184 matches found
Incus Privilege Escalation
The vulnerability of the container management system and the virtual machine manager Incus is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers operating remotely to enhance their privileges...
Container management system Template Creation Code Execution
The vulnerability of the container management system and the virtual machine manager Incus is related to the failure to take measures to neutralize special elements in the template creation mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Incus Symbolic Link Privilege Escalation
The vulnerability of the container management system and the virtual machine manager Incus relates to the tracking of symbolic links. Exploiting this vulnerability can allow attackers to enhance their privileges...
Incus Path Traversal Unauthorized Access
The vulnerability of the container management system and the virtual machine manager Incus is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...
LXD Container Management System Arbitrary Command Execution
The vulnerability of the LXD container management system is related to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
CVE-2026-42454
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, all Docker container management endpoints in Termix interpolate the containerId URL path parameter and WebSocket message field directly into shell commands execute...
CVE-2026-42454
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, all Docker container management endpoints in Termix interpolate the containerId URL path parameter and WebSocket message field directly into shell commands execute...
Termix operating system command injection vulnerability
Termix is a server management platform developed by Karmaa’s individual developers. Versions of Termix prior to 2.1.0 contained a vulnerability related to operating system command injection. This vulnerability stemmed from the Docker container management endpoint not properly cleaning or verifyin...
CVE-2026-40242: Server-Side Request Forgery (SSRF)
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation...
CVE-2026-39848: Missing Authentication for Critical Function
Dockyard is a Docker container management app. Prior to 1.1.0, Docker container start and stop operations are performed through GET requests without CSRF protection. A remote attacker can cause a logged-in administrator's browser to request /apps/action.php?action=stop&name= or...
SUSE SLES15 Security Update : container-suseconnect (SUSE-SU-2026:0909-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0909-1 advisory. This update for container-suseconnect rebuilds it against the current go 1.25 security release. Tenable has extracted the preceding...
CVE-2026-30824
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...
CVE-2026-30824
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...
CVE-2026-30824: Missing Authentication for Critical Function
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...
Flowise Access Control Vulnerability
Flowise is an open-source tool developed by FlowiseAI, designed for easily building LLM applications. Prior versions of Flowise 3.0.13 contained an access control vulnerability. This vulnerability stemmed from the inclusion of NVIDIA NIM routers in the global authentication middleware whitelist,...
Incus Path Traversal Command Execution
The vulnerability of the container management system and the virtual machine manager Incus is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
Container management system CRLF Command Execution
The vulnerability of the container management system and the virtual machine manager Incus is related to the failure to take measures to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
CVE-2026-23953 Incus container environment configuration newline injection
Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration e.g a member of the ‘incus’ group can create an environment variable containing newlines, which can be used to add additional...
