Updated docker-containerd packages fix security vulnerabilities

It was discovered that containerd incorrectly set certain directory path permissions. An attacker could possibly use this issue to achieve unauthorised access to the files. CVE-2024-25621 It was discovered that containerd did not properly handle the execution of the goroutine of container attach...

GHSA-W669-JJ7H-88M9 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

Impact A path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with techdocs.generator.runIn: local. When processing documentation from untrusted sources, symlinks within the docs directory are...

@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

Impact A path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with techdocs.generator.runIn: local. When processing documentation from untrusted sources, symlinks within the docs directory are...

PT-2026-5722

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.1.29 Description A command injection issue exists in the Docker sandbox execution mechanism due to unsafe handling of the PATH environment variable when constructing shell commands. An authenticated user with th...

EulerOS 2.0 SP13 : docker-runc (EulerOS-SA-2026-1220)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 throug...

OpenClaw 操作系统命令注入漏洞

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw there is an operating system command injection vulnerability , the vulnerability stems from the Docker sandbox execution mechanism when constructing shell commands on the PATH environment variable handling insecurity ,...

PT-2026-6421

Summary 1. A hardcoded secret key used for signing JWTs is checked into source code 2. ManyAPI routes do not check authentication Details I am using the publicly available docker image at ghcr.io/maziggy/bambuddy 1. Hardcoded JWT Secret Key...

EulerOS 2.0 SP13 : docker-runc (EulerOS-SA-2026-1208)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 throug...

Exploit for Unrestricted Upload of File with Dangerous Type in Gvectors Wpdiscuz

wpDiscuz-7.0.4-PoC-RCE - wpDiscuz 7.0.4 - Unauthenticated RCE...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: nri-jmx, dynamic-localpv-provisioner, bom, fuse-overlayfs-snapshotter, conjur-cli, minio-object-browser, vertical-pod-autoscaler, gitleaks, restic, crossplane-provider-aws-s3, kubelet-csr-approver, sftpgo-plugin-geoipfilter, pvc-autoresizer, wave, grafana-operator,...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: go-md2man, bom, helm-docs, conjur-cli, restic, src-fingerprint, temporal-ui-server, linkerd2-proxy-init, falcosidekick, terraform-docs, kubernetes-dns-node-cache, docker-machine-driver-linode, crossplane-provider-aws-firehose, k8sgateway, kubeflow, ghaudit, kustomize...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: go-md2man, bom, helm-docs, conjur-cli, restic, src-fingerprint, temporal-ui-server, linkerd2-proxy-init, falcosidekick, terraform-docs, kubernetes-dns-node-cache, docker-machine-driver-linode, crossplane-provider-aws-firehose, k8sgateway, kubeflow, ghaudit, kustomize...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, bom, fuse-overlayfs-snapshotter, conjur-cli, minio-object-browser, vertical-pod-autoscaler, gitleaks, restic, crossplane-provider-aws-s3, kubelet-csr-approver, sftpgo-plugin-geoipfilter, pvc-autoresizer, wave, grafana-operator, spegel,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: go-md2man, bom, helm-docs, conjur-cli, restic, src-fingerprint, temporal-ui-server, linkerd2-proxy-init, falcosidekick, terraform-docs, kubernetes-dns-node-cache, docker-machine-driver-linode, crossplane-provider-aws-firehose, k8sgateway, kubeflow, ghaudit, kustomize...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: nri-jmx, dynamic-localpv-provisioner, bom, fuse-overlayfs-snapshotter, conjur-cli, minio-object-browser, vertical-pod-autoscaler, gitleaks, restic, crossplane-provider-aws-s3, kubelet-csr-approver, sftpgo-plugin-geoipfilter, pvc-autoresizer, wave, grafana-operator,...

CVE-2026-25116

Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the UserConfigController allows any remote user to overwrite the system's docker-compose.yml configuration file. By exploiting insecure URN...

Directory Traversal

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Directory Traversal via the TechdocsGenerator function when processing documentation from...

CVE-2026-25152

The CVE-2026-25152 entry concerns the Backstage @backstage/plugin-techdocs-node, where versions before 1.13.11 and 1.14.1 allow path traversal via the TechDocs local generator when techdocs.generator.runIn is set to local. This permits reading arbitrary host files as MkDocs follows symlinks in do...

CVE-2026-25152 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allow...

Arbitrary Code Injection

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Arbitrary Code Injection via the processing of MkDocs hooks, when TechDocs is configured wit...