github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

CVE-2019-16097

CVE-2019-16097-batch Descargo de responsabilidad Solo para uso en investigación de seguridad. No lo utilice para pruebas ilegales. ¡¡¡Las consecuencias son bajo su propia responsabilidad!!! CVE-2019-16097-batch Script de explotación de vulnerabilidad en lote Agregue direcciones objetivo en lote e...

jenkinsci__docker-commons-plugin_CVE-2022-20617_1-17

Jenkins 的 Docker Commons API 插件 API 插件，为各种与 Docker 相关的插件提供通用共享功能。 概要 用于管理 Docker 镜像和容器指纹的 API Docker Registry 的凭据和位置 Docker Daemon（即 Docker Remote API）的凭据和位置 用于 Docker CLI 客户端的 ToolInstallation DockerImageExtractor 扩展点，用于从任务中获取 Docker 镜像关系 在 Docker 构建中引用相关镜像指纹的简单 UI 等等。 使用场景 凭据和位置...

CVE-2019-16097-batch

CVE-2019-16097-batch 免责声明 只做安全研究使用，不得做非法测试，后果自行承担！！！ CVE-2019-16097-batch 批量漏洞利用脚本 在 url.txt文件 批量添加目标地址 http://1.1.1.1 http://2.2.2.2 使用python 运行 此脚本 在 result.txt 可以看到最终的验证结果 漏洞背景...

CVE-2026-21005-Docker-Registry-V2-Schema-1-Image-Poisoning

CVE-2026-21005 – Docker Registry V2 Schema 1 镜像投毒 程序代码（Python Flask + Shell） root@kitploit: dockerregistrysim.py - Simulated registry that serves schema1 manifests from flask import Flask, request, jsonify app = Flaskname images = 'myapp': 'v1': 'layers': 'sha256:abc', 'sha256:def', 'config': ,...

ictf-framework

The iCTF Framework 3.0 This is the framework that Shellphish uses to host the iCTF. The iCTF Framework is described in a paper presented at the Usenix 3GSE workshop in 2014. We released this in the hope that it allows educators and trainers to host their own A/D CTFs. This framework is free for...

klar

Klar ClairとDocker Registryの統合（Clair API v1およびv3をサポート） Klarは、Clair（https://github.com/coreos/clair）を使用して、プライベートまたはパブリックなDockerレジストリに保存されたイメージのセキュリティ脆弱性を分析するためのシンプルなツールです。Klarは統合ツールとして使用されるように設計されているため、環境変数に依存します。依存関係が不要な単一のバイナリです。 Klarは、DockerレジストリとClair間のイメージチェックを調整するクライアントとして機能します。 バイナリインストール...

klar

Klar Integration of Clair and Docker Registry supports both Clair API v1 and v3 Klar is a simple tool to analyze images stored in a private or public Docker registry for security vulnerabilities using Clair https://github.com/coreos/clair. Klar is designed to be used as an integration tool so it...

go-pillage-registries

go-pillage-registries 该项目会获取一个 Docker 注册表，并对其目录中每个镜像的 manifest 和 configuration 进行掠夺。 它使用 Google 的 crane 命令包，该包应遵循 Docker 的 keychain 语义。 如果你想覆盖此行为，只需按照 https://github.com/google/go-containerregistry/tree/master/pkg/authn/k8schain 中的描述更改 authn.DefaultKeychain 即可。 安装： root@kitploit: git clone...

Astra Linux – Vulnerability in Docker-Registry

A flaw was discovered in the /v2/catalog endpoint located in the distribution/distribution directory. This endpoint accepts a parameter that controls the maximum number of records to be returned query string: n. This vulnerability allows a malicious user to submit an excessively large value for n...

CVE-2026-49349 regclient may leak authentication credentials to external blob stores

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...

PYSEC-2026-2391 BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing

The dockerpull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication reques...

BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing

The dockerpull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication reques...

PT-2026-39313

🔴 Docker Registry Auth Substring Match Forwards Credentials to a Different Registry CVE-2025-27119, High https://t.co/gO08whMpWZ...

Exploit for CVE-2026-7482

CVE-2026-7482: Ollama Heap Out-of-Bounds Read 1-Day PoC Thi...

org.keycloak/keycloak-services: Keycloak: Missing Check on Disabled Client for Docker Registry Protocol

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously...

GHSA-FJF4-6F34-W64Q Keycloak: Missing Check on Disabled Client for Docker Registry Protocol

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously...

CVE-2026-2733 Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously...

CVE-2026-2733 Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously...

malcontent OCI image pull credential exfiltration via malicious registry token realm

Malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. Malcontent uses google/go-containerregistry for OCI image pulls, which by default uses the Docker credential keychain. A malicious registry could return a WWW-Authenticate header...