CVE-2026-16599

Medium

Advisory

Published 25 Aug 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.1; base score, highest
EPSS: 0.004; 31st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 565; of 17,787 indexed, latest versions
Container images: 560; deployed by those charts
Fix available: 2 of 3; affected packages

Security update for wget

Carried by container images the latest versions of 565 of 17,787 indexed charts deploy, on 560 images.

Affected package	Affected versions	Fixed in	Images
wgetdeb	1.15-1ubuntu1, 1.15-1ubuntu1.14.04.1, 1.15-1ubuntu1.14.04.4, 1.17.1-1ubuntu1.3+23 more	no fix listed	555
wgetapk	1.25.0-r4, 1.25.0-r16	1.25.0-r17	4
wgetrpm	1.24.5-150700.3.6.1	1.24.5-150700.3.12.1	1

OSV records: CGA-7q69-m5x5-gcq7 DEBIAN-CVE-2026-16599 UBUNTU-CVE-2026-16599 SUSE-SU-2026:4049-1
Also known as: CGA-j4gw-5vrq-m7mf

Charts affected

565 by stars

Chart

Latest

Affected images

Radar Score

demo-backendv2fly

0.0.3

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	wget@1.21.3-1+b2	no fix listed

Open the chart page →

14,383

unmanicvhdirk

0.1.4

1 of 1 See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
josh5/unmanic :0.2.6	4d49c4816260	wget@1.21.2-2ubuntu1	no fix listed

Open the chart page →

9,396

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	wget@1.21.4-1ubuntu4.1	no fix listed

Open the chart page →

4,360

aih-scannerwallarm

2.7.11

1 of 2 See more

aih-scanner wallarm 2.7.11

1 of the 2 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
wallarm/aih-scanner :2.7.11	f1cb26db1f5b	wget@1.25.0-2	no fix listed

Open the chart page →

3,906

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	wget@1.20.3-1ubuntu2	no fix listed

Open the chart page →

11,167

myweatherhelmwebapp1

1.3.50

1 of 8 See more

myweatherhelm webapp1 1.3.50

1 of the 8 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	wget@1.20.3-1ubuntu2	no fix listed

Open the chart page →

9,225

myweatherhelm-schedulingwebapp1

1.3.92

1 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

1 of the 9 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	wget@1.20.3-1ubuntu2	no fix listed

Open the chart page →

9,225

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	wget@1.20.3-1ubuntu1	no fix listed

Open the chart page →

14,420

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	wget@1.20.3-1ubuntu1	no fix listed

Open the chart page →

28,699

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	wget@1.21.3-1+deb12u1	no fix listed

Open the chart page →

8,824

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	wget@1.21.2-2ubuntu1	no fix listed

Open the chart page →

9,296

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	wget@1.21.2-2ubuntu1.1	no fix listed

Open the chart page →

14,172

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	wget@1.21.3-1+b2	no fix listed

Open the chart page →

13,197

clickhousezloi-space

1.2.0

1 of 3 See more

clickhouse zloi-space 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
yandex/clickhouse-server :21.3.20	4eccfffb01d7	wget@1.20.3-1ubuntu2	no fix listed

Open the chart page →

9,250

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-16599.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	wget@1.21.2-2ubuntu1.4	no fix listed

Open the chart page →

7,916

Container images carrying it

560 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	wget@1.21.3-1+b2	no fix listed	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	wget@1.21.3-1+b2	no fix listed	1
quay.io/argoprojlabs/gitops-promoter :v0.38.1	9c8a510dc25e	wget@1.25.0-2	no fix listed	1
quay.io/fiware/waltid :1.14.1-SNAPSHOT	93889c3d8a34	wget@1.21.2-2ubuntu1	no fix listed	1
quay.io/galaxyproject/galaxy-min :26.1.1	2c324c9789f5	wget@1.25.0-2	no fix listed	1
quay.io/go-skynet/local-ai :latest	d78cd113b2bc	wget@1.21.4-1ubuntu4.4	no fix listed	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	wget@1.21.3-1+b2	no fix listed	1
registry.gitlab.com/dyff/workflows-aggregator :0.16.9	b7984253b128	wget@1.25.0-2ubuntu4.4	no fix listed	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	wget@1.21.3-1+deb12u1	no fix listed	1
registry.gitlab.com/school_guy/docker-typo3 :13.4.30-197d868e	d76185d7270d	wget@1.21.3-1+deb12u1	no fix listed	1