StackRadar

CVE-2026-16238

High

Advisory

Published 13 Aug 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.004
35th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
45
of 17,781 indexed, latest versions
Container images
43
deployed by those charts
Fix available
3 of 4
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 45 of 17,781 indexed charts deploy, on 43 images.

Affected packageAffected versionsFixed inImages
postgresql18apk18.1-r0, 18.2-r0, 18.3-r0, 18.4-r018.5-r026
postgresql17apk17.2-r0, 17.4-r0, 17.5-r0, 17.6-r0+3 more17.11-r012
postgresql-18deb18.4-0ubuntu0.26.04.1, 18.4-1.pgdg26.04+118.6-0ubuntu0.26.04.14
postgresql-9.3deb9.3.22-0ubuntu0.14.04no fix listed1
OSV records
ALPINE-CVE-2026-16238UBUNTU-CVE-2026-16238
Also known as
USN-8653-1

Charts affected

45 by stars
ChartLatestAffected imagesRadar Score
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
postgresql17@17.6-r0
17.11-r0

Open the chart page →

16,251
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
postgresql17@17.10-r0
17.11-r0

Open the chart page →

9,203
privatebinprivatebin0.23.61 of 1See more

privatebin privatebin 0.23.6

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
privatebin/nginx-fpm-alpine:2.0.613290e2f04bf
postgresql18@18.4-r0
18.5-r0

Open the chart page →

483
postgresqlkubelauncherVerified publisher0.4.31 of 1See more

postgresql kubelauncher 0.4.3

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/postgresqldigest-pinned1a27e11e5925
postgresql-18@18.4-1.pgdg26.04+1
18.6-0ubuntu0.26.04.1

Open the chart page →

1,115
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
budibase/apps:3.41.344fe6feab985
postgresql18@18.4-r0
18.5-r0

Open the chart page →

10,775
photoprismandrenarchyVerified publisher8.15.01 of 1See more

photoprism andrenarchy 8.15.0

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
photoprism/photoprism:260728958642220223
postgresql-18@18.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1

Open the chart page →

8,825
healthchecksgabe565Verified publisher0.17.01 of 1See more

healthchecks gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/healthchecks:version-v3.9b5c6bfb00b03
postgresql17@17.4-r0
17.11-r0

Open the chart page →

2,286
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.28cfde8170c92f
postgresql18@18.2-r0
18.5-r0

Open the chart page →

30,816
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
postgresql18@18.2-r0
18.5-r0

Open the chart page →

4,634
adminerstartechnicaVerified publisher1.1.01 of 1See more

adminer startechnica 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
library/adminer:5.4.2-standalone983261ecc40a
postgresql18@18.4-r0
18.5-r0

Open the chart page →

602
domain-lockerdomain-locker0.2.81 of 3See more

domain-locker domain-locker 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
lissy93/domain-locker:latestd3c95edc0a8b
postgresql18@18.3-r0
18.5-r0

Open the chart page →

1,882
jupyterhub-outpostjupyter-jscVerified publisher2.4.11 of 1See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
postgresql18@18.4-r0
18.5-r0

Open the chart page →

1,678
gobackupadnoctemVerified publisher0.4.01 of 1See more

gobackup adnoctem 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
huacnlee/gobackup:v3.1.1560be93229a5
postgresql18@18.4-r0
18.5-r0

Open the chart page →

1,828
linkstackadnoctemVerified publisher0.4.01 of 1See more

linkstack adnoctem 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
linkstackorg/linkstack:latest1c8b05399ee4
postgresql17@17.8-r0
17.11-r0

Open the chart page →

2,092
antigenic-docuseal-helm-chartantigenic-docuseal-helm-chartVerified publisher0.2.01 of 1See more

antigenic-docuseal-helm-chart antigenic-docuseal-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
docuseal/docuseal:2.4.17493fd7f6728
postgresql18@18.3-r0
18.5-r0

