grype v0.119.0

Grype A vulnerability scanner for container images and filesystems. Features Scan container images , filesystems , and SBOMs for known vulnerabilities see the docs for a full list of supported scan targets Supports major OS package ecosystems Alpine, Debian, Ubuntu, RHEL, Oracle Linux, Amazon...

GHSA-QG2G-G9W3-M5H8 ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

Summary A containerized MCP server running with the default network permission profile insecureallowall: true can reach host-local services via host.docker.internal. This includes the ToolHive API itself, other ToolHive-managed MCP server proxies, and any other service listening on the host's...

CVE-2026-75031

In the interchange/interchange project, a critical remote code execution RCE vulnerability was found in the “quick question” admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated users. The Perl code normally runs within a Safe...

RUSTSEC-2026-0294 Unsoundness in UTF-8 'String' trait

The String API in iceoryx2-bb-container exposes its contents as mutable bytes through safe APIs, while String::asstr converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust...

iceoryx2 (>=0.0.4, <=0.3.0), iceoryx2-bb-lock-free (>=0.0.4, <=0.3.0) +6 more potentially affected by CVE-2026-92612 via iceoryx2-bb-container (>=0.0.3, <=0.3.0)

iceoryx2-bb-container CARGO version =0.0.3, =0.0.4, =0.0.4, =0.0.4, =0.0.3, =0.0.3, =0.0.4, =0.0.4, =0.0.4, =0.3.0 Source cves: CVE-2026-92612 Source advisory: OSV:RUSTSEC-2026-0294...

Unsoundness in UTF-8 'String' trait

The String API in iceoryx2-bb-container exposes its contents as mutable bytes through safe APIs, while String::asstr converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust...

CLEANSTART-2026-UZ56675 Security fix for CVE-2025-47907 applied in: argo-workflows-fips 3.7.0-r0, cert-manager-webhook-pdns-fips 3.0.0-r0, cert-manager-webhook-pdns-fips 3.1.3-r0, cert-manager-webhook-pdns-fips 3.2.3-r0, consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.1-r0, consul-k8s-fips 1.8.6-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dex-fips 2.40.0-r3, dex-fips 2.41.1-r3, dex-fips 2.42.1-r3, dex-fips 2.43.1-r3, druid-exporter-fips 0.10-r0, druid-exporter-fips 0.11-r1, fluent-operator-fips 3.1.0-r3, flux-notification-controller-fips 1.5.0-r0, gomplate 4.3.3-r0, gomplate-fips 4.3.3-r0, gosu 1.17-r5, harbor-fips 2.10.3-r0, harbor-fips 2.11.2-r3, harbor-fips 2.12.4-r1, harbor-fips 2.13.2-r1, harbor-registry 3.0.0.1-r2, k8ssandra-operator-fips 1.24.0-r0, k8ssandra-operator-fips 3.3.0-r3, kubernetes-csi-node-driver-registrar 2.13.0-r0, kyverno-fips 1.11.5-r6, kyverno-fips 1.12.7-r5, kyverno-fips 1.14.4-r1, kyverno-policy-reporter-fips 3.0.7-r5, kyverno-policy-reporter-fips 3.1.3-r6, kyverno-policy-reporter-fips 3.2.2, kyverno-policy-reporter-fips 3.3.2, kyverno-policy-reporter-fips 3.3.2-r0, kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r1, kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r2, kyverno-policy-reporter-kyverno-plugin-fips 1.5.2-r1, kyverno-policy-reporter-kyverno-plugin-fips 1.6.4-r1, metrics-server 0.8.0-r0, metrics-server-fips 0.8.0-r3, minio-client-fips 0.20250416181326-r2, minio-client-fips 0.20250521015954-r2, minio-client-fips 0.20250716.153503-r2, minio-client-fips 0.20250721052808-r2, minio-operator-fips 4.5.8-r3, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r0, opensearch-k8s-operator-fips 2.6.1-r0, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r7, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0, spark-operator 2.2.1-r0

CVE-2025-47907 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZC33521 Security fix for CVE-2025-22873 applied in: cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, nvidia-container-toolkit 1.19.0-r0, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0

