dockle

Dockle - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start Dockle helps you: 1. Build Best Practice Docker images 2. Build secure Docker images Checkpoints includes CIS Benchmarks $ brew untap goodwithtech/dockle who use 0.1.16 or older version $ bre...

CVE-2026-115935 Control panel only API response emulation replaces "securityKey" and reaches server RCE

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. Thi...

CVE-2026-115935

The Craft CMS control panel contains a vulnerability in the app/process-api-response-headers action, allowing authenticated users with accessCp permissions to perform Remote Code Execution (RCE) . An attacker can inject newline characters into the X-Craft-Plugin-Licenses header, which the system ...

CVE-2026-115935 Control panel only API response emulation replaces "securityKey" and reaches server RCE

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. Thi...

Devolutions Server authorization issue vulnerability

Versions Devolutions Server from 2026.3.5.0 through 2026.3.10.0 and versions 2026.2.20.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization on PAM AD computer import endpoints, allowing authenticated non-administrative users possessing...

[SECURITY] Fedora 45 Update: ocaml-spdx-licenses-1.5.0-2.fc45

spdxlicenses is an OCaml library aiming to provide an up-to-date and strict SPDX License Expression parser. It implements the format described in https://spdx.github.io/spdx-spec/appendix-IV-SPDX-license-expressions/...

CVE-2026-90933

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...

CVE-2026-90933: Missing Authorization

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...

Driver’s License Data for Sale

A database of 153 million drivers licenses is for sale on the dark web. Brian Krebs has more detail...

153M+ driver’s licenses for sale on new dark web platform

A new dark web platform called Nexus claimed to be selling 153 million driver’s license scans and millions of other identity and medical cards. The collection included more than 153 million driver’s licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical cards, including...

FBI Probes Service Selling 153M+ Drivers Licenses

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphonin...

EUVD-2026-42986

Snipe-IT has missing object-level authorization in Kits API...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: kuma, rancher, loki, kapp, newrelic-nri-statsd, external-secrets-operator, atlantis, crossplane, nri-kubernetes, hydra, cosign, stakater-reloader, traefik, fscrypt, litestream, mattermost, cert-manager, terraform-provider-kubernetes, sigstore-scaffolding, ollama,...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: kuma, rancher, loki, kapp, newrelic-nri-statsd, external-secrets-operator, atlantis, crossplane, nri-kubernetes, hydra, cosign, stakater-reloader, traefik, fscrypt, litestream, mattermost, cert-manager, terraform-provider-kubernetes, sigstore-scaffolding, ollama,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: kuma, rancher, loki, kapp, newrelic-nri-statsd, external-secrets-operator, atlantis, crossplane, nri-kubernetes, hydra, cosign, stakater-reloader, traefik, fscrypt, litestream, mattermost, cert-manager, terraform-provider-kubernetes, sigstore-scaffolding, ollama,...

CVE-2026-33818 vulnerabilities

Vulnerabilities for packages: kuma, rancher, loki, kapp, newrelic-nri-statsd, external-secrets-operator, atlantis, crossplane, nri-kubernetes, hydra, cosign, stakater-reloader, traefik, fscrypt, litestream, mattermost, cert-manager, terraform-provider-kubernetes, sigstore-scaffolding, ollama,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: apko, pulumi-language-java, kaniko, tfsec, flux-image-automation-controller, chezmoi, trivy, gitea, goreleaser, kots, kubescape, kargo, melange, pulumi, guac, k8sgpt, crossplane, src-fingerprint, syft, kubevela, wolfictl, zarf, go-licenses, pulumi-language-yaml,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: apko, pulumi-language-java, kaniko, tfsec, flux-image-automation-controller, chezmoi, trivy, gitea, goreleaser, kots, kubescape, kargo, melange, pulumi, guac, k8sgpt, crossplane, src-fingerprint, syft, kubevela, wolfictl, zarf, go-licenses, pulumi-language-yaml,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: hey, rancher-helm, sops, crossplane-provider-aws-cloudwatchlogs, spqr, timescaledb-parallel-copy, grafana-rollout-operator, volume-modifier-for-k8s, kuma, paranoia, terraform, rabbitmq-cluster-operator, neuvector-sigstore-interface, whereabouts,...

CVE-2026-12690 ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license setting...