Open the chart page →

2,766
appwriteappwrite-helmVerified publisher1.3.21 of 8See more

appwrite appwrite-helm 1.3.2

1 of the 8 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.01aaa70127114
postgresql18@18.2-r0
18.5-r0

Open the chart page →

9,847
blackduck-alertblackduck8.4.01 of 4See more

blackduck-alert blackduck 8.4.0

1 of the 4 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
blackducksoftware/blackduck-alert:8.4.090cca32de2cc
postgresql18@18.3-r0
18.5-r0

Open the chart page →

4,292
galaxy-stablecloudve2.0.01 of 5See more

galaxy-stable cloudve 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
galaxy/galaxy-stable:v18.018e577a626dfd
postgresql-9.3@9.3.22-0ubuntu0.14.04
no fix listed

Open the chart page →

70,895
csghubcsghubVerified publisher2.4.31 of 34See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
opencsghq/psql:latest57def8e77d0f
postgresql17@17.2-r0
17.11-r0

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
opencsghq/psql:latest57def8e77d0f
postgresql17@17.2-r0
17.11-r0

Open the chart page →

11,335
dataflowcsghubVerified publisher2.5.01 of 7See more

dataflow csghub 2.5.0

1 of the 7 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
opencsghq/psql:latest57def8e77d0f
postgresql17@17.2-r0
17.11-r0

Open the chart page →

6,632
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
postgresql17@17.7-r0
17.11-r0

Open the chart page →

2,896
fairwinds-insightsfairwinds-stableVerified publisher10.1.101 of 13See more

fairwinds-insights fairwinds-stable 10.1.10

1 of the 13 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
alpine/psql:18.339824ef2b7fc
postgresql18@18.3-r0
18.5-r0

Open the chart page →

3,797
borgmaticgabe565Verified publisher0.10.11 of 1See more

borgmatic gabe565 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
ghcr.io/borgmatic-collective/borgmatic:1.9.9835b72878606
postgresql17@17.2-r0
17.11-r0

Open the chart page →

2,438
monicagabe565Verified publisher0.10.01 of 2See more

monica gabe565 0.10.0

1 of the 2 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
library/monica:4.1.2-fpm-alpine6d1b2bd0947e
postgresql18@18.4-r0
18.5-r0

Open the chart page →

1,173
octoboxhalkeye0.1.11 of 1See more

octobox halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
octoboxio/octobox:latestd909041c46eb
postgresql18@18.1-r0
18.5-r0

Open the chart page →

3,255
appwritehelmforgeVerified publisher1.3.41 of 5See more

appwrite helmforge 1.3.4

1 of the 5 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.6adc7d0e7ec23
postgresql18@18.4-r0
18.5-r0

Open the chart page →

6,952
netboxhelmforgeVerified publisher2.0.11 of 4See more

netbox helmforge 2.0.1

1 of the 4 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v4.6.10-5.0.291b823a05cb5
postgresql-18@18.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1

Open the chart page →

4,243
ja-shortenerja-shortenerVerified publisher0.1.01 of 2See more

ja-shortener ja-shortener 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
cr0hn/ja-shortener:v0.1.414482d0bc4a1
postgresql17@17.5-r0
17.11-r0

Open the chart page →

2,089
bazarrk8s-home-lab-repo11.3.21 of 1See more

bazarr k8s-home-lab-repo 11.3.2

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
postgresql18@18.4-r0
18.5-r0

Open the chart page →

1,794
syslog-ngk8s-home-lab-repo3.1.11 of 1See more

syslog-ng k8s-home-lab-repo 3.1.1

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/syslog-ng:4.10.247fae7f540f9
postgresql18@18.4-r0
18.5-r0

Open the chart page →

1,298
bazarrm0nsterrr-bazarrVerified publisher2.3.01 of 1See more

bazarr m0nsterrr-bazarr 2.3.0

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.6.0cd63bbd0986c
postgresql18@18.4-r0
18.5-r0

