EUVD-2026-63905

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name...

GO-2025-3527 vulnerabilities

Vulnerabilities for packages: kubescape, docker-compose-fips, docker-compose...

GO-2025-3699 vulnerabilities

Vulnerabilities for packages: neuvector, neuvector-fips, neuvector-scanner, docker-compose, docker-compose-fips...

GO-2026-4859 vulnerabilities

Vulnerabilities for packages: trivy, buildah-fips, zot, buildah, kaniko-fips, scorecard, kubescape-server-fips, docker-cli-buildx-fips, podman-fips, conftest-fips, docker-fips, trivy-operator, conftest, skaffold-fips, kubescape, docker-cli-buildx, docker-compose, kubescape-server, kaniko, skaffol...

GO-2025-3900 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, pluto-fips, grafana-fips, zitadel, beats, istio-fips, grafana, kyverno-notation-aws-fips, k9s-fips, ratify-fips, tkn-fips, gitlab-cng, jitsucom-bulker, kyverno, neuvector-sigstore-interface-fips, beats-fips, bank-vaults, mattermost-fips,...

GO-2023-2331 vulnerabilities

Vulnerabilities for packages: temporal-server, temporal, kubevela, metrics-server-fips, rancher-webhook, aws-ebs-csi-driver, kube-oidc-proxy, kine, kubernetes-csi-external-resizer, temporal-server-fips, prometheus-adapter, rancher-webhook-fips, kubernetes, k3s, kubescape, docker-compose, buildkit...

GO-2025-3699 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, docker-compose...

GO-2025-3527 vulnerabilities

Vulnerabilities for packages: kubescape, docker-compose...

GO-2026-4859 vulnerabilities

Vulnerabilities for packages: podman, guac, kaniko, osv-scanner, kubescape, docker-cli-buildx, zot, trivy-operator, skaffold, trivy, conftest, scorecard, buildah, docker-compose...

GO-2026-4858 vulnerabilities

Vulnerabilities for packages: podman, guac, kaniko, osv-scanner, kubescape, docker-cli-buildx, zot, trivy-operator, skaffold, trivy, conftest, scorecard, buildah, docker-compose...

GO-2024-2737 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, cri-tools, harbor-scanner-trivy, helm-push, kaniko, wolfictl, syft, grype, buf, dagger, k3d, melange, policy-controller, docker, docker-compose...

GO-2025-3830 vulnerabilities

Vulnerabilities for packages: k9s, tw, goreleaser, cadvisor, apko, trufflehog, kargo, nerdctl, grype, dagger, opentelemetry-collector-contrib, zot, falcoctl, docker-cli-buildx, opentelemetry-collector, buf, melange, spire-server, buildkitd, wolfictl, syft, zarf, osv-scanner, splunk-otel-collector...

GO-2024-2659 vulnerabilities

Vulnerabilities for packages: crossplane, kaniko, cadvisor, ctop, kargo, grype, dagger, zot, aactl, tkn, kubescape, buf, melange, up, spire-server, conftest, ko, buildkitd, wolfictl, syft, trivy, cilium-cli, docker-compose...

CVE-2026-72865

Dokploy prior to 0.29.13 suffers an OS command injection via an unvalidated composePath used by the compose.update/deploy flow. An authenticated user with compose write and deploy permissions can craft a path that is interpolated into docker commands (docker compose -f, docker stack deploy -c) an...

Astra Linux – Vulnerability in docker.io-app

Docker Compose relies on the path information embedded in remote OCI Compose artifacts. When a layer includes the annotations com.dockercompose.extends or com.dockercompose.envfile, Compose incorporates the value provided by the attacker from com.dockercompose.file/com.dockercompose.envfile into...

EUVD-2026-53374

The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. "$IONMGRPORT:-8089:8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the C...

CVE-2026-71289

The CVE affects NASA-AMMOS ANMS and JHUAPL-DTNMA/dtnma-tools. The default docker-compose setup exposes the amp-manager REST API on the host network (port 8089) with NET_ADMIN/NET_RAW/SYS_NICE and bypasses the CAM gateway, placing the REST server (CivetWeb, nm_rest.c) in a state where enable_auth_...

CVE-2026-71289

The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. ":8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the CAM Configuration...

SUSE CVE-2026-47179

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because...

EUVD-2026-48434

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...