bento

Ce logiciel est expérimental mais nous acceptons les suggestions et contributions Bento Toolkit pour PT et CTF Un bento 弁当, bentō est un repas individuel à emporter ou préparé à la maison d’origine japonaise. Bento Toolkit est un conteneur Docker simple et minimal pour les testeurs d’intrusion et...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: kubescape, ollama-fips, seaweedfs, nemo, kubescape-server-fips, mailpit-fips, rclone-fips, bento-fips, kitty, kubescape-server, fortio, mailpit, gitea, seaweedfs-operator, seaweedfs-operator-fips, mattermost-fips, ollama, seaweedfs-rocksdb-fips, gitea-fips, mattermos...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: pdfcpu, kitty, seaweedfs, gitea, mattermost, bento, ollama, rclone, mailpit, kubescape...

CVE-2026-46603 vulnerabilities

Vulnerabilities for packages: pdfcpu, kitty, seaweedfs, gitea, mattermost, bento, ollama, rclone, mailpit, kubescape...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: steampipe, splunk-otel-collector, teleport, splunk-otel-collector-fips, bento-fips, grafana-alloy-fips, grafana-alloy, telegraf, bento, kots...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: atlantis-fips, peerdb-flow, kubernetes-event-exporter, ory-kratos-fips, argo-rollouts-fips, ory-kratos, argo-events, bento-fips, kyverno-policy-reporter-fips, argo-rollouts, argo-events-fips, kyverno-policy-reporter, atlantis, goreleaser, argo-cd-fips,...

GO-2025-4173 vulnerabilities

Vulnerabilities for packages: elastic-agent-fips, dapr, agentbeat-fips, dapr-fips, falcosidekick-fips, zabbix-agent2-fips, falcosidekick, telegraf, minio, beats-fips, zabbix-agent2, agentbeat, influxd, beats, elastic-agent, minio-fips, bento...

GO-2025-4173 vulnerabilities

Vulnerabilities for packages: falcosidekick, bento, minio...

GO-2026-4518 vulnerabilities

Vulnerabilities for packages: grafana-alloy, bento, telegraf, splunk-otel-collector, steampipe, kots...

GO-2026-4961 vulnerabilities

Vulnerabilities for packages: pdfcpu, seaweedfs, gitea, bento, kubescape, ollama, rclone, mattermost...

GO-2026-5061 vulnerabilities

Vulnerabilities for packages: pdfcpu, seaweedfs, gitea, bento, kubescape, ollama, rclone, mailpit, mattermost...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: goreleaser, argo-cd, atlantis, kyverno-policy-reporter, kubernetes-event-exporter, bento, kubewatch, argo-events, argo-rollouts...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, cluster-api-aws-controller, grafana-alloy, sqlexporter, bento, amazon-cloudwatch-agent, jitsucom-bulker, argo-events, splunk-otel-collector...

Exploit for Deserialization of Untrusted Data in Bentoml

CVE-2025-27520 exploit for CVE-2025-27520 A Remote Code Execut...

PYSEC-2026-1218 BentoML has a Path Traversal via Bentofile Configuration

Summary BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate, conda.environmentyml. An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files fr...

BentoML SSRF Vulnerability in File Upload Processing

DescriptionThere's an SSRF in the file upload processing system that allows remote attackers to make arbitrary HTTP requests from the server without authentication. The vulnerability exists in the serialization/deserialization handlers for multipart form data and JSON requests, which automaticall...

CVE-2026-41653

BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site scripting vulnerability was identified in BentoPD. An attacker may be able to execute arbitrary JavaScript in certain circumstances in Markdown to PDF Tool. This issue has been patched in version 2.8...

PYSEC-2026-189

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/internal/container/frontend/dockerfile/templates/basev2.j2 interpolates docker.baseimage raw with no escaping, newline filtering, or validation. A malicious...

PYSEC-2026-190

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs.name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentom...

CVE-2026-44345 BentoML: Dockerfile command injection via docker.base_image

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/internal/container/frontend/dockerfile/templates/basev2.j2 interpolates docker.baseimage raw with no escaping, newline filtering, or validation. A malicious...