GHSA-9CV2-CFXC-V4V2 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, gitlab-rails-ce, pact-broker-docker, logstash, pact-broker-docker-fips, ruby3.4-rails, ruby4.0-rails, ruby3.3-rails, logstash-fips, ruby3.2-rails...

GHSA-P67V-3W7G-WJG7 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, gitlab-rails-ce, pact-broker-docker, logstash, pact-broker-docker-fips, ruby3.4-rails, ruby4.0-rails, ruby3.3-rails, logstash-fips, ruby3.2-rails...

GHSA-5PRR-V3J2-97MH vulnerabilities

Vulnerabilities for packages: kube-logging-operator, gitlab-rails-ce, pact-broker-docker, logstash, pact-broker-docker-fips, ruby3.4-rails, ruby4.0-rails, ruby3.3-rails, logstash-fips, ruby3.2-rails...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: tekton-pipelines-fips, beats-fips, skaffold-fips, spegel, kgateway-fips, helmfile, k9s, helm, packer, chartmuseum-fips, rancher-helm, amazon-ecs-agent, envoy-gateway-fips, k3s, kubescape-server, syft, newrelic-infrastructure-agent, kubescape, tigera-operator,...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: tekton-pipelines-fips, beats-fips, skaffold-fips, spegel, kgateway-fips, helmfile, k9s, helm, packer, chartmuseum-fips, rancher-helm, amazon-ecs-agent, envoy-gateway-fips, k3s, kubescape-server, syft, newrelic-infrastructure-agent, kubescape, tigera-operator,...

GHSA-33VJ-92QQ-66HC vulnerabilities

Vulnerabilities for packages: tekton-pipelines-fips, beats-fips, skaffold-fips, spegel, kgateway-fips, helmfile, k9s, helm, packer, chartmuseum-fips, rancher-helm, amazon-ecs-agent, envoy-gateway-fips, k3s, kubescape-server, syft, newrelic-infrastructure-agent, kubescape, tigera-operator,...

GHSA-CVXM-645Q-P574 vulnerabilities

Vulnerabilities for packages: tekton-pipelines-fips, beats-fips, skaffold-fips, spegel, kgateway-fips, helmfile, k9s, helm, packer, chartmuseum-fips, rancher-helm, amazon-ecs-agent, envoy-gateway-fips, k3s, kubescape-server, syft, newrelic-infrastructure-agent, kubescape, tigera-operator,...

CVE-2026-50195 vulnerabilities

Vulnerabilities for packages: tekton-pipelines-fips, beats-fips, skaffold-fips, spegel, kgateway-fips, helmfile, k9s, helm, packer, chartmuseum-fips, rancher-helm, amazon-ecs-agent, envoy-gateway-fips, k3s, kubescape-server, syft, newrelic-infrastructure-agent, kubescape, tigera-operator,...

GHSA-RGH6-RFWX-V388 vulnerabilities

Vulnerabilities for packages: tekton-pipelines-fips, beats-fips, skaffold-fips, spegel, kgateway-fips, helmfile, k9s, helm, packer, chartmuseum-fips, rancher-helm, amazon-ecs-agent, envoy-gateway-fips, k3s, kubescape-server, syft, newrelic-infrastructure-agent, kubescape, tigera-operator,...

CVE-2026-47262 vulnerabilities

Vulnerabilities for packages: skaffold-fips, spegel, kgateway-fips, helmfile, k9s, helm, packer, chartmuseum-fips, rancher-helm, amazon-ecs-agent, envoy-gateway-fips, k3s, kubescape-server, syft, newrelic-infrastructure-agent, kubescape, tigera-operator, spegel-fips, upwind-agent, linkerd2-fips,...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: skaffold-fips, spegel, kgateway-fips, helmfile, k9s, helm, packer, chartmuseum-fips, rancher-helm, amazon-ecs-agent, envoy-gateway-fips, k3s, kubescape-server, syft, newrelic-infrastructure-agent, kubescape, tigera-operator, spegel-fips, linkerd2-fips, helm-fips,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: skaffold-fips, spegel, kgateway-fips, helmfile, k9s, helm, packer, chartmuseum-fips, rancher-helm, amazon-ecs-agent, envoy-gateway-fips, k3s, kubescape-server, syft, newrelic-infrastructure-agent, kubescape, tigera-operator, spegel-fips, upwind-agent, linkerd2-fips,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: skaffold-fips, spegel, kgateway-fips, helmfile, k9s, helm, packer, chartmuseum-fips, rancher-helm, amazon-ecs-agent, envoy-gateway-fips, k3s, kubescape-server, syft, newrelic-infrastructure-agent, kubescape, tigera-operator, spegel-fips, linkerd2-fips, helm-fips,...

docker-stable-24.0.9_ce-18.1 on GA media (moderate)

docker-stable-24.0.9ce-18.1 on GA media Announcement ID: openSUSE-SU-2026:11075-1 Rating: moderate Cross-References: CVE-2026-33186 CVE-2026-33747 CVE-2026-33748 CVE-2026-33814 CVE-2026-33997 CVE-2026-34040 CVE-2026-39821 CVE-2026-41567 CVSS scores: CVE-2026-33186 SUSE : 8.1...

PYSEC-2026-227

vLLM is an inference and serving engine for large language models LLMs. Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index flashinfer.ai/whl/ using --extra-index-url, but the...

CVE-2026-54232

vLLM is an inference and serving engine for large language models LLMs. Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index flashinfer.ai/whl/ using --extra-index-url, but the...

CVE-2026-54232 vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile

vLLM is an inference and serving engine for large language models LLMs. Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index flashinfer.ai/whl/ using --extra-index-url, but the...

CVE-2026-54232

vLLM prior to 0.22.1 is affected by a dependency confusion flaw in its Dockerfile. The vulnerability arises from installing flashinfer-jit-cache from a private index (flashinfer.ai/whl/) via --extra-index-url while the package name was not registered on PyPI and UV_INDEX_STRATEGY is set to unsafe...

GHSA-XJVP-4FHW-GC47 runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

Impact When setting up the container rootfs, setupPtmx and setupDevSymlinks call os.Remove and os.Symlink with a filepath.Join string which allow an image with /dev as a symlink to trick runc into deleting files called ptmx on the host or creating a hardcoded set of symlinks with specific names a...

GHSA-WF69-R4MX-43RR AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration

Vulnerability Details CWE: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory The official docker-compose.yml line 61 mounts the entire project root directory as the Apache document root: yaml volumes: - "./:/var/www/html/AVideo" This causes the .env file —...