600 matches found
GHSA-Q4H4-GMJ2-QVW2 vulnerabilities
Vulnerabilities for packages: gatus, src, crossplane-provider-aws-emr-fips, crossplane-provider-aws-ram, crossplane-provider-family-aws, longhorn-cli-fips, vault-benchmark, apply-cve-bump, gitlab-runner-fips, witness, consul-fips, google-guest-agent-manager, jfrog-cli,...
GO-2026-5308 Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend...
Astra Linux – Vulnerability in docker.io-app
Docker Compose relies on the path information embedded in remote OCI Compose artifacts. When a layer includes the annotations com.dockercompose.extends or com.dockercompose.envfile, Compose incorporates the value provided by the attacker from com.dockercompose.file/com.dockercompose.envfile into...
CVE-2026-53492 vulnerabilities
Vulnerabilities for packages: harvester-fips, docker-cli-buildx, trivy, helm-mapkubeapis, redpanda-operator, gatekeeper, tekton-pipelines-fips, envoy-gateway-fips, jfrog-cli, helm, neuvector, kubescape-operator, rancher-helm, packer-fips, trivy-fips, dagger, beats, datadog-agent-fips,...
GHSA-CVXM-645Q-P574 vulnerabilities
Vulnerabilities for packages: harvester-fips, docker-cli-buildx, trivy, helm-mapkubeapis, redpanda-operator, gatekeeper, tekton-pipelines-fips, envoy-gateway-fips, jfrog-cli, helm, neuvector, kubescape-operator, rancher-helm, packer-fips, trivy-fips, dagger, beats, datadog-agent-fips,...
GHSA-33VJ-92QQ-66HC vulnerabilities
Vulnerabilities for packages: harvester-fips, docker-cli-buildx, trivy, helm-mapkubeapis, redpanda-operator, gatekeeper, tekton-pipelines-fips, envoy-gateway-fips, jfrog-cli, helm, neuvector, kubescape-operator, rancher-helm, packer-fips, trivy-fips, dagger, beats, datadog-agent-fips,...
CVE-2026-53489 vulnerabilities
Vulnerabilities for packages: harvester-fips, docker-cli-buildx, trivy, helm-mapkubeapis, redpanda-operator, gatekeeper, tekton-pipelines-fips, envoy-gateway-fips, jfrog-cli, helm, neuvector, kubescape-operator, rancher-helm, packer-fips, trivy-fips, dagger, beats, datadog-agent-fips,...
CVE-2026-50195 vulnerabilities
Vulnerabilities for packages: harvester-fips, docker-cli-buildx, trivy, helm-mapkubeapis, redpanda-operator, gatekeeper, tekton-pipelines-fips, envoy-gateway-fips, jfrog-cli, helm, neuvector, kubescape-operator, rancher-helm, packer-fips, trivy-fips, dagger, beats, datadog-agent-fips,...
GHSA-JPCC-P29G-P8MQ vulnerabilities
Vulnerabilities for packages: harvester-fips, docker-cli-buildx, trivy, helm-mapkubeapis, redpanda-operator, gatekeeper, envoy-gateway-fips, jfrog-cli, helm, neuvector, kubescape-operator, rancher-helm, packer-fips, trivy-fips, dagger, datadog-agent-fips, kubescape-server-fips, tigera-operator,...
GHSA-XHF5-7WJV-PQXP vulnerabilities
Vulnerabilities for packages: harvester-fips, docker-cli-buildx, trivy, helm-mapkubeapis, redpanda-operator, gatekeeper, envoy-gateway-fips, jfrog-cli, helm, neuvector, kubescape-operator, rancher-helm, packer-fips, trivy-fips, dagger, datadog-agent-fips, kubescape-server-fips, tigera-operator,...
GHSA-WF69-R4MX-43RR AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
Vulnerability Details CWE: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory The official docker-compose.yml line 61 mounts the entire project root directory as the Apache document root: yaml volumes: - "./:/var/www/html/AVideo" This causes the .env file —...
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
Vulnerability Details CWE: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory The official docker-compose.yml line 61 mounts the entire project root directory as the Apache document root: yaml volumes: - "./:/var/www/html/AVideo" This causes the .env file —...
Files or Directories Accessible to External Parties
Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the official Docker Compose configuration, which mounts the project root directory as the Apache document...
PT-2026-51433
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 Description AVideo exposes sensitive .env files to unauthenticated users when deployed using the official Docker compose configuration. The docker-compose.yml file mounts the entire project root directory as the...
PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication
Summary Setting PRAISONAICALLAUTH=disabled completely disables all authentication on the /api/v1/agents/id/invoke endpoint. This bypass is advertised in the application's own error messages, making it likely to appear in production Docker and Compose configurations. Details python...
GHSA-8CCJ-P46R-JWQQ PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication
Summary Setting PRAISONAICALLAUTH=disabled completely disables all authentication on the /api/v1/agents/id/invoke endpoint. This bypass is advertised in the application's own error messages, making it likely to appear in production Docker and Compose configurations. Details python...
cybersec-bad-folio
DevFolio Application portfolio étudiant — Spring Boot 3.2 + V...
CVE-2026-39833 affecting package docker-compose for versions less than 2.27.0-13
CVE-2026-39833 affecting package docker-compose for versions less than 2.27.0-13. A patched version of the package is available...