CVE-2026-14373: Missing Authorization

HashiCorp Nomad and Nomad Enterprise did not enforce the allowprivileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on...

Amazon Linux 2 : docker, --advisory ALAS2ECS-2026-131 (ALASECS-2026-131)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-131 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN...

Exploit for CVE-2026-20896

CVE-2026-20896 Gitea Docker Auth Bypass Checker Authorized re...

BentoML has a Path Traversal via Bentofile Configuration

SummaryBentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate, conda.environmentyml. An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files fro...

cloudlift (>=1.0.0, <=2.0.6), pytest-docker-py (>=1.1.0, <=1.1.3) +1 more potentially affected by CVE-2025-71176 via pytest (4.0.0)

pytest PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - cloudlift =1.0.0, =1.1.0, =1.1.3 - pytest-mockservers 0.1.0 Source cves: CVE-2025-71176 Source advisory: OSV:PYSEC-2026-1845...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +5 more potentially affected by CVE-2025-58065 via flask-appbuilder (1.13.1)

flask-appbuilder PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-clickhouse-plugin =0.5.1, =1.0.0, =1.10.0, =1.10.4b2, =1.10.6 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24....

PYSEC-2026-1526 Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)

This vulnerability was discovered by researchers at Check Point. We are sharing this report as part of a responsible disclosure process and are happy to assist in validation and remediation if needed. Summary A privilege escalation vulnerability exists in Langflow containers where an authenticate...

Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)

This vulnerability was discovered by researchers at Check Point. We are sharing this report as part of a responsible disclosure process and are happy to assist in validation and remediation if needed. SummaryA privilege escalation vulnerability exists in Langflow containers where an authenticated...

PYSEC-2026-1360 FastAPI Guard has a regex bypass

Summary The regular expression patched to mitigate the ReDoS vulnerability by limiting the length of string fails to catch inputs that exceed this limit. Details In version 3.0.1, you can find a commit like the one in the link below, which was made to prevent ReDoS...

docker-compose-control-center (3.1.0) potentially affected by CVE-2026-48588 via django (2.1.10)

django PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center 3.1.0 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

docker-compose-control-center (>=3.1.1, <=3.1.2) potentially affected by CVE-2026-48588 via django (2.1.11)

django PYPI version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =3.1.1, =3.1.2 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

docker-compose-control-center (>=2.4.0, <=3.0.0) potentially affected by CVE-2026-48588 via django (2.1.8)

django PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =2.4.0, =3.0.0 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

docker-compose-control-center (>=2.4.0, <=3.0.0) potentially affected by CVE-2026-53878 via django (2.1.8)

django PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =2.4.0, =3.0.0 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

docker-compose-control-center (3.1.0) potentially affected by CVE-2026-53878 via django (2.1.10)

django PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center 3.1.0 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

docker-compose-control-center (>=3.1.1, <=3.1.2) potentially affected by CVE-2026-53877 via django (2.1.11)

django PYPI version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =3.1.1, =3.1.2 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

docker-compose-control-center (>=2.4.0, <=3.0.0) potentially affected by CVE-2026-53877 via django (2.1.8)

django PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =2.4.0, =3.0.0 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

docker-compose-control-center (3.1.0) potentially affected by CVE-2026-53877 via django (2.1.10)

django PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center 3.1.0 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...

PYSEC-2026-1731 Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...

docker-compose-control-center (>=2.4.0, <=3.0.0) potentially affected by CVE-2024-45231 via django (2.1.8)

django PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =2.4.0, =3.0.0 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...