c470ae82	glib2.0@2.84.4-3~deb13u3	2.84.4-3~deb13u5

Open the chart page →

5,635

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	glib2.0@2.72.4-0ubuntu2.3	no fix listed

Open the chart page →

14,172

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	glib2@2.56.4-156.el8	0:2.56.4-178.el8_10

Open the chart page →

11,592

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	glib2@2.56.4-159.el8	0:2.56.4-178.el8_10

Open the chart page →

6,016

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	glib2@2.56.4-159.el8	0:2.56.4-178.el8_10

Open the chart page →

3,697

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-16118.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	glib2.0@2.72.4-0ubuntu2.9	no fix listed

Open the chart page →

7,916

Container images carrying it

920 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
intelowlproject/intelowl :v6.6.1	0b22e547ea6b	glib2.0@2.74.6-2	no fix listed	1
intel/trusted-certificate-issuer :0.5.0	591a9db4a427	glib2.0@2.64.6-1~ubuntu20.04.4	no fix listed	1
inventree/inventree :1.5.4	a946ec09da3e	glib2.0@2.84.4-3~deb13u3	2.84.4-3~deb13u5	1
ispras/svacer :11-2-0	42aa9fa9f189	glib2.0@2.72.4-0ubuntu2.5	no fix listed	1
itzg/bungeecord :latest	1c59f9631f3b	glib2.0@2.88.0-1	no fix listed	1
itzg/minecraft-server :2026.9.0	4e29d14082d9	glib2.0@2.80.0-6ubuntu3.8	no fix listed	1
itzg/minecraft-server :latest	8672e335dbef	glib2.0@2.80.0-6ubuntu3.8	no fix listed	1
jacobalberty/unifi :v7.4.162	b3edc809a3ff	glib2.0@2.56.4-0ubuntu0.18.04.9	no fix listed	1
jaedb/iris :latest	048cfbf58d57	glib2.0@2.74.6-2+deb12u5	no fix listed	1
jakowenko/double-take :1.6.0	b858bac9e32a	glib2.0@2.64.6-1~ubuntu20.04.4	no fix listed	1
jodogne/orthanc-plugins :latest	6ff510aa29c2	glib2.0@2.84.4-3~deb13u3	2.84.4-3~deb13u5	1
jordan/icinga2 :latest	f75025fe8ea8	glib2.0@2.74.6-2+deb12u9	no fix listed	1
josh5/unmanic :0.2.6	4d49c4816260	glib2.0@2.72.4-0ubuntu2.2	no fix listed	1
jpgouin/openldap :2.6.9-fix	bfdd0088c776	glib2.0@2.74.6-2+deb12u5	no fix listed	1
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	glib2.0@2.74.6-2+deb12u9	no fix listed	1
kennethreitz/httpbin :latest	599fe5e50731	glib2.0@2.56.2-0ubuntu0.18.04.2	no fix listed	1
kinseii/wazuh-agent :4.14.1	7160eb143728	glib2.0@2.74.6-2+deb12u7	no fix listed	1
knspar/phronetis-operator :0.1.6	0c4f0543ee58	glib2.0@2.74.6-2+deb12u2	no fix listed	1
kubeflow/model-registry :v0.2.9	5783f6db428f	glib2@2.56.4-162.el8	0:2.56.4-178.el8_10	1
kuberay/operator :v1.0.0	4e6ac8a3a2c4	glib2@2.56.4-161.el8	0:2.56.4-178.el8_10	1
laly9999/node-app :1	dd0e503913e1	glib2.0@2.74.6-2+deb12u6	no fix listed	1
langgenius/dify-api :0.6.11	fca918260dd6	glib2.0@2.74.6-2+deb12u2	no fix listed	1
langgenius/dify-ee-audit :3.9.8-ubi9	e99aed151fc5	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
langgenius/dify-ee-collector :3.9.8-ubi9	a9b91fd62c94	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
langgenius/dify-ee-enterprise :3.9.8-ubi9	c392a36a4ef7	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
langgenius/dify-ee-enterprise-frontend :3.9.8-ubi9	8dd9de6b6190	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
langgenius/dify-ee-gateway :3.9.8-ubi9	9e314c29a61f	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
langgenius/dify-ee-plugin-connector :3.9.8-ubi9	1848d8f1f144	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
langgenius/dify-ee-plugin-crd :3.9.8-ubi9	6f4e0e5f6e5a	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
langgenius/dify-ee-plugin-daemon-serverless :3.9.8-ubi9	d2b8df196d08	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
langgenius/dify-ee-plugin-manager :3.9.8-ubi9	207b343013a0	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
langgenius/dify-ee-web :3.9.8-ubi9	ba1dd1d0bcea	glib2@2.68.4-19.el9_8.1	0:2.68.4-19.el9_8.10	1
langgenius/dify-plugin-daemon :0.6.3-local	3c694329357b	glib2.0@2.80.0-6ubuntu3.8	no fix listed	1
langgenius/dify-plugin-daemon :0.5.1-local	8269050f192e	glib2.0@2.80.0-6ubuntu3.5	no fix listed	1
langgenius/dify-plugin-daemon :main-local	da995c129e2f	glib2.0@2.80.0-6ubuntu3.8	no fix listed	1
library/elasticsearch :9.5.1	9656a9ca03f8	glib2@2.68.4-19.el9_8.9	0:2.68.4-19.el9_8.10	1
library/logstash :9.1.2	33eae14f0867	glib2@2.68.4-16.el9_6.2	0:2.68.4-19.el9_8.10	1
library/nextcloud :31.0.6-apache	588609d76b21	glib2.0@2.74.6-2+deb12u6	no fix listed	1
library/nextcloud :31.0.10-apache	b7faa1653c39	glib2.0@2.84.4-3~deb13u1	2.84.4-3~deb13u5	1
library/nextcloud :34.0.4-apache	de4ad9389386	glib2.0@2.84.4-3~deb13u3	2.84.4-3~deb13u5	1
library/node :20	8f693eaa7e0a	glib2.0@2.74.6-2+deb12u8	no fix listed	1
library/node :latest	f5d1cc40abc1	glib2.0@2.84.4-3~deb13u3	2.84.4-3~deb13u5	1
library/python :3.10	70c9cc675605	glib2.0@2.84.4-3~deb13u3	2.84.4-3~deb13u5	1
library/python :3.8	d41127070014	glib2.0@2.74.6-2+deb12u3	no fix listed	1
library/python :3.9	da5aee29682d	glib2.0@2.84.4-3~deb13u1	2.84.4-3~deb13u5	1
library/redmine :6.1.2	04ac44a2595b	glib2.0@2.84.4-3~deb13u3	2.84.4-3~deb13u5	1
library/wordpress :6.4.3-apache	8ae66efb09a2	glib2.0@2.74.6-2	no fix listed	1
library/wordpress :6.9.4-fpm	ad4a8bae2eb4	glib2.0@2.84.4-3~deb13u3	2.84.4-3~deb13u5	1
library/wordpress :php8.1-apache	f73396626d2f	glib2.0@2.84.4-3~deb13u1	2.84.4-3~deb13u5	1
library/xwiki :lts-postgres-tomcat	56490ac14a31	glib2.0@2.80.0-6ubuntu3.8	no fix listed	1