1301 matches found
CVE-2026-85391
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...
CVE-2026-85391 Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...
django-DefectDojo v3.2.400
DefectDojo | ---|--- DefectDojo is a DevSecOps, ASPM application security posture management, and vulnerability management tool. DefectDojo orchestrates end-to-end security testing, vulnerability tracking, deduplication, remediation, and reporting. Demo Pro Edition: pro.demo.defectdojo.com OWASP...
AZL-99207 CVE-2026-78662 affecting package docker-compose for versions less than 2.27.0-14
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...
AZL-99210 CVE-2026-56855 affecting package docker-compose for versions less than 2.27.0-14
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...
EUVD-2026-63905
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name...
CVE-2026-77776: Authorization Bypass Through User-Controlled Key
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name...
Project-Ronin
Project Ronin Documentation Hub Welcome to the technical doc...
django-DefectDojo v3.2.201
DefectDojo | ---|--- DefectDojo is a DevSecOps, ASPM application security posture management, and vulnerability management tool. DefectDojo orchestrates end-to-end security testing, vulnerability tracking, deduplication, remediation, and reporting. Demo Pro Edition: pro.demo.defectdojo.com OWASP...
ANT-2026-6FH6D5TF · supabase/supabase · other
other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-6FH6D5TF: Hardcoded Realtime tenant-credential encryption key with no override In docker/docker-compose.yml the...
aquila-graph-poc
Aquila Graph POC A reproducible proof of concept for combinin...
GO-2025-3527 vulnerabilities
Vulnerabilities for packages: docker-compose, docker-compose-fips, kubescape...
GO-2025-3699 vulnerabilities
Vulnerabilities for packages: docker-compose-fips, docker-compose, neuvector, neuvector-scanner, neuvector-fips...
GO-2026-4859 vulnerabilities
Vulnerabilities for packages: docker-compose, kubescape, cloudbeat, kubescape-server, conftest, skaffold, buildah, trivy-operator, zot, conftest-fips, kaniko, livekit-cli, docker-fips, cloudbeat-fips, skaffold-fips, podman, docker-cli-buildx, trivy-operator-fips, osv-scanner, guac,...
GO-2025-3900 vulnerabilities
Vulnerabilities for packages: istio-fips, grafana-fips, kyverno-notation-aws-fips, ratify-fips, tkn-fips, beats, k9s-fips, rancher-security-scan, zitadel, jitsucom-bulker, bank-vaults, mattermost-fips, grafana, docker-compose-fips, kyverno, neuvector-sigstore-interface-fips, pluto-fips, beats-fip...
GO-2023-2331 vulnerabilities
Vulnerabilities for packages: docker-compose, kubescape, buildkitd, metrics-server, prometheus-adapter, temporal, aws-ebs-csi-driver, k3s, cri-tools, kubernetes, kubevela, temporal-fips, kubernetes-csi-external-resizer, envoy-ratelimit, kube-oidc-proxy, prometheus-adapter-fips,...
GO-2025-3527 vulnerabilities
Vulnerabilities for packages: docker-compose, kubescape...
GO-2025-3699 vulnerabilities
Vulnerabilities for packages: docker-compose, neuvector-scanner...