vex8s

Vex8s このロゴはAI生成ではありません Vex8sは、コンテナの脆弱性とKubernetesの設定を関連付けることでVEXドキュメントを生成し、クラスタ内で実際に悪用可能なCVEを特定します。 これは実験的なプロジェクトであることにご注意ください。状況は急速に変化する可能性があります。 仕組み このプロジェクトは、脆弱性の分類とsecurityContext分析を組み合わせることで、Kubernetesワークロード内の既知のCVEの悪用可能性を評価することを目的としています。 これは以下のコンセプトに基づいています: 各CVEは1つ以上の脆弱性クラスCWEに分類されます...

clair

Clair 注意 : main ブランチは開発中に 不安定または壊れた状態 になる可能性があります。安定したバイナリを入手するには、main ブランチの代わりに releases を使用してください。 Clair は、アプリケーションコンテナ（現在は OCI と docker を含む）の脆弱性の 静的解析 のためのオープンソースプロジェクトです。 クライアントは Clair API を使用してコンテナイメージをインデックス化し、既知の脆弱性と照合できます。...

cve-2019-9194

CVE-2019-9194 これはCvedの一部です： 脆弱なDockerコンテナを管理するためのツールです。 Cved: https://github.com/git-rep-src/cved イメージソース: https://github.com/cved-sources/cve-2019-9194 イメージ作者: https://github.com/cved-sources/cve-2019-9194...

cve-2024-3094

CVE-2024-3094 の検出方法 Trend MicroのVision One TMAS（CLI）を使用して、コンテナ内のCVE-2024-3094（通称XZバックドア）を検出する手順を順を追って説明します。この脆弱性はコンテナ環境に重大なリスクをもたらしますが、適切なツールと手順を用いることで、これらの脅威を効果的に特定し軽減できます。早速始めましょう。 必要条件 Vision One アカウントをお持ちであること。まだの場合は無料トライアルに今すぐサインアップしてください。 Vision OneでRun artifact scan...

aws-perimeter

aws-perimeter ターミナルベースのAWSセキュリティスキャナ 。100以上のセキュリティチェック をVPC、IAM、S3、CloudTrail、コンテナ（ECS/EKS）、AI攻撃検出にわたって実行。危険なIAM権限、露出したシークレット、誤設定されたS3バケット、コンテナの脆弱性、そして新興のLLMjacking脅威を検出します。 製品概要: docs/CAPABILITIESOVERVIEW.md 機能 🔐 VPCセキュリティ セキュリティグループ分析（開放されたSSH/RDP、データベースポート） パブリック公開検出と管理ポートリスク...

CVE-2026-15788 WCOW cache mount source selector resolves NTFS junctions outside of cache root

BuildKit's cache mount source= selector on Windows Container on Windows WCOW workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon...

CVE-2026-55686

Summary of CVE-2026-55686 (Podman: WORKDIR symlink traversal) Affects Podman versions 3.0.0 through 5.7.0 where a container image run with a crafted WORKDIR path that contains a symlink can cause a host filesystem change: create a directory or modify ownership. Ownership modification is less like...

CVE-2026-47846

Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is configured via the CASSANDRAUSER environment variable, the container initialization script creates the new superuser account but fails to drop the built-in cassand...

GHSA-RG2X-37C3-W2RH Docker: Race condition in docker cp allows bind mount redirection to host path

Summary A race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. Details When copying files into a container, the daemon sets up a temporary filesystem vie...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationRuntime and IntegrationServer operands that use Kafka connectors are vulnerable to loss of confidentiality (CVE-2025-12183, CVE-2025-66566)

Summary Java module lz4 is used by IBM App Connect Enterprise Certified Container when connecting to Kafka servers. IBM App Connect Enterprise Certified Container IntegrationRuntime and IntegrationServer operands that use Kafka connectors are vulnerable to loss of confidentiality. This bulletin...

LXC 安全漏洞

LXC is an open-source low-level Linux container runtime that has been extensively tested. LXC has a security vulnerability, which stems from a logical flaw in the deletion path of the findline function within the setuid helper program lxc-user-nic. This flaw allows non-privileged users to delete...

CVE-2026-41686

The CVE-2026-41686 entry concerns the Claude SDK for TypeScript, where the BetaLocalFilesystemMemoryTool from Anthropic’s TypeScript SDK (versions 0.79.0 through before 0.91.1) created memory files with default Node.js modes (files 0o666, dirs 0o777). This caused world-readable files on normal um...

ROS-20260420-73-0032

Vulnerability in lxd is related to failure to take measures to neutralize special elements used in operating system commands. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary commands...

Security Bulletin: Security vulnerability has been detected in IBM Security Verify Directory (Container) (CVE-2025-36074)

Summary Security vulnerability has been addressed in IBM Security Verify Directory Container Vulnerability Details CVEID:CVE-2025-36074 DESCRIPTION: IBM Security Verify Directory could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious fil...

CVE-2026-1342

Summary: CVE-2026-1342 affects IBM Verify Identity Access Container 11.0–11.0.2, IBM Security Verify Access Container 10.0–10.0.9.1, IBM Verify Identity Access 11.0–11.0.2, and IBM Security Verify Access 10.0–10.0.9.1. A locally authenticated user could execute malicious scripts outside of the ap...

Incus has an abitrary file write through its systemd-creds options

Summary Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. An attacker can use the name of a systemd credential to escape that directory and overwrite arbitrary files on the host system. This can in turn be us...

EUVD-2025-208964

NVIDIA SNAP-4 Container contains a vulnerability in the VIRTIO-BLK component where a malicious guest VM may cause use of out-of-range pointer offset by sending crafted messages. A successful exploit of this vulnerability may lead to a denial of service of the DPA and impact the availability of...

CVE-2025-33215

NVIDIA SNAP-4 Container contains a vulnerability in the VIRTIO-BLK component where a malicious guest VM may cause use of out-of-range pointer offset by sending crafted messages. A successful exploit of this vulnerability may lead to a denial of service of the DPA and impact the availability of...

XML external entity injection vulnerability in IBM Business Automation Workflow containers and IBM Business Automation Workflow traditional

IBM Business Automation Workflow is a suite of workflow automation solutions from International Business Machines IBM. The product is primarily used for workflow management, compliance management, and features workflow visibility and scalability. IBM Business Automation Workflow containers V25.0....

PT-2026-6556

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise Certified Container versions up to 12.19.0 Continuous Delivery IBM App Connect Enterprise Certified Container version 12.0 LTS Long Term Support Description The software may allow an attacker to access sensitive file...