pwndbg

pwndbg pwndbg /paʊnˈdiˌbʌɡ/ is a GDB and LLDB plug-in that makes debugging suck less, with a focus on features needed by low-level software developers, hardware hackers, reverse-engineers and exploit developers. It has a boatload of features, see our Features page and CHEATSHEET feel free to prin...

kali-docker

공식 Kali Linux Docker 이 Kali Linux Docker 이미지는 최신 버전의 Kali Linux Rolling Distribution의 최소 기본 설치를 제공합니다. 이 이미지에는 도구가 추가되어 있지 않으므로 직접 설치해야 합니다. Kali Linux 메타패키지에 대한 자세한 내용은 다음을 확인하세요. https://www.kali.org/blog/kali-linux-metapackages/. 주간 업데이트 Docker 이미지는 매주 업데이트되어 Docker Hub에 푸시됩니다...

DockerSpy

DockerSpy DockerSpy는 Docker Hub에서 이미지를 검색하고 인증 비밀, 개인 키 등 민감한 정보를 추출합니다. Docker란 무엇인가? Docker는 컨테이너화 기술을 사용하여 애플리케이션의 배포, 확장 및 관리를 자동화하는 오픈소스 플랫폼입니다. 컨테이너를 통해 개발자는 애플리케이션과 그 종속성을 단일의 이식 가능한 단위로 패키징하여 다양한 컴퓨팅 환경에서 일관되게 실행할 수 있습니다. Docker는 애플리케이션이 배포된 환경에 관계없이 동일하게 실행되도록 보장하여 개발 및 배포 프로세스를 단순화합니다...

CVE-2021-44228

CVE-2021-44228 Log4j 2.14 라이브러리 사용 User-Agent, POST 메서드 및 엔트리포인트 /admin/cores?foo= 에서 취약 Docker Hub에 업로드했습니다: 풀pull하여 실행할 수 있습니다 https://hub.docker.com/repository/docker/iamnewbie/log4j-vuln...

CVE-2026-91936 Flowise before 3.1.4 Script Injection via Docker Workflows

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflowdispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tagversion and nodeversi...

CVE-2026-91936: Improper Neutralization of Special Elements used in an OS Command

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflowdispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tagversion and nodeversi...

Vulnerabilities, Secrets and Misconfiguration in the Highest-Exposure Docker Hub Images

Docker Hub is the registry underneath most container deployments, and a flaw in a widely reused base image is inherited by every image built on it. Prior ecosystem-scale measurements each rely on a single detector, leaving the tool-dependence of their counts unquantified, while the studies that d...

docker-vuln-lab-builder

bash python scripts-exportcontainer.py \ --image-path rockm...

CVE-2026-45131

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow pull-request.yaml executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens...

CVE-2026-45131

CloudPirates Open Source Helm Charts are affected by a vulnerability in the GitHub Actions pull-request.yaml workflow where attacker-controlled code from fork pull requests could run in a privileged context, exposing repository secrets (e.g., Docker Hub credentials/tokens). The issue precedes com...

Containers on fire: from container escapes to supply chain attacks

Introduction Modern infrastructures universally rely on containerization to deploy applications, scale services, and build cloud platforms. The use of Docker, Kubernetes, and similar technologies has become the corporate standard for efficient automation. However, as containers grow in popularity...

PT-2026-45467

Name of the Vulnerable Software and Affected Versions CloudPirates Open Source Helm Charts versions prior to commit fcf9302 Description A GitHub Actions workflow in the pull-request.yaml file executes attacker-controlled code from fork pull requests within a privileged context. This allows for th...

What’s in the container? Analyzing vulnerabilities, risks and protection with Kaspersky Container Security and the KIRA AI assistant

Introduction Containerization using Docker has become firmly established in modern development standards, significantly increasing the speed and convenience of deploying various services. Developers often use ready-made Docker images, making only minimal changes. The largest repository of contain...

GHSA-2V5F-5R6W-P67R MCP Registry: OCI validator skips ownership check on upstream rate limits

OCI ownership validation fails open on upstream rate limits, allowing attacker to claim arbitrary public OCI images under their own namespace Severity: Low re-scored post-triage; see Maintainer triage note below Affected: modelcontextprotocol/registry main branch at commit fe0cb3b current HEAD as...

GHSA-69FQ-XP46-6X23 Trivy ecosystem supply chain was briefly compromised

Summary On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious commits. On March 22...

Trivy ecosystem supply chain was briefly compromised

Summary On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious commits. On March 22...

Docker Fixes ‘Ask Gordon’ AI Flaw That Enabled Metadata-Based Attacks

Pillar Security has identified a critical indirect prompt injection vulnerability in Docker’s ‘Ask Gordon’ assistant. By poisoning metadata on Docker Hub, attackers could bypass security to exfiltrate private build logs and chat history. Discover how the "lethal trifecta" enabled this attack and...

EUVD-2022-7433

Malicious code in bioql PyPI...

Researchers Spot XZ Utils Backdoor in Dozens of Docker Hub Images, Fueling Supply Chain Risks

New research has uncovered Docker images on Docker Hub that contain the infamous XZ Utils backdoor, more than a year after the discovery of the incident. More troubling is the fact that other images have been built on top of these infected base images, effectively propagating the infection furthe...

Researchers Spot XZ Utils Backdoor in Dozens of Docker Hub Images, Fueling Supply Chain Risks

New research has uncovered Docker images on Docker Hub that contain the infamous XZ Utils backdoor, more than a year after the discovery of the incident. More troubling is the fact that other images have been built on top of these infected base images, effectively propagating the infection furthe...