PT-2026-90509

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify tha...

CVE-2026-54248: Improper Verification of Cryptographic Signature

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify tha...

CLEANSTART-2026-WT32301 oras-go is a Go library for managing OCI artifacts

Multiple security vulnerabilities affect the kyverno package. oras-go is a Go library for managing OCI artifacts. See references for individual vulnerability details...

[SECURITY] Fedora 44 Update: complyctl-1.0.0-1.fc44

complyctl fetches Gemara policies from OCI registries, resolves dependency graphs, dispatches scans to providers via gRPC, and produces compliance reports EvaluationLog, OSCAL, Markdown, SARIF. Providers are distributed separately via the complytime-providers package...

SUSE CVE-2026-55588

ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...

RLSA-2026:63332 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

RHEL 10 : buildah (RHSA-2026:63332)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63332 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

CVE-2026-67620-poc — Updated!

CVE-2026-67620 — Flowise SSRF via incomplete cloud-metadata deny-list Oracle OCI + Alibaba Cloud Product: FlowiseAI/Flowise — visual LLM / AI-agent builder 54k ★ Affected versions: ≤ 3.1.4 — confirmed still vulnerable in 3.1.4 , the latest release re-verified 2026-08-06 Vulnerability: Server-Side...

PT-2026-90774

Fix slurmstepd removing files outside the container spool directory when cleaning up an OCI containe, Fix slurmstepd leaving OCI container spool directories behind when ContainerPath contains a task id pattern...

CVE-2026-65109

Fix slurmstepd removing files outside the container spool directory when cleaning up an OCI containe, Fix slurmstepd leaving OCI container spool directories behind when ContainerPath contains a task id pattern...

UBUNTU-CVE-2026-65109

Fix slurmstepd removing files outside the container spool directory when cleaning up an OCI containe, Fix slurmstepd leaving OCI container spool directories behind when ContainerPath contains a task id pattern...

ALSA-2026:63332 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

PT-2026-84120

Name of the Vulnerable Software and Affected Versions CRI-O affected versions not specified Description A trust-boundary flaw exists in the sandbox state persistence of CRI-O. This issue allows attacker-influenced pod metadata to overwrite reserved sandbox bookkeeping. After a restart, this data ...

UBUNTU-CVE-2026-81494

GHSA-7fj9-65v4-rp7h: Arbitrary file write on host via image-planted symlinks and oci.dns. newline injection...

Unity Linux 20.1070e Security Update: runc (UTSA-2026-104944)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104944 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and...

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

Summary A malicious OCI registry can return a cyclic referrer graph e.g. A - A or A - B - A. The ORAS CLI's recursive referrer traversal does not track visited descriptors, so a cycle causes unbounded recursion and memory growth — a client-side denial of service. This affects oras discover...

GHSA-298F-872V-2RCX ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

Summary A malicious OCI registry can return a cyclic referrer graph e.g. A - A or A - B - A. The ORAS CLI's recursive referrer traversal does not track visited descriptors, so a cycle causes unbounded recursion and memory growth — a client-side denial of service. This affects oras discover...

EUVD-2026-66110

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption...

SUSE CVE-2026-17113

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: umoci (UTSA-2026-031608)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031608 advisory. Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when umoci unpack o...