Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

1153 matches found

CVE
CVE•added 2026/04/21 12:44 a.m.•57 views

CVE-2026-39396

OpenBao is vulnerable to a DoS via a decompression bomb in its OCI plugin extraction. Before version 2.5.3, ExtractPluginFromImage() streams decompressed tar data with no upper bound, using io.Copy without size checks. If an attacker controls the OCI registry, they can serve a crafted image that ...

6.5CVSS7AI score0.0033EPSS
SaveExploits1References1Affected Software1
Cvelist
Cvelist•added 2026/04/21 12:44 a.m.•50 views

CVE-2026-39396 OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, ExtractPluginFromImage in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via io.Copy with no upper bound on the number of bytes written. ...

3.1CVSS0.0033EPSS
SaveExploits1References1
attackerkb
attackerkb•added 2026/04/21 12:44 a.m.•14 views

CVE-2026-39396

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, ExtractPluginFromImage in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via io.Copy with no upper bound on the number of bytes written. ...

3.1CVSS7AI score0.0033EPSS
SaveExploits1References2Affected Software1
AlpineLinux
AlpineLinux•added 2026/04/21 12:44 a.m.•32 views

CVE-2026-39396

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, ExtractPluginFromImage in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via io.Copy with no upper bound on the number of bytes written. ...

6.5CVSS7AI score0.0033EPSS
SaveExploits1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)•added 2026/04/21 12:00 a.m.•3 views

CVE-2026-39396: Uncontrolled Resource Consumption

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, ExtractPluginFromImage in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via io.Copy with no upper bound on the number of bytes written. ...

6.5CVSS7AI score0.0033EPSS
SaveExploits1References6
Oracle linux
Oracle linux•added 2026/04/21 12:00 a.m.•24 views

osbuild-composer security update

101.4-5.0.1 - Support using repository definitons with OCI variables JIRA: OLDIS-38657 - Update repositories to contain OCI variables - Remove image types Minimal-raw and wsl JIRA: OLDIS-38123 - Increase default /boot size to 1GB Orabug: 36827079 - support for building OL8/9 images on Oracle Linu...

7.5CVSS7.6AI score0.00834EPSS
SaveExploits0
CNNVD
CNNVD•added 2026/04/21 12:00 a.m.•30 views

OpenBao 安全漏洞

OpenBao is an open-source sensitive data management software developed by OpenBao. Versions of OpenBao prior to 2.5.3 contained security vulnerabilities. These vulnerabilities stemmed from the ExtractPluginFromImage function in the OCI plugin downloader, which did not limit the number of bytes...

6.5CVSS7.1AI score0.0033EPSS
SaveExploits1References2
Oracle linux
Oracle linux•added 2026/04/21 12:00 a.m.•33 views

osbuild-composer security update

149-5.0.1 - Add missing dependency over dracut-config-rescue for image-installer ORABUG: 38587453 - Switch to UEKR8 repositories for OL9.6 Orabug: 37962207 - Add support to create OpenScap images JIRA: OLDIS-35301 - Simplify repository names JIRA: OLDIS-35893 - Refactor patches to fix some naming...

7.5CVSS7.5AI score0.00834EPSS
SaveExploits0
Qualys Blog
Qualys Blog•added 2026/04/15 6:02 p.m.•41 views

Qualys VMDR and TotalCloud™ Now Available on Oracle Cloud Marketplace

Key Takeaways Qualys VMDR and TotalCloud are now available on the Oracle Cloud Marketplace, simplifying procurement and deployment for Oracle Cloud Infrastructure OCI customers. Organizations can deploy security faster with native OCI integration and one-click provisioning. The combined platform...

5.8AI score
SaveExploits0
Tenable Nessus
Tenable Nessus•added 2026/04/14 12:00 a.m.•15 views

Amazon Linux 2 : oci-add-hooks, --advisory ALAS2ECS-2026-104 (ALASECS-2026-104)

The version of oci-add-hooks installed on the remote host is prior to 0-0.8.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-104 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs...

7.5CVSS6.8AI score0.00834EPSS
SaveExploits0References8
Tenable Nessus
Tenable Nessus•added 2026/04/14 12:00 a.m.•16 views

Amazon Linux 2 : oci-add-hooks, --advisory ALAS2DOCKER-2026-110 (ALASDOCKER-2026-110)

The version of oci-add-hooks installed on the remote host is prior to 0-0.8.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-110 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs...

7.5CVSS6.8AI score0.00834EPSS
SaveExploits0References8
Tenable Nessus
Tenable Nessus•added 2026/04/14 12:00 a.m.•11 views

Amazon Linux 2 : oci-add-hooks, --advisory ALAS2NITRO-ENCLAVES-2026-096 (ALASNITRO-ENCLAVES-2026-096)

The version of oci-add-hooks installed on the remote host is prior to 0-0.8.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-096 advisory. url.Parse insufficiently validated the host/authority component and accepted some...

7.5CVSS6.8AI score0.00834EPSS
SaveExploits0References8
Amazon
Amazon•added 2026/04/14 12:00 a.m.•31 views

Medium: oci-add-hooks

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

7.5CVSS5.9AI score0.00834EPSS
SaveExploits0
Amazon
Amazon•added 2026/04/14 12:00 a.m.•27 views

Medium: oci-add-hooks

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

7.5CVSS5.9AI score0.00834EPSS
SaveExploits0
Amazon
Amazon•added 2026/04/14 12:00 a.m.•27 views

Medium: oci-add-hooks

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

7.5CVSS5.9AI score0.00834EPSS
SaveExploits0
OPENSUSE Linux
OPENSUSE Linux•added 2026/04/14 12:00 a.m.•18 views

oci-cli-3.76.2-1.1 on GA media (moderate)

oci-cli-3.76.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:10539-1 Rating: moderate Cross-References: CVE-2024-37891 CVE-2024-47081 CVE-2025-47273 CVE-2025-50181 CVE-2025-66418 CVE-2026-21441 CVE-2026-26007 CVSS scores: CVE-2024-37891 SUSE : 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N...

8.7CVSS6.8AI score0.02922EPSS
SaveExploits9
Tenable Nessus
Tenable Nessus•added 2026/04/13 12:00 a.m.•9 views

Amazon Linux 2023 : oci-add-hooks (ALAS2023-2026-1575)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1575 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or...

7.5CVSS6.7AI score0.00834EPSS
SaveExploits0References8
osv_opensuse
osv_opensuse•added 2026/04/13 12:00 a.m.•12 views

OPENSUSE-SU-2026:10539-1 oci-cli-3.76.2-1.1 on GA media

These are all security issues fixed in the oci-cli-3.76.2-1.1 package on the GA media of openSUSE Tumbleweed...

8.9CVSS6.5AI score0.02922EPSS
SaveExploits9References7
GithubExploit
GithubExploit•added 2026/04/10 3:52 a.m.•181 views

Exploit for CVE-2026-5530

CVE-2026-5530 Ollama SSRF via OCI registry redirect with full...

6.5CVSS6.9AI score0.00347EPSS
SaveExploits2
osv_go
osv_go•added 2026/04/02 6:42 p.m.•21 views

GO-2026-4911 Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF) in github.com/docker/model-runner

Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery SSRF in github.com/docker/model-runner...

9.1CVSS8AI score0.00289EPSS
SaveExploits0References1
Rows per page
Query Builder