klar

Klar Clair और Docker Registry का एकीकरण Clair API v1 और v3 दोनों का समर्थन करता है Klar एक सरल उपकरण है जो Clair https://github.com/coreos/clair का उपयोग करके एक निजी या सार्वजनिक Docker रजिस्ट्री में संग्रहीत छवियों की सुरक्षा कमजोरियों का विश्लेषण करता है। Klar को एक एकीकरण उपकरण के रूप में उपय...

klar

Klar Integration of Clair and Docker Registry supports both Clair API v1 and v3 Klar is a simple tool to analyze images stored in a private or public Docker registry for security vulnerabilities using Clair https://github.com/coreos/clair. Klar is designed to be used as an integration tool so it...

CVE-2019-16097-batch

CVE-2019-16097-batch Haftungsausschluss Nur für Sicherheitsforschung verwenden, keine illegalen Tests durchführen. Die Konsequenzen trägt der Benutzer selbst!!! CVE-2019-16097-batch Batch-Exploit-Skript Ziele in der Datei url.txt in Batches hinzufügen http://1.1.1.1 http://2.2.2.2 Führen Sie dies...

ictf-framework

Il Framework iCTF 3.0 Questo è il framework che Shellphish utilizza per ospitare l'iCTF. Il Framework iCTF è descritto in un articolo presentato al workshop Usenix 3GSE nel 2014. Abbiamo rilasciato questo framework nella speranza che permetta a educatori e formatori di ospitare i propri CTF A/D...

CVE-2026-21005-Docker-Registry-V2-Schema-1-Image-Poisoning

CVE-2026-21005 – Envenenamento de Imagens no Docker Registry V2 Schema 1 Código do Programa Python Flask + Shell root@kitploit: dockerregistrysim.py - Simulated registry that serves schema1 manifests from flask import Flask, request, jsonify app = Flaskname images = 'myapp': 'v1': 'layers':...

jenkinsci__docker-commons-plugin_CVE-2022-20617_1-17

Docker Commons API Plugin für Jenkins API-Plugin, das die gemeinsame Funktionalität für verschiedene Docker-bezogene Plugins bereitstellt. Zusammenfassung API zum Verwalten von Docker-Image- und Container-Fingerabdrücken Anmeldeinformationen und Standort der Docker-Registry Anmeldeinformationen u...

go-pillage-registries

go-pillage-registries यह प्रोजेक्ट एक Docker रजिस्ट्री लेता है और उसकी सूची catalog में मौजूद प्रत्येक इमेज के manifest और configuration को निकालता है। यह Google के crane कमांड के पैकेज का उपयोग करता है, जो Docker की keychain semantics का पालन करता है। यदि आप इसे ओवरराइड करना चाहते हैं, तो...

CVE-2019-16097

CVE-2019-16097-batch Isenção de responsabilidade Apenas para uso em pesquisas de segurança. Não realize testes ilegais. As consequências são de sua própria responsabilidade!!! CVE-2019-16097-batch Script de exploração em lote Adicione endereços de destino em lote no arquivo url.txt http://1.1.1.1...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

CVE-2026-49349 regclient may leak authentication credentials to external blob stores

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs f...

PYSEC-2026-2391 BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing

The dockerpull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication reques...

BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing

The dockerpull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication reques...

Astra Linux – Vulnerability in Docker-Registry

A flaw was discovered in the /v2/catalog endpoint located in the distribution/distribution directory. This endpoint accepts a parameter that controls the maximum number of records to be returned query string: n. This vulnerability allows a malicious user to submit an excessively large value for n...

PT-2026-39313

🔴 Docker Registry Auth Substring Match Forwards Credentials to a Different Registry CVE-2025-27119, High https://t.co/gO08whMpWZ...

Exploit for CVE-2026-7482

CVE-2026-7482: Ollama Heap Out-of-Bounds Read 1-Day PoC Thi...

org.keycloak/keycloak-services: Keycloak: Missing Check on Disabled Client for Docker Registry Protocol

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously...

GHSA-FJF4-6F34-W64Q Keycloak: Missing Check on Disabled Client for Docker Registry Protocol

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously...

CVE-2026-2733 Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously...

CVE-2026-2733 Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously...

malcontent OCI image pull credential exfiltration via malicious registry token realm

Malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. Malcontent uses google/go-containerregistry for OCI image pulls, which by default uses the Docker credential keychain. A malicious registry could return a WWW-Authenticate header...