CVE-2026-42204 Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELLSAFECOMMANDPATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an...

CVE-2026-42204: Improper Neutralization of Special Elements used in an OS Command

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELLSAFECOMMANDPATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an...

Fedora 45 : docker-compose (2026-caecf8f2d7)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-caecf8f2d7 advisory. Automatic update for docker-compose-5.3.0-1.fc45. Changelog Thu Jul 2 2026 Bradley G Smith - 5.3.0-1 - Update to release v5.3.0 - Resolves:...

SQLi-PoC

SQLi-PoC — CW... flag extractor A self-contained, sqlma...

CVE-2026-27955 Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker helper wraps commands in bash -c '$command' without escaping single quotes. User-controlled dockercomposecustombuildcommand and...

EUVD-2026-40332

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the executeInDocker helper wraps commands in bash -c '$command' without escaping single quotes. User-controlled dockercomposecustombuildcommand and...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-orbital, crossplane-provider-keycloak, flux-image-automation-controller-fips, gomplate, knative-serving, prometheus-podman-exporter, steampipe, sops, packer, crossplane-provider-aws-sesv2, chainloop-control-plane,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-orbital, crossplane-provider-keycloak, flux-image-automation-controller-fips, gomplate, knative-serving, prometheus-podman-exporter, steampipe, sops, packer, crossplane-provider-aws-sesv2, chainloop-control-plane,...

GO-2026-5308 Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend

Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend...

cerberus-redteam

Agent Autonome de Red Teaming Guidé par LLM et MITRE ATT&CK...

CVE-2026-50195 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, scorecard, grype-fips, upwind-agent, steampipe, trivy-operator-fips, zarf-fips, chainctl, cloudbeat-fips, packer, k3s, helm-operator-fips, harvester, kargo, skaffold-fips, kubescape-operator, falco-no-driver, dagger, helm-mapkubeapis,...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, scorecard, grype-fips, steampipe, trivy-operator-fips, zarf-fips, chainctl, cloudbeat-fips, packer, k3s, helm-operator-fips, harvester, kargo, skaffold-fips, kubescape-operator, falco-no-driver, dagger, helm-mapkubeapis, rancher-helm,...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, scorecard, grype-fips, steampipe, trivy-operator-fips, zarf-fips, chainctl, cloudbeat-fips, packer, k3s, helm-operator-fips, harvester, kargo, skaffold-fips, kubescape-operator, falco-no-driver, dagger, helm-mapkubeapis, rancher-helm,...

GHSA-33VJ-92QQ-66HC vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, scorecard, grype-fips, steampipe, trivy-operator-fips, zarf-fips, chainctl, cloudbeat-fips, packer, k3s, helm-operator-fips, harvester, kargo, skaffold-fips, kubescape-operator, falco-no-driver, dagger, helm-mapkubeapis, rancher-helm,...

GHSA-CVXM-645Q-P574 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, scorecard, grype-fips, upwind-agent, steampipe, trivy-operator-fips, zarf-fips, chainctl, cloudbeat-fips, packer, k3s, helm-operator-fips, harvester, kargo, skaffold-fips, kubescape-operator, falco-no-driver, dagger, helm-mapkubeapis,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, scorecard, grype-fips, upwind-agent, steampipe, trivy-operator-fips, zarf-fips, chainctl, cloudbeat-fips, packer, k3s, helm-operator-fips, harvester, kargo, skaffold-fips, kubescape-operator, falco-no-driver, dagger, helm-mapkubeapis,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, scorecard, grype-fips, steampipe, trivy-operator-fips, zarf-fips, chainctl, cloudbeat-fips, packer, k3s, helm-operator-fips, harvester, kargo, skaffold-fips, kubescape-operator, falco-no-driver, dagger, helm-mapkubeapis, rancher-helm,...

lab-keamanan-siber

Lab Keamanan Siber Web Security Testing Lab 🚀 Cara Menja...

GHSA-WF69-R4MX-43RR AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration

Vulnerability Details CWE: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory The official docker-compose.yml line 61 mounts the entire project root directory as the Apache document root: yaml volumes: - "./:/var/www/html/AVideo" This causes the .env file —...

Files or Directories Accessible to External Parties

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the official Docker Compose configuration, which mounts the project root directory as the Apache document...