grype

Grype A vulnerability scanner for container images and filesystems. Features Scan container images , filesystems , and SBOMs for known vulnerabilities see the docs for a full list of supported scan targets Supports major OS package ecosystems Alpine, Debian, Ubuntu, RHEL, Oracle Linux, Amazon...

layerleak

layerleak Layerleak is a read-only OCI image secret scanner. It resolves public image references without a Docker daemon, verifies downloaded content against OCI digests, reconstructs layer state, inspects deleted artifacts and image metadata, and returns redacted, provenance-rich findings. It...

OCI-Ansible-Fix-CVE-2026-31431

CVE-2026-31431 Ansible Remediation This playbook remediates CVE-2026-31431, also known as Copy Fail, on Linux instances in OCI. CVE-2026-31431 is a local privilege escalation issue in the Linux kernel algifaead implementation used by the AFALG userspace crypto API. This playbook applies the main...

pisc

Public OCI-Image Security Checker What is it? PISC Public OCI-Image or docker-image Security Checker is command-line tool to assess the security of OCI container images. Exits with code 1 if any of the following conditions are met: malware 🍄 exploits 🐙, hack-tools 👾, backdoors 🐴, crypto-miners 💰,...

CVE-2026-118763

A flaw was found in @sigstore/oci. This vulnerability allows a malicious or compromised container registry to cause an information disclosure of sensitive authentication credentials. When pushing an artifact, the client sends an upload request to a registry-provided destination address without...

CVE-2026-122315

A flaw was found in Kyverno. An unauthenticated remote attacker can cause a Denial of Service DoS by supplying a crafted attestation statement containing an unexpected data type in an Open Container Initiative OCI manifest. Processing this payload triggers an internal application crash that halts...

flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize 32 bits on 32-bit systems, causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an O...

CVE-2026-122315

Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under...

CVE-2026-122315

Kyverno versions prior to 1.19.2 are vulnerable to a denial-of-service or verification bypass due to an unchecked type assertion in the buildStatementMap function. Unauthenticated attackers can exploit this by pushing an OCI referrer manifest containing a non-string type field within crafted atte...

Rocky Linux 10.2 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2026_93464)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202693464 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 Tenable has extracted the preceding description block directly from the CIQ security...

PT-2026-137337

Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under...

CVE-2026-113369

Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository a user account that holds the edit permission on that repository to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the...

EUVD-2026-117062

Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository a user account that holds the edit permission on that repository to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the...

CVE-2026-113369

Sonatype Nexus Repository 3 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw (CWE-79) within the OCI repository management. A user with permissions to push manifests and edit a hosted OCI repository can inject malicious script content into the artifact type field of an OCI manifest. This...

PT-2026-137111

Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository a user account that holds the edit permission on that repository to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the...

CVE-2026-65109

NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node...

UBUNTU-CVE-2026-65109

NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node...

RLSA-2026:93464 Moderate: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: Arbitrary file write when importing OCI archive CVE-2025-11395 For more details...

podman security update

An update is available for podman. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The podman tool manages pods, container images, and containers. It is part of...

RockyLinux 10 : podman (RLSA-2026:93464)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:93464 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 Tenable has extracted the preceding description block directly from the RockyLinux securi...