CVE-2025-22873 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NT43393 Security fix for CVE-2026-39819 applied in: apko 1.2.2-r1, argo-cd-fips 3.0.23-r1, argo-cd-fips 3.1.14-r1, argo-workflows 4.0.5-r0, aws-eks-pod-identity-agent 0.1.36-r0, aws-eks-pod-identity-agent-fips 0.1.36-r0, aws-privateca-issuer 1.7.0-r0, aws-privateca-issuer-fips 1.7.0-r1, azuredisk-csi-fips 1.33.9-r1, cadvisor-fips 0.55.1-r0, cass-operator-fips 1.30.0-r1, cert-manager 1.20.0-r0, cert-manager 1.20.2-r0, cert-manager-cmctl-fips 2.4.0-r3, cert-manager-webhook-pdns-fips 3.2.3-r2, certificate-transparency-trillian-ctserver 1.3.2-r2, certificate-transparency-trillian-ctserver-fips 1.3.2-r0, confluent-cp-docker-utils 1.0.8-r1, confluent-kafka 8.2.0-r2, cortex 1.21.0-r2, cosign 3.0.6-r1, dex 2.45.1-r2, dex-fips 2.43.1-r5, druid-exporter-fips 0.10-r5, druid-exporter-fips 0.11-r6, druid-exporter-fips 0.9-r4, elastic-beats 8.19.15-r2, external-secrets 2.2.0-r0, external-secrets-fips 0.17.0-r2, external-secrets-fips 2.2.0-r0, fluent-operator-fips 3.4.0-r9, fluent-operator-fips 3.6.0-r5, fluent-operator-fips 3.7.0-r3, flux-notification-controller-fips 1.5.0-r0, gostatsd 28.3.0-r2, helm 4.1.3-r0, helm-fips 4.1.3-r0, helm-operator 1.42.1-r0, helm-operator 1.42.2-r0, helm-operator-fips 1.41.1-r2, istio 1.28.5-r3, istio 1.29.2-r1, istio-fips 1.26.8-r3, istio-fips 1.27.9-r1, istio-fips 1.28.6-r0, istio-pilot-discovery-fips 1.28.3-r1, k8ssandra-client-fips 0.5.0-r11, k8ssandra-client-fips 0.6.4-r9, k8ssandra-client-fips 0.7.0-r7, k8ssandra-operator-fips 1.29.0-r1, karpenter 1.9.0-r1, karpenter-fips 1.9.0-r0, keda 2.19.0-r3, keda-fips 2.18.3-r3, kube-rbac-proxy 0.20.2-r1, kube-rbac-proxy-fips 0.20.2-r1, kube-state-metrics 2.10.1-r1, kube-state-metrics 2.15.0-r1, kube-state-metrics-fips 2.18.0-r1, kubernetes-csi-driver-nfs-fips 4.13.0-r3, kubernetes-csi-external-attacher 4.10.0-r0, kubernetes-csi-external-attacher-fips 4.10.0-r0, kubernetes-csi-external-provisioner-fips 6.1.0-r4, kubernetes-csi-external-resizer 2.0.0-r0, kubernetes-csi-external-resizer-fips 2.0.0-r1, kubernetes-csi-external-resizer-fips 2.1.0-r1, kubernetes-csi-external-snapshotter-fips 8.4.0-r4, kubernetes-csi-node-driver-registrar 2.13.0-r0, kubernetes-csi-node-driver-registrar-fips 2.16.0-r3, kubernetes-dashboard 7.14.0-r1, kubernetes-dashboard-api 1.14.0-r1, kubernetes-dashboard-api-fips 1.14.0-r1, kubernetes-dashboard-auth 1.4.0-r1, kubernetes-dashboard-auth-fips 1.4.0-r2, kubernetes-dashboard-web 1.7.0-r0, kubernetes-fips 1.35.4-r0, kured 1.20.0-r0, kustomize-fips 5.8.1-r0, kyverno-fips 1.16.4-r1, kyverno-fips 1.17.2-r1, kyverno-policy-reporter-fips 3.4.2-r6, kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r11, kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r9, linkerd2 25.12.3-r1, linkerd2 26.4.3-r0, local-static-provisioner 2.8.0-r2, minio-operator-fips 5.0.19-r3, minio-operator-fips 6.0.4-r11, minio-operator-fips 7.1.1-r10, modelmesh-runtime-adapter 0.10.0-r0, modelmesh-runtime-adapter 0.11.2-r0, modelmesh-runtime-adapter 0.9.0-r0, mongodb 8.0.20-r1, mongodb 8.2.6-r1, mountpoint-s3-csi-driver 2.3.0-r1, newrelic-infrastructure-agent 1.73.1-r0, newrelic-nri-kube-events 2.16.4-r2, newrelic-prometheus-configurator 2.9.0-r0, nginx-prometheus-exporter 1.5.1-r2, nginx-prometheus-exporter-fips 1.5.1-r1, nvidia-container-toolkit 1.19.0-r0, ollama 0.20.3-r1, ollama-fips 0.18.3-r0, ollama-fips 0.21.0-r1, openbao-fips 2.1.1-r11, openbao-fips 2.2.2-r9, openbao-fips 2.3.3-r8, openbao-fips 2.4.4-r8, openbao-fips 2.5.3-r0, opensearch-k8s-operator-fips 2.5.1-r4, opensearch-k8s-operator-fips 2.6.1-r9, opentofu-fips 1.11.6-r1, opentofu-fips 1.7.10-r6, opentofu-fips 1.8.11-r6, opentofu-fips 1.9.4-r6, prometheus 3.5.2-r1, prometheus-mysqld-exporter 0.15.0-r1, prometheus-node-exporter 1.11.0-r0, prometheus-node-exporter-fips 1.11.0-r0, prometheus-operator 0.69.1-r1, prometheus-operator 0.87.1-r3, rabbitmq-cluster-operator 2.18.0-r0, rabbitmq-messaging-topology-operator 1.16.0-r0, rabbitmq-messaging-topology-operator 1.19.1-r1, rclone 1.69.0-r2, restic-fips 0.18.1-r5, sealed-secrets 0.33.1-r0, sealed-secrets 0.34.0-r0, sealed-secrets 0.36.6-r0, spark-operator 2.1.1-r7, spark-operator 2.2.1-r4, spark-operator 2.3.0-r4, spark-operator 2.4.0-r4, spark-operator 2.5.0-r1, stakater-reloader 1.1.0-r1, step-issuer 0.10.2-r1, terragrunt-fips 0.95.1-r5, terragrunt-fips 0.96.1-r5, terragrunt-fips 0.97.2-r7, terragrunt-fips 0.98.0-r7, tigera-operator 1.41.1-r0, tigera-operator 1.42.0-r0, timoni 0.25.2-r0, trust-manager-fips 0.20.3-r2, trust-manager-fips 0.21.1-r2, vault 1.20.4-r4, vault 1.21.4-r4, vault 2.0.0-r1, vault-k8s 1.7.4-r0, velero-fips 1.18.0-r3, velero-plugin-for-csi 0.7.1-r2, velero-plugin-for-gcp-fips 1.14.0-r2, velero-plugin-for-microsoft-azure-fips 1.14.0-r2, wave 0.11.0-r1, weaviate-fips 1.35.17-r1, weaviate-fips 1.36.11-r0, weaviate-fips 1.37.0-r0, yunikorn-web-fips 1.7.0-r0, zot 2.1.13-r2

