ConMachi

Сканер контейнеров Conmachi Плохо ли подбирать capabilities в контейнере? Conmachi — это инструмент, написанный на Golang и предназначенный для сбора информации об окружении контейнера и выявления потенциальных проблем безопасности. Его можно статически скомпилировать, чтобы затем поместить в...

trivy-plugin-kubectl

trivy-plugin-kubectl Плагин Trivy, который сканирует образы ресурса Kubernetes Установка $ trivy plugin install github.com/aquasecurity/trivy-plugin-kubectl $ trivy kubectl -h Usage: trivy kubectl -h,--help TYPE NAME TRIVY OPTION A Trivy plugin that scans the images of a kubernetes resource...

EUVD-2026-75802

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container...

CVE-2026-75777 Multiple vulnerabilities in IBM Aspera Enterprise Webapps

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container...

DEBIAN-CVE-2026-88264

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations...

CVE-2026-88264 Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations...

CVE-2026-87053

A flaw was found in operator-sdk-builder. Due to an oversight in the Containerfile configuration, the final built container image runs with root privileges by default. This increases the attack surface of the container, as any process executed within it will have elevated permissions. If a...

A Bootiful Podcast: BellSoft's Catherine Edelveis on hardened runtime images, container security, and more

Hi, Spring fans! I chat with BellSoft’s Catherine Edelweiss about using buildpacks and hardened images to ship Spring Boot apps with stronger security, cleaner defaults, and far less Dockerfile pain. BellSoft Docker Java JRE SpringBoot...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

CVE-2026-61711

A flaw was found in BuildKit. A custom frontend could craft a build request with an invalid security mode, leading to the disabling of Seccomp and AppArmor protections for the build container. This bypasses the intended sandbox mechanisms, potentially allowing for broader impact within the...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

CVE-2026-62313

Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of restricted.containers.privilege=isolated can be trivially bypassed, allowing a user to create a non-isolated shared host idmap container in a project that is configured to forbid them. Th...

BuildKit: Custom frontend could bypass Seccomp/AppArmor

Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers...

CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

Security update for podman

This update for podman fixes the following issues: CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership modification on the host filesystem bsc1268579. CVE-2026-57231: specially crafted image can trick podman run into leakin...

GHSA-PRG7-HCFM-MFCR vulnerabilities

Vulnerabilities for packages: datahub-ingestion, openstack-glance-2025.1, openstack-horizon-2026.1-fips, openstack-horizon-2026.1, datahub-ingestion-fips, openstack-keystone-2025.1, airflow, openstack-horizon-2025.2, mlflow, mycli, openstack-horizon-2025.1-fips, openstack-keystone-2025.2-fips,...

SUSE-SU-2026:23205-1 Security update for podman

This update for podman fixes the following issues: - CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability bsc1268579. - CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container bsc1269471...

GHSA-HQVF-45JJ-MCCQ vulnerabilities

Vulnerabilities for packages: localstack...

GHSA-76P8-FHRM-VPC7 vulnerabilities

Vulnerabilities for packages: plutono-fips, longhorn-cli, crossplane-provider-aws-route53recoverycontrolconfig, ld-relay-fips, dns-controller-manager-fips, kubernetes-event-exporter, redpanda-console, metrics-server, rancher-webhook-fips, cert-manager-cmctl, newrelic-k8s-metrics-adapter,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: grafana-mimir, git-lfs, gitness, karma, istio, harbor-registry, s5cmd, sonobuoy, hydra, nsc, keda, traefik, authservice, ollama, otel-cli, grafana, osv-scanner, cert-manager, buildkitd, skaffold, mattermost, nri-elasticsearch, cluster-api-azure-controller, deschedule...