CVE-2026-103053

AiSOC versions 9.0.0 before 12.0.0 are vulnerable to an authentication bypass in the response-action API endpoints . This flaw occurs when AISOC_DEV_MODE is enabled and the AISOC_ACTIONS_SERVICE_TOKEN is empty within a default Docker Compose deployment. An unauthenticated attacker can exploit thi...

CVE-2026-103053: Missing Authentication for Critical Function

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

holos v0.6.3

Docker compose for KVM. Define multi-VM stacks in one YAML file. No libvirt, no XML, no distributed control plane. Website and docs: https://zeroecco.github.io/holos/ The primitive is a VM, not a container. Every workload instance gets its own kernel boundary, qcow2 overlay, cloud-init seed, and...

CLEANSTART-2026-QH82064 Security fix for GHSA-4c29-8rgm-jvjj applied in: docker 29.3.0-r1, docker-compose 5.1.0-r0

GHSA-4c29-8rgm-jvjj affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IP63543 Security fix for CVE-2026-33747 applied in: docker-compose 5.1.0-r0

Security vulnerability affects the docker-compose package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100781

Security vulnerability affects the docker-compose package. This issue is resolved in later releases. See references for vulnerability details...

codex-security npm-v0.1.28

Codex Security @openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code. Features Scan repositories, selected paths, or Git changes. Deep scans run parallel discovery workers on repositories and selected paths. Validate candidate...

sonar v0.9.1

██████ ███ ██████ ██ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ███ ██ ██ ██ ██ ██ ██ Know what's running on your machine. Sonar shows everything listening on localhost and puts it in order: every port belongs to a group — normally th...

django-DefectDojo v3.3.100

DefectDojo | ---|--- DefectDojo is a DevSecOps, ASPM application security posture management, and vulnerability management tool. DefectDojo orchestrates end-to-end security testing, vulnerability tracking, deduplication, remediation, and reporting. Demo Pro Edition: pro.demo.defectdojo.com OWASP...

AZL-101025 CVE-2026-84445 affecting package docker-compose 2.27.0-14

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

CVE-2026-53495 vulnerabilities

Vulnerabilities for packages: headlamp-fips, rancher-helm, grype-db, kube-arangodb-fips, kgateway-fips, cloudbeat, cloudbeat-fips, harvester, kubescape, tigera-operator, kubescape-operator, cluster-api-helm-controller, trivy-operator, kaniko-fips, xeol-fips, helm-mapkubeapis, k9s,...

GHSA-7JXH-36Q5-GCQV vulnerabilities

Vulnerabilities for packages: headlamp-fips, rancher-helm, grype-db, kube-arangodb-fips, kgateway-fips, cloudbeat, cloudbeat-fips, harvester, kubescape, tigera-operator, kubescape-operator, cluster-api-helm-controller, trivy-operator, kaniko-fips, xeol-fips, helm-mapkubeapis, k9s,...

GHSA-7JXH-36Q5-GCQV vulnerabilities

Vulnerabilities for packages: syft, cluster-api-helm-controller, rancher-helm, kubevela, docker-cli-buildx, k8sgpt, grype, dagger, kube-arangodb, headlamp, steampipe, kaniko, helm, buildkitd, helm-mapkubeapis, manifest-tool, docker-compose, kubescape-operator, nerdctl, helm-operator, gatekeeper,...

CVE-2026-53495 vulnerabilities

Vulnerabilities for packages: syft, cluster-api-helm-controller, rancher-helm, kubevela, docker-cli-buildx, k8sgpt, grype, dagger, kube-arangodb, headlamp, steampipe, kaniko, helm, buildkitd, helm-mapkubeapis, manifest-tool, docker-compose, kubescape-operator, nerdctl, helm-operator, gatekeeper,...

CVE-2026-54248: Improper Verification of Cryptographic Signature

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify tha...

CVE-2026-86464: Exposure of Sensitive Information to an Unauthorized Actor

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager IdM deployment included insecure default configurations and credentials for security-sensitive services. The Helm chart exposed the Keycloak service and its PostgreSQL...

vuln_apps

vulnapps 一系列故意存在漏洞的应用，用于将安全工具（crossfyre、Burp、ZAP、nuclei 等）指向目标。此文件夹不包含任何应用源码 ，只有骨架定义和一个小型管理器。每个应用都作为自己独立的容器栈运行，因此不会相互冲突。 这里的一切都是故意有漏洞的。仅供本地测试。 请勿将这些暴露到互联网或不受信任的网络。所有端口都绑定到 127.0.0.1。 工作原理 docker compose up 启动一个容器：vulnappsmanager （控制平面）。它本身不会启动任何漏洞应用。 你通过管理器来驱动整个应用集群。每个应用由 apps// 下的一个骨架文件夹（一个...

owtf v2.7.0

Offensive Web Testing Framework OWTF OWASP OWTF helps penetration testers stay efficient and aligned with security standards such as the OWASP Web Security Testing Guide, the OWASP Top 10, PTES, and NIST so that they have more time to: See the big picture and think outside the box. Efficiently...

CVE-2026-85391

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...

CVE-2026-85391 Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...