bento

이 소프트웨어는 실험적이지만 제안과 기여를 환영합니다 PT 및 CTF를 위한 Bento 툴킷 벤토弁当, bentō는 일본에서 유래한 일회용 포장 또는 집에서 싸온 식사입니다. Bento Toolkit은 침투 테스터와 CTF 플레이어를 위한 간단하고 최소한의 Docker 컨테이너입니다. X가 추가된 Docker의 이식성을 제공하므로 GUI 애플리케이션예: burp도 실행할 수 있습니다. 사전 요구 사항 bento를 실행하려면 호스트 머신에 Docker와 Xorg 서버가 필요합니다. Windows에서는 vcxsrv, xming,...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: gitea, bento-fips, seaweedfs-operator-fips, kitty, rclone, mattermost-fips, rclone-fips, mattermost, ollama, ollama-fips, bento, kubescape, pdfcpu, kubescape-server, fortio-fips, seaweedfs-fips, mailpit, fortio, gitea-fips, nemo, seaweedfs, mailpit-fips,...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: bento, pdfcpu, kitty, rclone, gitea, mailpit, seaweedfs, mattermost, kubescape, ollama...

CVE-2026-46603 vulnerabilities

Vulnerabilities for packages: bento, pdfcpu, kitty, rclone, gitea, mailpit, seaweedfs, mattermost, kubescape, ollama...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: grafana-alloy, bento-fips, steampipe, splunk-otel-collector, kots, telegraf, bento, splunk-otel-collector-fips, teleport, grafana-alloy-fips...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: bento-fips, kubernetes-event-exporter, atlantis, kyverno-policy-reporter-fips, argo-events-fips, goreleaser, argo-cd, argo-events, argo-cd-fips, ory-kratos, atlantis-fips, bento, kubewatch, peerdb-flow, argo-rollouts, ory-kratos-fips, argo-rollouts-fips,...

GO-2025-4173 vulnerabilities

Vulnerabilities for packages: agentbeat, elastic-agent-fips, zabbix-agent2, falcosidekick-fips, telegraf, zabbix-agent2-fips, minio-fips, beats, beats-fips, bento, elastic-agent, influxd, agentbeat-fips, dapr, falcosidekick, minio, dapr-fips...

GO-2025-4173 vulnerabilities

Vulnerabilities for packages: bento, falcosidekick, minio...

GO-2026-5061 vulnerabilities

Vulnerabilities for packages: bento, pdfcpu, rclone, gitea, mailpit, seaweedfs, mattermost, kubescape, ollama...

GO-2026-4961 vulnerabilities

Vulnerabilities for packages: bento, pdfcpu, rclone, gitea, seaweedfs, mattermost, kubescape, ollama...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: kots, bento, grafana-alloy, splunk-otel-collector, telegraf, steampipe...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: argo-rollouts, argo-events, bento, goreleaser, atlantis, kubernetes-event-exporter, argo-cd, kubewatch, kyverno-policy-reporter...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: argo-events, sqlexporter, bento, grafana-alloy, amazon-cloudwatch-agent, jitsucom-bulker, splunk-otel-collector, cluster-api-aws-controller, opentelemetry-collector-contrib...

Exploit for Deserialization of Untrusted Data in Bentoml

CVE-2025-27520 exploit for CVE-2025-27520 A Remote Code Execut...

PYSEC-2026-1218 BentoML has a Path Traversal via Bentofile Configuration

Summary BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate, conda.environmentyml. An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files fr...

BentoML SSRF Vulnerability in File Upload Processing

DescriptionThere's an SSRF in the file upload processing system that allows remote attackers to make arbitrary HTTP requests from the server without authentication. The vulnerability exists in the serialization/deserialization handlers for multipart form data and JSON requests, which automaticall...

CVE-2026-41653

BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site scripting vulnerability was identified in BentoPD. An attacker may be able to execute arbitrary JavaScript in certain circumstances in Markdown to PDF Tool. This issue has been patched in version 2.8...

PYSEC-2026-189

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/internal/container/frontend/dockerfile/templates/basev2.j2 interpolates docker.baseimage raw with no escaping, newline filtering, or validation. A malicious...

PYSEC-2026-190

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs.name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentom...

CVE-2026-44345 BentoML: Dockerfile command injection via docker.base_image

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/internal/container/frontend/dockerfile/templates/basev2.j2 interpolates docker.baseimage raw with no escaping, newline filtering, or validation. A malicious...