PT-2026-5722

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.1.29 Description A command injection issue exists in the Docker sandbox execution mechanism due to unsafe handling of the PATH environment variable when constructing shell commands. An authenticated user with th...

PT-2026-6421

Summary 1. A hardcoded secret key used for signing JWTs is checked into source code 2. ManyAPI routes do not check authentication Details I am using the publicly available docker image at ghcr.io/maziggy/bambuddy 1. Hardcoded JWT Secret Key...

OpenClaw 操作系统命令注入漏洞

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw there is an operating system command injection vulnerability , the vulnerability stems from the Docker sandbox execution mechanism when constructing shell commands on the PATH environment variable handling insecurity ,...

EulerOS 2.0 SP13 : docker-runc (EulerOS-SA-2026-1208)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 throug...

Exploit for Unrestricted Upload of File with Dangerous Type in Gvectors Wpdiscuz

wpDiscuz-7.0.4-PoC-RCE - wpDiscuz 7.0.4 - Unauthenticated RCE...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: redka, aws-signer-notation-plugin, spqr, kubernetes-dashboard-api, wave, sriov-network-device-plugin, gobuster, bom, fuse-overlayfs-snapshotter, grafana-operator, openbao-k8s, tetragon, crossplane-provider-aws-elasticache, yunikorn-k8shim, ferretdb, metallb,...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-livenessprobe, vault-benchmark, terraform-provider-pagerduty, helm-set-status, redka, traefik, pgtimetable, azure-workload-identity-webhook, kyverno-policy-reporter-ui, rancher-loglevel, k3d, kubescape-operator, aws-signer-notation-plugin, sops,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: kubernetes-csi-livenessprobe, vault-benchmark, terraform-provider-pagerduty, helm-set-status, redka, traefik, pgtimetable, azure-workload-identity-webhook, kyverno-policy-reporter-ui, rancher-loglevel, k3d, kubescape-operator, aws-signer-notation-plugin, sops,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: redka, aws-signer-notation-plugin, spqr, kubernetes-dashboard-api, wave, sriov-network-device-plugin, gobuster, bom, fuse-overlayfs-snapshotter, grafana-operator, openbao-k8s, tetragon, crossplane-provider-aws-elasticache, yunikorn-k8shim, ferretdb, metallb,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: redka, aws-signer-notation-plugin, spqr, kubernetes-dashboard-api, wave, sriov-network-device-plugin, gobuster, bom, fuse-overlayfs-snapshotter, grafana-operator, openbao-k8s, tetragon, crossplane-provider-aws-elasticache, yunikorn-k8shim, ferretdb, metallb,...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-livenessprobe, vault-benchmark, terraform-provider-pagerduty, helm-set-status, redka, traefik, pgtimetable, azure-workload-identity-webhook, kyverno-policy-reporter-ui, rancher-loglevel, k3d, kubescape-operator, aws-signer-notation-plugin, sops,...

CVE-2026-25116

Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the UserConfigController allows any remote user to overwrite the system's docker-compose.yml configuration file. By exploiting insecure URN...

Directory Traversal

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Directory Traversal via the TechdocsGenerator function when processing documentation from...

CVE-2026-25152

The CVE-2026-25152 entry concerns the Backstage @backstage/plugin-techdocs-node, where versions before 1.13.11 and 1.14.1 allow path traversal via the TechDocs local generator when techdocs.generator.runIn is set to local. This permits reading arbitrary host files as MkDocs follows symlinks in do...

CVE-2026-25152 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, a path traversal vulnerability in the TechDocs local generator allow...

EUVD-2026-5004

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured with runIn: local, a malicious actor who...

Arbitrary Code Injection

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Arbitrary Code Injection via the processing of MkDocs hooks, when TechDocs is configured wit...

CVE-2026-24845

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. malcontent uses...

CLEANSTART-2026-YB44027 Moby is an open-source project created by Docker for software containerization

Multiple security vulnerabilities affect the docker-fips package. Moby is an open-source project created by Docker for software containerization. See references for individual vulnerability details...

CLEANSTART-2026-SB85645 Moby is an open-source project created by Docker for software containerization

Multiple security vulnerabilities affect the docker-fips package. Moby is an open-source project created by Docker for software containerization. See references for individual vulnerability details...