1253 matches found
ALPINE-CVE-2026-0864
When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters \r the resulting file could be injected with unexpected keys and values if the attacker controls the written value...
ALPINE-CVE-2026-56409
xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used...
ALPINE-CVE-2026-56410
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId...
ALPINE-CVE-2026-56403
libexpat before 2.8.2 has an integer overflow in storeAtts...
Dirty-cow-exploit
System Documentation Architecture - Frontend: React 19...
ROOT-OS-ALPINE-323-CVE-2026-49975 CVE-2026-49975 in rootio-apache2 - Patched by Root
Root has patched CVE-2026-49975 in the rootio-apache2 package for Root:Alpine:3.23. Multiple fixed versions available...
ALPINE-CVE-2026-3276
unicodedata.normalize can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms...
CVE-2026-42575
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...
ALPINE-CVE-2026-4873
A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text via IMAP, SMTP, or POP3, a subsequent request to that same host bypasses the TLS requirement and instead transm...
CVE-2026-42574 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...
apko 路径遍历漏洞
Apko is an open-source OCI image builder based on APK. In versions 0.14.8 to 1.2.5 of Apko, there was a path traversal vulnerability. This vulnerability occurred because specially crafted APK packages could install entries that pointed to directories other than the build root directory. This...
Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain
Cybersecurity researchers have warned of malicious images pushed to the official "checkmarx/kics" Docker Hub repository. In an alert published today, software supply chain security company Socket revealed that unknown threat actors managed to have overwritten existing tags, including v2.1.20 and...
ALPINE-CVE-2026-4786
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open" API could have commands injected into the underlying shell. See CVE-2026-4519 for details...
ALPINE-CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
ALPINE-CVE-2026-25835
Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator PRNG...
ALPINE-CVE-2026-25834
Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade...
ROOT-OS-ALPINE-322-CVE-2025-32989 CVE-2025-32989 in rootio-gnutls - Patched by Root
Root has patched CVE-2025-32989 in the rootio-gnutls package for Root:Alpine:3.22. Multiple fixed versions available...
ROOT-OS-ALPINE-322-CVE-2025-9820 CVE-2025-9820 in rootio-gnutls - Patched by Root
Root has patched CVE-2025-9820 in the rootio-gnutls package for Root:Alpine:3.22. Multiple fixed versions available...