GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: kubevela, spegel, docker-cli-buildx, cert-manager-cmctl, nerdctl, opa, melange, helm, helm-push, syft, opa-envoy, flux-source-controller, dagger, k8sgpt, neuvector-scanner, osv-scanner, wolfictl, zot, kargo, k3s, docker-compose, xeol, eksctl, linkerd2, docker,...

CVE-2025-0495 vulnerabilities

Vulnerabilities for packages: docker-compose-fips, docker-compose, kubescape...

GHSA-M4GQ-FM9H-8Q75 vulnerabilities

Vulnerabilities for packages: docker-compose-fips, docker-compose, kubescape...

CVE-2024-10846 affecting package docker-compose for versions less than 2.27.0-4

CVE-2024-10846 affecting package docker-compose for versions less than 2.27.0-4. A patched version of the package is available...

CVE-2025-22869 affecting package docker-compose for versions less than 2.27.0-4

CVE-2025-22869 affecting package docker-compose for versions less than 2.27.0-4. A patched version of the package is available...

CVE-2025-27615

umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit...

CVE-2025-27615 umatiGateway's UI publicly accessible in provided docker-compose file

umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit...

CVE-2025-27615 umatiGateway's UI publicly accessible in provided docker-compose file

umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit...

CVE-2025-27615: Exposure of Sensitive Information to an Unauthorized Actor

umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be publicly accessible with umatiGateway's provided docker-compose file. With this access, the configuration can be viewed and altered. Commit...

AZL-57374 CVE-2025-22869 affecting package docker-compose for versions less than 2.27.0-4

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: hello-world-golang, oauth2-proxy, kubernetes-ingress-defaultbackend, overmind, grafana-operator, pombump, go-bindata, runc, src, melange, tekton-chains, helm, pulumi-language-dotnet, smarter-device-manager, grpcurl, flux-kustomize-controller, confluent-common-docker,...

CVE-2025-23211

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24...

CVE-2025-23211 Tandoor Recipes - SSTI - Remote Code Execution

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24...

PT-2025-4850

Name of the Vulnerable Software and Affected Versions: Tandoor Recipes versions prior to 1.5.24 Description: The issue is related to a Jinja2 SSTI vulnerability that allows any user to execute commands on the server, potentially with root privileges in the case of the provided Docker Compose file...

SUSE CVE-2024-10846

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included...

AZL-55947 CVE-2024-10846 affecting package docker-compose for versions less than 2.27.0-4

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included...

CVE-2024-10846

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included...

CVE-2024-10846

Summary: CVE-2024-10846 affects the compose-go library. The vulnerability occurs in versions v2.10–v2.4.0 of the compose-go component when an authorized user sends malicious YAML payloads, causing the library to consume excessive memory and CPU cycles during YAML parsing (as used by Docker Compos...

CVE-2024-10846 Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included...

CVE-2024-10846 Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included...