Open the chart page →

898
novosgamarcusrepo0.1.11 of 2See more

novosga marcusrepo 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
novosga/novosga:latest34b9acbe6e51
postgresql18@18.3-r0
18.5-r0

Open the chart page →

3,706
szurubooru-servermy0nVerified publisher0.2.51 of 3See more

szurubooru-server my0n 0.2.5

1 of the 3 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
szurubooru/server:2.5accf2ad9fbc3
postgresql17@17.10-r0
17.11-r0

Open the chart page →

1,043
jupyterhub-metricsncsaVerified publisher1.3.01 of 5See more

jupyterhub-metrics ncsa 1.3.0

1 of the 5 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
ghcr.io/ncsa/jupyterhub-metrics/collector:1.3.0dcb8c731bb1b
postgresql17@17.8-r0
17.11-r0

Open the chart page →

4,132
pgbouncerpostgres-pgbouncerVerified publisher0.4.01 of 1See more

pgbouncer postgres-pgbouncer 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
edoburu/pgbouncer:latest4c1ca296ef52
postgresql18@18.4-r0
18.5-r0

Open the chart page →

651
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
postgresql17@17.7-r0
17.11-r0

Open the chart page →

4,499
pev2schichtelVerified publisher0.3.01 of 1See more

pev2 schichtel 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
dalibo/explain.dalibo.com:2.20.12a0b749c2f7f
postgresql18@18.2-r0
18.5-r0

Open the chart page →

1,178
teamspeak3schichtelVerified publisher1.0.21 of 1See more

teamspeak3 schichtel 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
library/teamspeak:3.13.74d3fa1c0db9a
postgresql18@18.3-r0
18.5-r0

Open the chart page →

774
photoprismschoolguys-helmcharts0.3.81 of 1See more

photoprism schoolguys-helmcharts 0.3.8

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
photoprism/photoprism:260601650c6ad5a651
postgresql-18@18.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1

Open the chart page →

10,348
smtpsmtpVerified publisher1.3.31 of 1See more

smtp smtp 1.3.3

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
postgresql18@18.4-r0
18.5-r0

Open the chart page →

1,437
mybbsudermanjr0.1.01 of 3See more

mybb sudermanjr 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
mybb/mybb:1.8f2a54bce31c5
postgresql18@18.4-r0
18.5-r0

Open the chart page →

2,157
teamspeaksyntaxerror404Verified publisher1.0.101 of 1See more

teamspeak syntaxerror404 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
library/teamspeak:3.13.815acbc64c92f
postgresql18@18.4-r0
18.5-r0

Open the chart page →

449
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
postgresql18@18.4-r0
18.5-r0

Open the chart page →

5,550
wexa-studiowexa-studio1.2.01 of 15See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-16238.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
postgresql17@17.5-r0
17.11-r0

