CVE-2026-22908

Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality...

RHSA-2026:0315 Red Hat Security Advisory: OpenShift Container Platform 4.12.84 packages and security update

Bulletin has no description...

Moderate: Red Hat Security Advisory: Red Hat Update Infrastructure 5 security update

The latest release of Red Hat Update Infrastructure. For more details, see the product documentation. Red Hat Update Infrastructure RHUI container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images. This release updates to the latest version...

RLSA-2026:0437 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

Moderate: Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.8.4

Assisted installer RHEL 9 components for the multicluster engine for Kubernetes 2.8.4 General Availability release, with updates to container images. Assisted Installer RHEL 9 integrates components for the general multicluster engine for Kubernetes 2.8.4 release that simplify the process of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.84 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.84 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects

A flaw was found in runc. This attack is a more sophisticated variant of CVE-2019-16884, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process...

runc: container escape via 'masked path' abuse due to mount race conditions

A flaw was found in runc. This flaw exploits an issue with how masked paths are implementedin runc. When masking files, runc will bind-mount the container's /dev/null inode on top of the file. However, if an attacker can replace /dev/null with a symlink to some other procfs file, runc will instea...

runc: container escape with malicious config due to /dev/console mount and related races

A flaw was found in runc. CVE-2025-52565 is very similar in concept and application toCVE-2025-31133, except that it exploits a flaw in /dev/console bind-mounts. When creating the /dev/console bind-mount to /dev/pts/$n, if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.84 packages and security update

Red Hat OpenShift Container Platform release 4.12.84 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

SICK TDC-X401GL has security vulnerabilities

The SICK TDC-X401GL is a edge computing gateway developed by the German company SICK. The SICK TDC-X401GL has a security vulnerability, which stems from the upload of unverified container images. This vulnerability could allow remote attackers to gain full system access...

PT-2026-2989

Name of the Vulnerable Software and Affected Versions versions prior to 2026-22908 Description Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality. Recommendations At the moment, there is n...

EulerOS 2.0 SP12 : docker-runc (EulerOS-SA-2026-1087)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 throug...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003473)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003473 advisory. The IPTSOSETREPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service out-of-bounds...

PT-2026-3097

Name of the Vulnerable Software and Affected Versions Arcane versions prior to 1.13.0 Description Arcane’s updater service allows defining commands to run before or after container updates using lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002583)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002583 advisory. The compat IPTSOSETREPLACE and IP6TSOSETREPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain...

EulerOS 2.0 SP12 : docker-runc (EulerOS-SA-2026-1067)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 throug...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003016)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003016 advisory. The IPTSOSETREPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service out-of-bounds...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003368)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003368 advisory. The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service syste...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003458)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003458 advisory. The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service syste...