733 matches found
CVE-2026-53495 vulnerabilities
Vulnerabilities for packages: manifest-tool, docker-compose, chartmuseum, neuvector-scanner, syft, steampipe, trivy-operator, dagger, skaffold, helm-mapkubeapis, helm-set-status, scorecard, k8sgpt, kubescape, docker-cli-buildx, k9s, rancher-helm, fuse-overlayfs-snapshotter, kargo, k3s, docker,...
GHSA-7JXH-36Q5-GCQV vulnerabilities
Vulnerabilities for packages: manifest-tool, docker-compose, chartmuseum, neuvector-scanner, syft, steampipe, trivy-operator, dagger, skaffold, helm-mapkubeapis, helm-set-status, scorecard, k8sgpt, kubescape, docker-cli-buildx, k9s, rancher-helm, fuse-overlayfs-snapshotter, kargo, k3s, docker,...
CVE-2026-54248: Improper Verification of Cryptographic Signature
Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify tha...
CVE-2026-86464: Exposure of Sensitive Information to an Unauthorized Actor
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager IdM deployment included insecure default configurations and credentials for security-sensitive services. The Helm chart exposed the Keycloak service and its PostgreSQL...
vuln_apps
vulnapps 一系列故意存在漏洞的应用，用于将安全工具（crossfyre、Burp、ZAP、nuclei 等）指向目标。此文件夹不包含任何应用源码 ，只有骨架定义和一个小型管理器。每个应用都作为自己独立的容器栈运行，因此不会相互冲突。 这里的一切都是故意有漏洞的。仅供本地测试。 请勿将这些暴露到互联网或不受信任的网络。所有端口都绑定到 127.0.0.1。 工作原理 docker compose up 启动一个容器：vulnappsmanager （控制平面）。它本身不会启动任何漏洞应用。 你通过管理器来驱动整个应用集群。每个应用由 apps// 下的一个骨架文件夹（一个...
owtf v2.7.0
Offensive Web Testing Framework OWTF OWASP OWTF helps penetration testers stay efficient and aligned with security standards such as the OWASP Web Security Testing Guide, the OWASP Top 10, PTES, and NIST so that they have more time to: See the big picture and think outside the box. Efficiently...
CVE-2026-85391
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...
CVE-2026-85391 Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...
django-DefectDojo v3.2.400
DefectDojo | ---|--- DefectDojo is a DevSecOps, ASPM application security posture management, and vulnerability management tool. DefectDojo orchestrates end-to-end security testing, vulnerability tracking, deduplication, remediation, and reporting. Demo Pro Edition: pro.demo.defectdojo.com OWASP...
AZL-99207 CVE-2026-78662 affecting package docker-compose 2.27.0-13
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...
AZL-99210 CVE-2026-56855 affecting package docker-compose 2.27.0-13
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...
EUVD-2026-63905
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name...
CVE-2026-77776: Authorization Bypass Through User-Controlled Key
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name...
ANT-2026-6FH6D5TF · supabase/supabase · other
other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-6FH6D5TF: Hardcoded Realtime tenant-credential encryption key with no override In docker/docker-compose.yml the...
GO-2025-3527 vulnerabilities
Vulnerabilities for packages: docker-compose, kubescape, docker-compose-fips...
GO-2025-3699 vulnerabilities
Vulnerabilities for packages: docker-compose, docker-compose-fips, neuvector, neuvector-fips, neuvector-scanner...
GO-2026-4859 vulnerabilities
Vulnerabilities for packages: docker-compose, kubescape-server, kaniko, kubescape, docker-compose-fips, livekit-cli, guac, cloudbeat, conftest-fips, kaniko-fips, podman-fips, skaffold-fips, skaffold, conftest, zot, podman, docker-fips, trivy-operator-fips, buildah, scorecard, trivy, trivy-fips,...
GO-2025-3900 vulnerabilities
Vulnerabilities for packages: kyverno, docker-compose-fips, jitsucom-bulker, boring-registry-fips, zitadel, grafana, ratify-fips, beats, mattermost-fips, k9s-fips, kyverno-notation-aws-fips, bank-vaults, grafana-fips, beats-fips, istio-fips, tkn-fips, neuvector-sigstore-interface-fips,...
GO-2023-2331 vulnerabilities
Vulnerabilities for packages: docker-compose, rancher-webhook-fips, kubescape, metrics-server, volume-modifier-for-k8s, temporal-server-fips, metrics-server-fips, kube-oidc-proxy, k3s, rancher-webhook, aws-ebs-csi-driver, temporal-server, cri-tools, kubevela, temporal-fips, kubernetes, buildkitd,...