CVE-2026-24845

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. malcontent uses...

CVE-2026-24845

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. malcontent uses...

Malcontent security vulnerabilities

Malcontent is a supply chain attack detection tool developed by Chainguard. Versions prior to 1.20.3 of Malcontent contain security vulnerabilities. These vulnerabilities arise from the possibility of exposing Docker registry credentials during the scanning of specially crafted OCI image referenc...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: kubernetes-secret-generator, contour, openbao-k8s-fips, yunikorn-k8shim, authservice-fips, kubescape-operator-fips, otel-cli, external-dns-fips, gostatsd, rancher-machine, kubernetes-dashboard-metrics-scraper-fips, tigera-operator, cert-exporter-fips,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: kubernetes-secret-generator, contour, openbao-k8s-fips, yunikorn-k8shim, authservice-fips, kubescape-operator-fips, otel-cli, external-dns-fips, gostatsd, rancher-machine, kubernetes-dashboard-metrics-scraper-fips, tigera-operator, cert-exporter-fips,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: kubernetes-secret-generator, contour, openbao-k8s-fips, yunikorn-k8shim, authservice-fips, kubescape-operator-fips, otel-cli, external-dns-fips, gostatsd, rancher-machine, kubernetes-dashboard-metrics-scraper-fips, tigera-operator, cert-exporter-fips,...

EUVD-2023-2736

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2020-8564

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file bein...

Credential Hijacking

github.com/artifacthub/hub is vulnerable to Credential Hijacking. This vulnerability exists in the registryIsDockerHub function in oci.go because it does not properly check the domain registry in docker hub, which allows an attacker to deploy a fake OCI registry on a domain ending with docker.io,...

Design/Logic Flaw

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which the registryIsDockerHub function was only checking that the...

CVE-2023-45821 Incorrect Docker Hub registry check in Artifact Hub

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which the registryIsDockerHub function was only checking that the...

CVE-2023-45821

Artifact Hub (artifacthub.io) has a vulnerability in the registryIsDockerHub check where the code only inspects the registry domain ending with docker.io, enabling credential hijacking by using a fake OCI registry on a domain that ends with docker.io. The issue affects how Docker credentials used...

CVE-2023-45821 Incorrect Docker Hub registry check in Artifact Hub

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which the registryIsDockerHub function was only checking that the...

GHSA-G6PQ-X539-7W4J Artifact Hub has Incorrect Docker Hub registry check

Impact During a security audit of Artifact Hub's code base, a security researcher at OffSec identified a bug in which the registryIsDockerHub function was only checking that the registry domain had the docker.io suffix. Artifact Hub allows providing some Docker credentials that are used to increa...

PT-2023-29710

Name of the Vulnerable Software and Affected Versions Artifact Hub versions prior to 1.16.0 Description A security issue was identified in Artifact Hub's code base where the registryIsDockerHub function only checked if the registry domain had the docker.io suffix. This allowed for the potential...

SUSE CVE-2021-41092

Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running docker login my-private-registry.example.com with a misconfigured configuration file typically /.docker/config.json listing a credsStore or credHelpers that could not be...

CVE-2021-41092

A confidential data leak vulnerability was found in Docker CLI. The execution of docker login to a private registry may send provided credentials in a misconfigured docker credentials store to the registry-1.docker.io rather than the specified private registry. This flaw allows an attacker to ste...

UBUNTU-CVE-2020-8564

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects v1.19.3, v1.18.10, v1.17.13...