PT-2026-42830

Name of the Vulnerable Software and Affected Versions Docker Model Runner on macOS affected versions not specified Description The vllm-metal inference backend unconditionally sets trust remote code=True when loading model tokenizers and operates without sandboxing. This allows the...

Critical Photon OS Security Update - PHSA-2026-5.0-90-0855

Updates of 'glibc', 'glib', 'go', 'rubygem-addressable', 'containerd', 'docker', 'gtk3', 'libvirt', 'libxml2', 'python3-idna' packages of Photon OS have been released...

MAL-2026-4228 Malicious code in @tiledesk/tiledesk-server (npm)

@tiledesk/tiledesk-server version 2.18.12 is a compromised release of the legitimate Tiledesk customer support platform package. This version was injected with a CI pipeline backdoor as part of the megalodon campaign — a mass GitHub repository backdooring operation targeting CI/CD runner...

GHSA-65PC-FJ4G-8RJX vulnerabilities

Vulnerabilities for packages: jwt-tool, superset, kubeflow-jupyter-web-app, reflex, httpie, ggshield, pypy-3.10, pypy-3.11, kserve, kubeflow-pipelines, dask-kubernetes, py3-pip, open-webui, airflow, kubeflow-pipelines-visualization-server, kubeflow-volumes-web-app, confluent-docker-utils, mlflow,...

CVE-2026-45409 vulnerabilities

Vulnerabilities for packages: jwt-tool, superset, kubeflow-jupyter-web-app, reflex, httpie, ggshield, pypy-3.10, pypy-3.11, kserve, kubeflow-pipelines, dask-kubernetes, py3-pip, open-webui, airflow, kubeflow-pipelines-visualization-server, kubeflow-volumes-web-app, confluent-docker-utils, mlflow,...

GHSA-65PC-FJ4G-8RJX vulnerabilities

Vulnerabilities for packages: crossplane-function-pythonic, ansible-operator-fips, dask-kubernetes, localstack, openstack-kolla-toolbox-2025.1-fips, wazuh-manager-fips, apache-beam-python-3.11-sdk, kubeflow-jupyter-web-app, kubeflow-pipelines, azureml-inference-server-http, mlflow-fips, reflex,...

CVE-2026-45409 vulnerabilities

Vulnerabilities for packages: crossplane-function-pythonic, ansible-operator-fips, dask-kubernetes, localstack, openstack-kolla-toolbox-2025.1-fips, wazuh-manager-fips, apache-beam-python-3.11-sdk, kubeflow-jupyter-web-app, kubeflow-pipelines, azureml-inference-server-http, mlflow-fips, reflex,...

ai-pentest-lab

AI Pentest Lab Demo de segurança ofensiva com IA para palestr...

Security update for docker

This update for docker rebuilds it against the current go security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: Basesystem Module 15-S...

SUSE-SU-2026:2033-1 Security update for docker

This update for docker rebuilds it against the current go security release...

Malicious code in arc-diag-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95f08d97107d726a6ae90afbf8e354b84a7e13d4a236bc8766180a362cc8344c On npm install, the package's postinstall hook runs id to capture the installer's uid/gid/group identity and opens a raw TCP socket to...

MAL-2026-4481 Malicious code in arc-diag-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95f08d97107d726a6ae90afbf8e354b84a7e13d4a236bc8766180a362cc8344c On npm install, the package's postinstall hook runs id to capture the installer's uid/gid/group identity and opens a raw TCP socket to...

Astra Linux – Vulnerability in docker.io

Docker CLI is the command-line interface for the Docker container runtime. A bug was discovered in Docker CLI where running docker login my-private-registry.example.com with a misconfigured configuration file typically /.docker/config.json, which lists a credsStore or credhelpers that cannot be...

Astra Linux – Vulnerability in docker.io

In Docker versions prior to 9.03.15 and 20.10.3, there is a vulnerability related to the --userns-remap option. This option allows access to the remapped root directory, enabling privilege escalation to the actual root directory. When using --userns-remap, if the root user in the remapped namespa...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework that is a key component of Docker Engine, Docker Desktop, and other container tooling or runtime distributions. Moby’s networking implementation allows for multiple networks to be defined, each with its own IP address range and gateway. This feature is...

Astra Linux – Vulnerability in docker.io

Moby is an open-source project created by Docker to enable software containerization. A bug was discovered in Moby Docker Engine where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates the supplementary group permissions, they may be abl...

Astra Linux – Vulnerability in docker.io

Moby is an open-source container framework developed by Docker Inc. It is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component dockerd, which is developed as moby/moby, is commonly referred to as Docker. Swarm Mode, which is...

Astra Linux – Vulnerability in docker.io-app

Moby version 25.0.3 has a race condition vulnerability in the StreamFormatter package. This vulnerability can be exploited to trigger multiple concurrent write operations, leading to data corruption or application crashes...

Astra Linux – Vulnerability in docker.io-app

Moby v25.0.5 is affected by a race condition in the builder/builder-next/adapters/snapshot/layer.go file. This vulnerability could be exploited to trigger concurrent builds that invoke the EnsureLayer function, leading to resource leaks or exhaustion...

Astra Linux – Vulnerability in Docker-Registry

A flaw was discovered in the /v2/catalog endpoint located in the distribution/distribution directory. This endpoint accepts a parameter that controls the maximum number of records to be returned query string: n. This vulnerability allows a malicious user to submit an excessively large value for n...