CVE-2026-13622 Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

CVE-2026-54465 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce...

USN-8635-1: Linux kernel (Azure) vulnerabilities

Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate attacker could use this issue to inject packets. CVE-2025-275...

GHSA-FWG2-594C-JP42 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-FP3F-MC75-235C vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-73218

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...

CVE-2026-61632 vulnerabilities

Vulnerabilities for packages: open-webui...

PT-2026-70252

Name of the Vulnerable Software and Affected Versions Docker affected versions not specified Description An issue known as CopyEscape allows for an arbitrary file write from a container to the host system. This occurs through the use of the docker cp command, which can be leveraged to write files...

CVE-2026-18620

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount SA during a CreateRun request, an attacker can bypass authorization checks. This...

CVE-2026-53090 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange, linux-gcp...

CVE-2026-72863

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's WebSocket handlers in-app terminals and log streamers authenticate the session but never authorize it. They establish who the user is via validateRequest and then proceed without consulting the role/permissio...

CVE-2026-72864

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's...

CVE-2026-72863

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's WebSocket handlers in-app terminals and log streamers authenticate the session but never authorize it. They establish who the user is via validateRequest and then proceed without consulting the role/permissio...

Photon OS 5.0: Podman PHSA-2023-5.0-91-0049

An update of the podman package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0049. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Docker PHSA-2026-5.0-91-0869

An update of the docker package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0869. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

USN-8615-2: Linux kernel (Raspberry Pi) vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

USN-8615-2 linux-raspi, linux-raspi-5.4 vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

CVE-2026-18107 Criu: criu: container escape via rseq critical section hijack during checkpoint/restore

A flaw was found in CRIU's handling of restartable sequences rseq during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the...

CVE-2026-18107

CRIU vulnerability CVE-2026-18107 involves how CRIU handles restartable sequences (rseq) during checkpoint/restore. A container-embedded process can register an rseq critical section that hijacks CRIU’s parasite code injection, enabling spoofed credentials saved in the checkpoint image. On restor...

USN-8617-1 linux-kvm vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...