dockle

Dockle - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start Dockle helps you: 1. Build Best Practice Docker images 2. Build secure Docker images Checkpoints includes CIS Benchmarks $ brew untap goodwithtech/dockle who use 0.1.16 or older version $ bre...

[SECURITY] Fedora 45 Update: ocaml-spdx-licenses-1.5.0-2.fc45

spdxlicenses is an OCaml library aiming to provide an up-to-date and strict SPDX License Expression parser. It implements the format described in https://spdx.github.io/spdx-spec/appendix-IV-SPDX-license-expressions/...

CVE-2026-90933: Missing Authorization

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...

Driver’s License Data for Sale

A database of 153 million drivers licenses is for sale on the dark web. Brian Krebs has more detail...

153M+ driver’s licenses for sale on new dark web platform

A new dark web platform called Nexus claimed to be selling 153 million driver’s license scans and millions of other identity and medical cards. The collection included more than 153 million driver’s licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical cards, including...

FBI Probes Service Selling 153M+ Drivers Licenses

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphonin...

EUVD-2026-42986

Snipe-IT has missing object-level authorization in Kits API...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: grafana-operator, nri-haproxy, controller-gen, terraform-provider-sendgrid, victoriametrics-cluster, grafana-agent-operator, bazelisk, nri-mongodb, buildkitd, crossplane-provider-aws-kms, gitness, crossplane-provider-aws-ec2, kyverno, kind,...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: grafana-operator, nri-haproxy, controller-gen, terraform-provider-sendgrid, victoriametrics-cluster, grafana-agent-operator, bazelisk, nri-mongodb, buildkitd, crossplane-provider-aws-kms, gitness, crossplane-provider-aws-ec2, kyverno, kind,...

CVE-2026-33818 vulnerabilities

Vulnerabilities for packages: grafana-operator, nri-haproxy, controller-gen, terraform-provider-sendgrid, victoriametrics-cluster, grafana-agent-operator, bazelisk, nri-mongodb, buildkitd, crossplane-provider-aws-kms, gitness, crossplane-provider-aws-ec2, kyverno, kind,...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: grafana-operator, nri-haproxy, controller-gen, terraform-provider-sendgrid, victoriametrics-cluster, grafana-agent-operator, bazelisk, nri-mongodb, buildkitd, crossplane-provider-aws-kms, gitness, crossplane-provider-aws-ec2, kyverno, kind,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: dagger, flux-kustomize-controller, argo-workflows, pulumi-language-yaml, snyk-cli, src-fingerprint, pulumi, zot, grafana-alloy, scorecard, argocd-image-updater, wolfictl, bom, kargo, gptscript, kubescape, trivy, tfsec, k8sgpt, gitsign, flux-image-automation-controlle...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: dagger, flux-kustomize-controller, argo-workflows, pulumi-language-yaml, snyk-cli, src-fingerprint, pulumi, zot, grafana-alloy, scorecard, argocd-image-updater, wolfictl, bom, kargo, gptscript, kubescape, trivy, tfsec, k8sgpt, gitsign, flux-image-automation-controlle...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-livenessprobe, ipfs-cluster, litestream, src-fingerprint, flannel, falcosidekick, grafana-operator, grpcurl, cloud-provider-vsphere, kube-logging-operator-custom-runner, nri-haproxy, sftpgo-plugin-kms, spegel, terraform-mcp-server, calico, golangci-lin...

CVE-2026-12690 ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license setting...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the POST /api/v1/kits/kitid/licenses endpoint. An attacker can gain unauthorized access to and manipulate license object...

CVE-2026-55479

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them to directly access the old checkin...

CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...

CVE-2026-55478 Snipe-IT: Missing object-level authorization in Kits API

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/kitid/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should n...

CVE-2026-55478

Snipe-IT (IT asset/license management) has a vulnerability in the Kits API. Before version 8.6.2, POST /api/v1/kits/{kit_id}/licenses validates the caller’s ability to edit kits but does not authorize access to the referenced license object. This allows a low-privilege user with predefined-kit pe...