Open the chart page →

14,983

Container images carrying it

43 by charts deploying them

A fixed version is listed for 3 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
opencsghq/psql:latest57def8e77d0f
postgresql17@17.2-r0
17.11-r0
3
alpine/psql:18.339824ef2b7fc
postgresql18@18.3-r0
18.5-r0
1
appwrite/appwrite:1.9.01aaa70127114
postgresql18@18.2-r0
18.5-r0
1
appwrite/appwrite:1.9.6adc7d0e7ec23
postgresql18@18.4-r0
18.5-r0
1
blackducksoftware/blackduck-alert:8.4.090cca32de2cc
postgresql18@18.3-r0
18.5-r0
1
budibase/apps:3.41.344fe6feab985
postgresql18@18.4-r0
18.5-r0
1
chatwoot/chatwoot:v4.15.167ebc751c171
postgresql17@17.10-r0
17.11-r0
1
cr0hn/ja-shortener:v0.1.414482d0bc4a1
postgresql17@17.5-r0
17.11-r0
1
dalibo/explain.dalibo.com:2.20.12a0b749c2f7f
postgresql18@18.2-r0
18.5-r0
1
docuseal/docuseal:2.4.17493fd7f6728
postgresql18@18.3-r0
18.5-r0
1
edoburu/pgbouncer:latest4c1ca296ef52
postgresql18@18.4-r0
18.5-r0
1
galaxy/galaxy-stable:v18.018e577a626dfd
postgresql-9.3@9.3.22-0ubuntu0.14.04
no fix listed
1
grafana/oncall:v1.16.5499851658393
postgresql17@17.6-r0
17.11-r0
1
huacnlee/gobackup:v3.1.1560be93229a5
postgresql18@18.4-r0
18.5-r0
1
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
postgresql18@18.4-r0
18.5-r0
1
library/adminer:5.4.2-standalone983261ecc40a
postgresql18@18.4-r0
18.5-r0
1
library/monica:4.1.2-fpm-alpine6d1b2bd0947e
postgresql18@18.4-r0
18.5-r0
1
library/teamspeak:3.13.815acbc64c92f
postgresql18@18.4-r0
18.5-r0
1
library/teamspeak:3.13.74d3fa1c0db9a
postgresql18@18.3-r0
18.5-r0
1
linkstackorg/linkstack:latest1c8b05399ee4
postgresql17@17.8-r0
17.11-r0
1
lissy93/domain-locker:latestd3c95edc0a8b
postgresql18@18.3-r0
18.5-r0
1
mybb/mybb:1.8f2a54bce31c5
postgresql18@18.4-r0
18.5-r0
1
netboxcommunity/netbox:v4.6.10-5.0.291b823a05cb5
postgresql-18@18.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1
1
novosga/novosga:latest34b9acbe6e51
postgresql18@18.3-r0
18.5-r0
1
octoboxio/octobox:latestd909041c46eb
postgresql18@18.1-r0
18.5-r0
1
photoprism/photoprism:260601650c6ad5a651
postgresql-18@18.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1
1
photoprism/photoprism:260728958642220223
postgresql-18@18.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1
1
privatebin/nginx-fpm-alpine:2.0.613290e2f04bf
postgresql18@18.4-r0
18.5-r0
1
rommapp/romm:4.4.1b909e95d1aab
postgresql17@17.7-r0
17.11-r0
1
szurubooru/server:2.5accf2ad9fbc3
postgresql17@17.10-r0
17.11-r0
1
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
postgresql17@17.5-r0
17.11-r0
1
temporalio/admin-tools:1.28cfde8170c92f
postgresql18@18.2-r0
18.5-r0
1
twentycrm/twenty:v2.22.0e7d9948bf284
postgresql18@18.4-r0
18.5-r0
1
vabene1111/recipes:2.3.50f8d061895e9
postgresql17@17.7-r0
17.11-r0
1
ghcr.io/borgmatic-collective/borgmatic:1.9.9835b72878606
postgresql17@17.2-r0
17.11-r0
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
postgresql18@18.4-r0
18.5-r0
1
ghcr.io/home-operations/bazarr:1.6.0cd63bbd0986c
postgresql18@18.4-r0
18.5-r0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
postgresql18@18.2-r0
18.5-r0
1
ghcr.io/kubelauncher/postgresql1a27e11e5925
postgresql-18@18.4-1.pgdg26.04+1
18.6-0ubuntu0.26.04.1
1
ghcr.io/linuxserver/healthchecks:version-v3.9b5c6bfb00b03
postgresql17@17.4-r0
17.11-r0
1
ghcr.io/linuxserver/syslog-ng:4.10.247fae7f540f9
postgresql18@18.4-r0
18.5-r0
1
ghcr.io/ncsa/jupyterhub-metrics/collector:1.3.0dcb8c731bb1b
postgresql17@17.8-r0
17.11-r0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
postgresql18@18.4-r0
18.5-r0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.