1234 matches found
CVE-2026-86114: Missing Authorization
Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts th...
PT-2026-86385
Name of the Vulnerable Software and Affected Versions Arcane versions prior to 2.0.0 Description Insufficient restrictions on template operations allow accounts with the default user role to create, modify, and delete compose templates, including instance-wide defaults. This allows for the...
owtf v2.7.0
Offensive Web Testing Framework OWTF OWASP OWTF helps penetration testers stay efficient and aligned with security standards such as the OWASP Web Security Testing Guide, the OWASP Top 10, PTES, and NIST so that they have more time to: See the big picture and think outside the box. Efficiently...
CVE-2026-85391
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...
CVE-2026-85391 Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...
django-DefectDojo v3.2.400
DefectDojo | ---|--- DefectDojo is a DevSecOps, ASPM application security posture management, and vulnerability management tool. DefectDojo orchestrates end-to-end security testing, vulnerability tracking, deduplication, remediation, and reporting. Demo Pro Edition: pro.demo.defectdojo.com OWASP...
AZL-99207 CVE-2026-78662 affecting package docker-compose for versions less than 2.27.0-14
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...
AZL-99210 CVE-2026-56855 affecting package docker-compose for versions less than 2.27.0-14
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...
EUVD-2026-63905
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name...
CVE-2026-77776: Authorization Bypass Through User-Controlled Key
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name...
ANT-2026-6FH6D5TF · supabase/supabase · other
other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-6FH6D5TF: Hardcoded Realtime tenant-credential encryption key with no override In docker/docker-compose.yml the...
GO-2025-3527 vulnerabilities
Vulnerabilities for packages: kubescape, docker-compose, docker-compose-fips...
GO-2025-3699 vulnerabilities
Vulnerabilities for packages: neuvector-scanner, neuvector-fips, docker-compose, docker-compose-fips, neuvector...
GO-2026-4859 vulnerabilities
Vulnerabilities for packages: buildah-fips, zot, docker-compose, skaffold-fips, docker-cli-buildx, conftest-fips, conftest, trivy-fips, buildah, kaniko-fips, osv-scanner, kubescape-server, docker-cli-buildx-fips, podman-fips, guac, scorecard, skaffold, trivy-operator, podman, trivy-operator-fips,...
GO-2025-3900 vulnerabilities
Vulnerabilities for packages: k9s-fips, jitsucom-bulker, bank-vaults, kyverno, istio-fips, beats-fips, rancher-security-scan, grafana-fips, pluto-fips, ratify-fips, neuvector-sigstore-interface-fips, kyverno-notation-aws-fips, beats, tkn-fips, zitadel, boring-registry-fips, docker-compose-fips,...
GO-2023-2331 vulnerabilities
Vulnerabilities for packages: buildkitd, volume-modifier-for-k8s, docker-compose, temporal-server, metrics-server-fips, kubevela, envoy-ratelimit, kubernetes-csi-external-resizer, cri-tools, temporal, prometheus-adapter-fips, aws-ebs-csi-driver, rancher-webhook, k3s, kubernetes, prometheus-adapte...
GO-2025-3527 vulnerabilities
Vulnerabilities for packages: docker-compose, kubescape...
GO-2025-3699 vulnerabilities
Vulnerabilities for packages: neuvector-scanner, docker-compose...