CVE-2026-39819 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GY71678 Security fix for CVE-2026-41579 applied in: cadvisor 0.55.1-r1, cadvisor 0.56.2-r1, cadvisor 0.57.0-r1, cadvisor 0.57.0-r2, cadvisor 0.60.2-r1, nvidia-container-toolkit 1.19.0-r2

CVE-2026-41579 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JK26072 Security fix for CVE-2025-50688 applied in: nvidia-container-toolkit 1.19.0-r3

Security vulnerability affects the nvidia-container-toolkit package. This issue is resolved in later releases. See references for vulnerability details...

EUVD-2026-82584

Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network...

Oracle WebLogic Server CVE-2026-83021 (September 2026 CSPU)

The version of Oracle WebLogic Server installed on the remote host is affected by a vulnerability as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Container. Supported versions that are affected are...

PT-2026-100847

Security vulnerability affects the nvidia-container-toolkit package. This issue is resolved in later releases. See references for vulnerability details...

The vulnerability of the Container Isolation FS Filter driver for Windows operating systems allows a hacker to compromise the integrity of the protected information.

The vulnerability of the Container Isolation FS Filter driver for Windows operating systems is related to the incorrect handling of symbolic references before accessing a file. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

CVE-2026-69865

Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69865

Microsoft Container Registry is affected by an authorization bypass through user-controlled key , allowing an unauthorized attacker to elevate privileges over a network . The CVSS v3.1 base score is 10.0 (Critical) with a changed scope and high impact to both confidentiality and integrity, while ...

Critical: Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image

A new satellite/iop-vmaas-rhel9 container image is now available as a technical preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running...

Important: Red Hat Security Advisory: General availability of the satellite/iop-insights-engine-rhel9 container image

A new satellite/iop-insights-engine-rhel9 container image is now generally available in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services,...

Critical: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages...