CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

CVE-2026-16763

CVE-2026-16763 affects localstack serverless-localstack up to version 1.4.0. The vulnerability targets an unknown function in src/index.js of the Configuration Handler, where manipulating the argument custom.localstack.docker.compose_file enables local OS command injection. The CVE describes loca...

CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

PYSEC-2026-3508 PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

Summary Setting PRAISONAICALLAUTH=disabled completely disables all authentication on the /api/v1/agents/id/invoke endpoint. This bypass is advertised in the application's own error messages, making it likely to appear in production Docker and Compose configurations. Details python...

PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

SummarySetting PRAISONAICALLAUTH=disabled completely disables all authentication on the /api/v1/agents/id/invoke endpoint. This bypass is advertised in the application's own error messages, making it likely to appear in production Docker and Compose configurations. Detailspython...

PT-2026-64183

Name of the Vulnerable Software and Affected Versions localstack serverless-localstack versions prior to 1.4.1 Description An OS command injection issue exists within the Configuration Handler component in the src/index.js file. This occurs when the custom.localstack.docker.compose file argument ...

PT-2026-64114

Summary Setting PRAISONAI CALL AUTH=disabled completely disables all authentication on the /api/v1/agents/id/invoke endpoint. This bypass is advertised in the application's own error messages, making it likely to appear in production Docker and Compose configurations. Details python...

AZL-93171 CVE-2026-56852 affecting package docker-compose for versions less than 2.27.0-13

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

SUSE-SU-2026:22887-1 Security update for docker-compose

This update for docker-compose fixes the following issues - CVE-2025-0495: buildx: credential leakage to telemetry endpoints when credentials allowed to be set as attribute values in cache-to/cache-from configuration bsc1239766. - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the...

CVE-2026-33692

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which...

CVE-2026-33692

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which...

CVE-2026-33692 AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which...

CVE-2026-33692 AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which...

CVE-2026-33692 AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which...

EUVD-2026-45037

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which...

CVE-2026-33692

Summary: CVE-2026-33692 affects WWBN AVideo prior to 29.0, where the official Docker Compose configuration exposes the project’s .env file to unauthenticated users via the root path (/.env). The docker-compose.yml mounts the entire project root as the Apache document root, allowing access to sens...

CVE-2026-33692: Improper Input Validation

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The official docker-compose.yml mounts the entire project root directory as the Apache document root, causing the .env file — which...

[SECURITY] Fedora 43 Update: docker-compose-5.3.0-1.fc43

Define and run multi-container applications with Docker...

openSUSE 16 Security Update : docker-compose (openSUSE-SU-2026:21247-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21247-1 advisory. This update for docker-compose fixes the following issues - CVE-2025-0495: buildx: credential leakage to telemetry endpoints when credentials...