GO-2026-4859 vulnerabilities

Vulnerabilities for packages: docker-cli-buildx, cloudbeat-fips, kaniko-fips, conftest, livekit-cli, conftest-fips, guac, trivy-operator, docker-fips, zot, podman-fips, trivy-fips, skaffold, kubescape-server-fips, docker-compose-fips, docker-cli-buildx-fips, docker-compose, kubescape,...

GO-2025-3900 vulnerabilities

Vulnerabilities for packages: zitadel, jitsucom-bulker, pluto-fips, tkn-fips, beats-fips, bank-vaults, boring-registry-fips, grafana-fips, neuvector-sigstore-interface-fips, mattermost-fips, k9s-fips, docker-compose-fips, istio-fips, rancher-security-scan, beats, grafana, kyverno, ratify-fips,...

GO-2023-2331 vulnerabilities

Vulnerabilities for packages: kube-oidc-proxy, rancher-webhook-fips, temporal-server-fips, temporal-server, volume-modifier-for-k8s, cri-tools, envoy-ratelimit, kubevela, k3s, prometheus-adapter-fips, docker-compose, temporal-fips, kubescape, buildkitd, prometheus-adapter, rancher-webhook,...

GO-2025-3527 vulnerabilities

Vulnerabilities for packages: kubescape, docker-compose...

GO-2025-3699 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, docker-compose...

GO-2026-4859 vulnerabilities

Vulnerabilities for packages: scorecard, podman, trivy-operator, docker-compose, guac, skaffold, trivy, buildah, osv-scanner, kubescape, kaniko, zot, docker-cli-buildx, conftest...

GO-2026-4858 vulnerabilities

Vulnerabilities for packages: scorecard, podman, trivy-operator, docker-compose, guac, skaffold, trivy, buildah, osv-scanner, kubescape, kaniko, zot, docker-cli-buildx, conftest...

GO-2024-2737 vulnerabilities

Vulnerabilities for packages: grype, neuvector-scanner, helm-push, kaniko, dagger, melange, cri-tools, docker-compose, policy-controller, buf, wolfictl, syft, k3d, harbor-scanner-trivy...

GO-2025-3830 vulnerabilities

Vulnerabilities for packages: dagger, falcoctl, buf, syft, nerdctl, buildkitd, buildah, splunk-otel-collector, opentelemetry-collector-contrib, apko, grype, opentelemetry-collector, goreleaser, openfga, trivy, osv-scanner, zot, docker-cli-buildx, spire-server, k9s, cadvisor, zarf, melange,...

GO-2024-2659 vulnerabilities

Vulnerabilities for packages: dagger, buf, syft, kaniko, conftest, buildkitd, kubescape, grype, aactl, ko, trivy, tkn, up, zot, spire-server, cadvisor, cilium-cli, melange, docker-compose, wolfictl, crossplane, kargo, ctop...

CVE-2026-72865 Dokploy: OS Command Injection via compose `composePath`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c,...

CVE-2026-72865

Dokploy prior to 0.29.13 suffers an OS command injection via an unvalidated composePath used by the compose.update/deploy flow. An authenticated user with compose write and deploy permissions can craft a path that is interpolated into docker commands (docker compose -f, docker stack deploy -c) an...

CVE-2026-71289

The CVE affects NASA-AMMOS ANMS and JHUAPL-DTNMA/dtnma-tools. The default docker-compose setup exposes the amp-manager REST API on the host network (port 8089) with NET_ADMIN/NET_RAW/SYS_NICE and bypasses the CAM gateway, placing the REST server (CivetWeb, nm_rest.c) in a state where enable_auth_...

EUVD-2026-53374

The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. "$IONMGRPORT:-8089:8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the C...

CVE-2026-71289

The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. ":8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the CAM Configuration...

SUSE CVE-2026-47179

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because...

Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory

Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-59726 CVSS score: 10.0, impacts all...

EUVD-2026-48434

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

CVE-2026-16763

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...