655 matches found
CVE-2026-42204
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELLSAFECOMMANDPATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an...
CVE-2026-42204
Coolify CVE-2026-42204 affects the 4.0.0-beta.471 to 4.0.0-beta.473 releases, where a regression in the SHELL_SAFE_COMMAND_PATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields. This enabled an authenticated team member to inject shell commands t...
CVE-2026-42204 Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELLSAFECOMMANDPATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an...
GHSA-Q4H4-GMJ2-QVW2 vulnerabilities
Vulnerabilities for packages: crossplane-provider-azure-servicelinker, crossplane-provider-aws-ecr-fips, knative-kafka-broker, flux, datadog-agent-fips, atlantis, kueue-fips, gitlab-rails-ce, buildah, prometheus, helmfile, knative-serving, crossplane-provider-azure-policyinsights,...
GHSA-RM3J-F69W-WQMQ vulnerabilities
Vulnerabilities for packages: crossplane-provider-azure-servicelinker, crossplane-provider-aws-ecr-fips, knative-kafka-broker, flux, datadog-agent-fips, atlantis, kueue-fips, gitlab-rails-ce, buildah, prometheus, helmfile, knative-serving, crossplane-provider-azure-policyinsights,...
GO-2026-5308 Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend...
CVE-2026-53492 vulnerabilities
Vulnerabilities for packages: k9s-fips, beats, datadog-agent-fips, gitlab-rails-ce, envoy-gateway-fips, consul-k8s-fips, crossplane-fips, helmfile, scorecard, buildkitd-fips, docker-fips, k8sgpt, grype-fips, amazon-ecs-agent, jfrog-cli, manifest-tool, newrelic-infrastructure-agent, wolfictl,...
GHSA-33VJ-92QQ-66HC vulnerabilities
Vulnerabilities for packages: k9s-fips, beats, datadog-agent-fips, gitlab-rails-ce, envoy-gateway-fips, consul-k8s-fips, crossplane-fips, helmfile, scorecard, buildkitd-fips, docker-fips, k8sgpt, grype-fips, amazon-ecs-agent, jfrog-cli, manifest-tool, newrelic-infrastructure-agent, wolfictl,...
CVE-2026-53489 vulnerabilities
Vulnerabilities for packages: k9s-fips, beats, datadog-agent-fips, gitlab-rails-ce, envoy-gateway-fips, consul-k8s-fips, crossplane-fips, helmfile, scorecard, buildkitd-fips, docker-fips, k8sgpt, grype-fips, amazon-ecs-agent, jfrog-cli, manifest-tool, newrelic-infrastructure-agent, wolfictl,...
GHSA-CVXM-645Q-P574 vulnerabilities
Vulnerabilities for packages: k9s-fips, beats, datadog-agent-fips, gitlab-rails-ce, envoy-gateway-fips, consul-k8s-fips, crossplane-fips, helmfile, scorecard, buildkitd-fips, docker-fips, k8sgpt, grype-fips, amazon-ecs-agent, jfrog-cli, manifest-tool, newrelic-infrastructure-agent, wolfictl,...
CVE-2026-50195 vulnerabilities
Vulnerabilities for packages: k9s-fips, beats, datadog-agent-fips, gitlab-rails-ce, envoy-gateway-fips, consul-k8s-fips, crossplane-fips, helmfile, scorecard, buildkitd-fips, docker-fips, k8sgpt, grype-fips, amazon-ecs-agent, jfrog-cli, manifest-tool, newrelic-infrastructure-agent, wolfictl,...
GHSA-JPCC-P29G-P8MQ vulnerabilities
Vulnerabilities for packages: k9s-fips, datadog-agent-fips, gitlab-rails-ce, envoy-gateway-fips, consul-k8s-fips, crossplane-fips, helmfile, scorecard, buildkitd-fips, docker-fips, k8sgpt, grype-fips, amazon-ecs-agent, jfrog-cli, manifest-tool, newrelic-infrastructure-agent, wolfictl, chaos-mesh,...
GHSA-XHF5-7WJV-PQXP vulnerabilities
Vulnerabilities for packages: k9s-fips, datadog-agent-fips, gitlab-rails-ce, envoy-gateway-fips, consul-k8s-fips, crossplane-fips, helmfile, scorecard, buildkitd-fips, docker-fips, k8sgpt, grype-fips, amazon-ecs-agent, jfrog-cli, manifest-tool, newrelic-infrastructure-agent, wolfictl, chaos-mesh,...
GHSA-WF69-R4MX-43RR AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
Vulnerability Details CWE: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory The official docker-compose.yml line 61 mounts the entire project root directory as the Apache document root: yaml volumes: - "./:/var/www/html/AVideo" This causes the .env file —...
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
Vulnerability Details CWE: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory The official docker-compose.yml line 61 mounts the entire project root directory as the Apache document root: yaml volumes: - "./:/var/www/html/AVideo" This causes the .env file —...
Files or Directories Accessible to External Parties
Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the official Docker Compose configuration, which mounts the project root directory as the Apache document...
PT-2026-51433
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 Description AVideo exposes sensitive .env files to unauthenticated users when deployed using the official Docker compose configuration. The docker-compose.yml file mounts the entire project root directory as the...
PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication
Summary Setting PRAISONAICALLAUTH=disabled completely disables all authentication on the /api/v1/agents/id/invoke endpoint. This bypass is advertised in the application's own error messages, making it likely to appear in production Docker and Compose configurations. Details python...
GHSA-8CCJ-P46R-JWQQ PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication
Summary Setting PRAISONAICALLAUTH=disabled completely disables all authentication on the /api/v1/agents/id/invoke endpoint. This bypass is advertised in the application's own error messages, making it likely to appear in production Docker and Compose configurations. Details python...
