CVE-2026-46386

OpenProject’s official docker image ships SECRET_KEY_BASE=OVERWRITE_ME and cookies_serializer = :marshal, creating a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader. This enables potential pre-authentication remote code execution, as noted in the ...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

vuln-scanner-agent

vuln-scanner-agent A multi-agent vulnerability scanner for Gi...

CVE-2026-54232

A flaw was found in vLLM, an inference and serving engine for large language models LLMs. This vulnerability, a dependency confusion attack, allows a remote attacker to execute arbitrary code with root privileges during the Docker build process. By exploiting this, an attacker can compromise the...

GHSA-5JMJ-H7XM-6Q6V vulnerabilities

Vulnerabilities for packages: s3proxy, apache-tika, nextflow, solr-fips, solr, apicurio-registry, keycloak, keycloak-fips, pinot-fips, zookeeper, airflow, geoserver, infinispan, knative-kafka-broker, opensearch-fips, ontop, airbyte-server, ontop-fips, logstash-fips, elasticsearch, reposilite, hon...

CVE-2026-54515 vulnerabilities

Vulnerabilities for packages: s3proxy, apache-tika, nextflow, solr-fips, solr, apicurio-registry, keycloak, keycloak-fips, pinot-fips, zookeeper, airflow, geoserver, infinispan, knative-kafka-broker, opensearch-fips, ontop, airbyte-server, ontop-fips, logstash-fips, elasticsearch, reposilite, hon...

CVE-2026-54515 vulnerabilities

Vulnerabilities for packages: kafka, apache-nifi-registry, thingsboard, druid, flyway, apache-tika, wildfly, cassandra-reaper, zipkin, nextflow, dependency-track, solr, apicurio-registry, celeborn, sonarqube, keycloak, ruby3.4-jrjackson, ruby4.0-jrjackson, spdx-tools-java, akhq, gradle, spark,...

GHSA-5JMJ-H7XM-6Q6V vulnerabilities

Vulnerabilities for packages: kafka, apache-nifi-registry, thingsboard, druid, flyway, apache-tika, wildfly, cassandra-reaper, zipkin, nextflow, dependency-track, solr, apicurio-registry, celeborn, sonarqube, keycloak, ruby3.4-jrjackson, ruby4.0-jrjackson, spdx-tools-java, akhq, gradle, spark,...

SUSE SLES15 Security Update : podman (SUSE-SU-2026:2597-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2597-1 advisory. This update for podman rebuilds it against the current go security release. Tenable has extracted the preceding description block directly...

SUSE SLES15: docker-stable / docker-stable-bash-completion / etc (SUSE-SU-2026:2579-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2579-1 advisory. - CVE-2026-33997: Fixed privilege validation bypass during plugin bsc1265907. - CVE-2026-34040: Fixed Authz zero length regression...

Fedora 43 : docker-buildx (2026-3cca6f41d4)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3cca6f41d4 advisory. - Update to release v0.35.0 - Resolves: rhbz2487819 - Resolves CVE-2026-39828: rhbz2489918, rhbz2490102 - Upstream enhancements, new features, and...

SUSE SLES12 Security Update : docker-stable (SUSE-SU-2026:2578-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2578-1 advisory. This update for docker-stable fixes the following issues - CVE-2026-33747: github.com/moby/buildkit: malicious frontends can craft API messages...

Fedora 43 : docker-buildkit (2026-1a714d39b0)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1a714d39b0 advisory. - Update to release v0.31.0 - Resolve CVE-2026-39829: rhbz2489939, rhbz2490056 - Upstream new features and fixes Tenable has extracted the preceding...

Fedora 44 : docker-buildkit (2026-1e00728616)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1e00728616 advisory. - Update to release v0.31.0 - Resolve CVE-2026-39829: rhbz2489939, rhbz2490056 - Upstream new features and fixes Tenable has extracted the preceding...

ROS-20260626-73-0017

The vulnerability of the Swarm Mode mode of the dockerd daemon, a software tool for creating containerized systems like Moby and the Mirantis Container Runtime environment, is related to the use of an unprotected alternative channel. Exploiting this vulnerability allows an attacker to compromise...

CVE-2026-53576: Improper Control of Generation of Code

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

PT-2026-52984

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.21 Description The authentication filter for the REST API @Filter"/api/v1/" incorrectly treats any request path ending in /configs as a public instance-config endpoint, allowing...

Fedora 44 : docker-buildx (2026-105f7df940)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-105f7df940 advisory. - Update to release v0.35.0 - Resolves: rhbz2487819 - Resolves CVE-2026-39828: rhbz2489918, rhbz2490102 - Upstream enhancements, new features, and...

GO-2026-5639 Portainer missing authorization on Docker plugin endpoints, which allows host RCE in github.com/portainer/portainer

Portainer missing authorization on Docker plugin endpoints, which allows host RCE in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2026-5746 Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker

The Docker daemon's implementation of the "PUT /containers/id/archive" endpoint executes a container binary on the host when extracting an archive to a container. On Unix-like systems, this can be exploited if an attacker can control the container's filesystem or the archive being extracted,...