CVE-2026-41567

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via PUT /containers/id/archive or piped through docker cp -, the daemon resolves decompression binaries such as xz or unpigz fr...

MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills

AI coding agents such as Claude Code and Gemini CLI increasingly extend themselves with third-party skills: markdown packages bundling natural-language instructions, executable scripts, and tool permissions. Because a skill is at once code and agent-facing instruction, it introduces a supply chai...

Docker Desktop < 4.76.0 VM Panic via Unbounded Recursion (CVE-2026-8936)

The version of Docker Desktop installed on the remote host is prior to 4.76.0. It is, therefore, affected by a denial of service vulnerability: - A VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested directories on a bind-mounted host folder...

CVE-2026-41567: Uncontrolled Search Path Element

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via PUT /containers/id/archive or piped through docker cp -, the daemon resolves decompression binaries such as xz or unpigz fr...

PT-2026-49248

Impact Vantage6 currently provides an initial user with username root and password root. This is not ideal for the following reasons: - Attackers know that almost all vantage6 servers have a user with username root that probably has admin rights - The initial password is very weak and it is...

SmartMES-Range

SmartMES Attack-Defense Drill Site The Smart Manufacturing En...

Exploit for CVE-2026-34234

CVE-2026-34234 - CtrlPanel Installer RCE Lab Local Docker lab...

PT-2026-46857

Impact Any network-reachable caller can write arbitrary documents to any patient's electronic health record accessible by the institution's SMC-B card. In a misconfigured deployment e.g., following the production Docker example in the README, this is exploitable from the local network without...

CVE-2026-36576

An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 allows attackers to execute arbitrary commands via a crafted POST request...

docker-compose-control-center (3.1.0) potentially affected by CVE-2026-6873 via django (2.1.10)

django PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center 3.1.0 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

docker-compose-control-center (>=3.1.1, <=3.1.2) potentially affected by CVE-2026-48587 via django (2.1.11)

django PYPI version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =3.1.1, =3.1.2 Source cves: CVE-2026-48587 Source advisory: OSV:GHSA-923M-GV2P-W5QP...

docker-compose-control-center (>=2.4.0, <=3.0.0) potentially affected by CVE-2026-8404 via django (2.1.8)

django PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =2.4.0, =3.0.0 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

docker-compose-control-center (3.1.0) potentially affected by CVE-2026-8404 via django (2.1.10)

django PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center 3.1.0 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

docker-compose-control-center (>=2.4.0, <=3.0.0) potentially affected by CVE-2026-6873 via django (2.1.8)

django PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =2.4.0, =3.0.0 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

docker-compose-control-center (>=3.1.1, <=3.1.2) potentially affected by CVE-2026-6873 via django (2.1.11)

django PYPI version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - docker-compose-control-center =3.1.1, =3.1.2 Source cves: CVE-2026-6873 Source advisory: OSV:GHSA-H7PC-VWP9-298G...

ambition-edc (>=0.3.63, <=0.3.66), capreolus (0.1.3) +7 more potentially affected by CVE-2026-48587 via django (2.2.9)

django PYPI version 2.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - ambition-edc =0.3.63, =1.1.35, =1.13.0.dev5, =0.1.0, =2.1.0, =2.2.1 Source cves: CVE-2026-48587 Source advisory: OSV:GHSA-923M-GV2P-W5QP...

CVE-2026-10729

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting XSS in emails clients that render HTML emails. This issue affects Canarytokens: fr...

CVE-2026-10729

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting XSS in emails clients that render HTML emails. This issue affects Canarytokens: fr...

CVE-2026-10729 HTML injection in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting XSS in emails clients that render HTML emails. This issue affects Canarytokens: fr...

Security Bulletin: IBM Verify Antenna is affected by multiple vulnerabilities (CVE-2026-33815, CVE-2026-33816, CVE-2026-41889)

Summary IBM Verify Antenna has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-41889 DESCRIPTION: pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string...