EUVD-2026-101424

Talos Linux: Support bundle does not redact registry credentials...

Talos Linux: Support bundle does not redact registry credentials

Summary When generating a support bundle with talosctl support the credentials entered for private registries are included in the bundle. Details Within the generated support bundle, inside resources/registryconfigs.cri.talos.dev.yaml the auth field of the spec is retained. The same, potentially...

cve-2026-59891-control-lab

CVE-2026-59891 Regression & Control Lab An isolated hands-on lab and read-only audit project that compares the actual vulnerable and fixed versions of @sigstore/oci with the same input and checks environment-specific exposure conditions. The CVE Reporter for this project is gyubin02...

CVE-2026-77564 Talos Linux: Support bundle does not redact registry credentials

Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking...

CVE-2026-77564

In Talos Linux versions prior to 1.12.9 and 1.13.3 , the talosctl utility fails to redact sensitive information when generating support bundles. Specifically, the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml are included...

EUVD-2026-91767

@nx/docker: OS command injection in the @nx/docker release pipeline...

CVE-2026-104859 Nx: OS command injection in the @nx/docker release pipeline

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

CVE-2026-104859 Nx: OS command injection in the @nx/docker release pipeline

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

PT-2026-104410

Name of the Vulnerable Software and Affected Versions Nx versions 21.4.0 through 22.7.7 Nx versions 23.0.0 through 23.1.0 Description The @nx/docker release pipeline constructs docker tag, image lookup, and docker push invocations as shell command strings. The configuration values...

CVE-2026-93537

SUSE Rancher Fleet is vulnerable to a path traversal vulnerability in the Helm valuesFiles component. An attacker with permission to supply bundle content to a GitRepo resource (e.g., via Git push access) can force the system to read arbitrary files from the filesystem of the bundle-processing en...

CVE-2026-65388

A remote attacker controlling a container registry can exploit this vulnerability to redirect a client's token request to an arbitrary host, leading to the disclosure of the victim's registry credentials . The flaw is addressed in containerization version 0.41.0 . Additionally, the Berthly 1.3.1 ...

CVE-2026-85469

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

CVE-2026-85469 Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

PT-2026-94091

Name of the Vulnerable Software and Affected Versions quay-builder-qemu affected versions not specified Description A flaw exists where the release workflow uses the upstream Noelware/docker-manifest-action pinned to a mutable branch. A remote attacker could compromise this upstream action to...

CVE-2026-88887

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...

CVE-2026-88882

Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...

CVE-2026-88887 Renovate before 44.11.2 Credential Exfiltration via Link Header

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...

EUVD-2026-55745

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...

CVE-2026-72879

Summary: Dokploy before version 0.29.8 is affected by a command injection in getRegistryCommands() when building a shell command from registry.password and registry.registryUrl in packages/server/src/utils/cluster/upload.ts. An authenticated user with project access can supply malicious registry ...

CVE-2026-72879 Dokploy: Command Injection via Registry Credentials in Swarm Upload

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...