CVE-2025-54867: UNIX Symbolic Link (Symlink) Following

Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version 0.5.5...

Ubuntu 14.04 LTS / 16.04 LTS : cifs-utils vulnerabilities (USN-7688-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7688-1 advisory. Aurlien Aptel discovered that cifs-utils invoked a shell when requesting a password. In certain environments, a local attacker could possibly...

Amazon ECS Container Agent 安全漏洞

Amazon ECS Container Agent is an elastic container service agent software open source by Amazon Web Services. A security vulnerability exists in Amazon ECS Container Agent that stems from the fact that under certain conditions, an introspective server can be accessed by other instances in the sam...

SUSE CVE-2025-7195

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, usersetup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used...

CVE-2025-40767

CVE-2025-40767 affects Siemens SINEC Traffic Analyzer (versions prior to 3.0). All connected sources consistently describe a weakness where the application runs docker containers without adequate isolation, enabling an attacker with local access to potentially gain elevated privileges and access ...

Network Isolation Bypass

github.com/moby/moby is vulnerable to network isolation bypass. The vulnerability is due to Docker failing to re-create iptables rules isolating bridge networks after firewalld reload, which allows an attacker to access all ports of containers across different bridge networks on the same host,...

nvidia-container-toolkit: Privilege Escalation via Hook Initialization in NVIDIA Container Toolkit

A flaw was found in the NVIDIA Container Toolkit. This vulnerability allows execution of arbitrary code with elevated permissions via improperly secured container initialization hooks. This can potentially lead to privilege escalation, data tampering, information disclosure, and denial of service...

nvidia-container-toolkit: Privilege Escalation via Hook Initialization in NVIDIA Container Toolkit

A flaw was found in the NVIDIA Container Toolkit. This vulnerability allows execution of arbitrary code with elevated permissions via improperly secured container initialization hooks. This can potentially lead to privilege escalation, data tampering, information disclosure, and denial of service...

Important: Red Hat Security Advisory: toolbox security update

An update for toolbox is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Moderate: Red Hat Security Advisory: Updated 7.1 container image is now available in the Red Hat Ecosystem Catalog

Updated rhceph-7.1 container image is now available in the Red Hat Ecosystem Catalog. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support...

OSV-2025-617 UNKNOWN WRITE in MP4_BoxFree

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=437783630 Crash type: UNKNOWN WRITE Crash state: MP4BoxFree MP4ReadBoxContainerChildrenIndexed MP4ReadBoxContainer...

ALSA-2025:13673 Important: toolbox security update

Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. Security Fixes: nvidia-container-toolkit: Privilege Escalation via Hook Initialization in NVIDIA Contain...

Siemens SINEC Traffic Analyzer 资源管理错误漏洞

Siemens SINEC Traffic Analyzer is a network traffic analysis tool from Siemens Germany. A resource management error vulnerability exists in Siemens SINEC Traffic Analyzer versions prior to V3.0, which stems from insufficient resource limitations in docker containers and could lead to a denial of...

PT-2025-32662

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to 3.0 Description: The application runs docker containers without adequate security controls to enforce isolation. This could allow an attacker to gain elevated access, potentially accessing sensitive ho...

RHEL 10 : toolbox (RHSA-2025:13674)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:13674 advisory. Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and...

Important: toolbox security update

Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. Security Fixes: nvidia-container-toolkit: Privilege Escalation via Hook Initialization in NVIDIA Contain...

ALSA-2025:13674 Important: toolbox security update

Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. Security Fixes: nvidia-container-toolkit: Privilege Escalation via Hook Initialization in NVIDIA Contain...

GO-2025-3830 Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker

Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker...

Linux Distros Unpatched Vulnerability : CVE-2024-6601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox 128, Firefox ESR 115.1...

Linux Distros Unpatched Vulnerability : CVE-2025-38369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using Running IDXD workloads in a container with the /dev directory mounted...