GHSA-6JR7-99PF-8VGF @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks

Impact When TechDocs is configured with runIn: local, a malicious actor who can submit or modify a repository's mkdocs.yml file can execute arbitrary Python code on the TechDocs build server via MkDocs hooks configuration. Patches Upgrade to @backstage/plugin-techdocs-node version 1.13.11, 1.14.1...

MGASA-2026-0030 Updated docker-containerd packages fix security vulnerabilities

It was discovered that containerd incorrectly set certain directory path permissions. An attacker could possibly use this issue to achieve unauthorised access to the files. CVE-2024-25621 It was discovered that containerd did not properly handle the execution of the goroutine of container attach...

Updated docker-containerd packages fix security vulnerabilities

It was discovered that containerd incorrectly set certain directory path permissions. An attacker could possibly use this issue to achieve unauthorised access to the files. CVE-2024-25621 It was discovered that containerd did not properly handle the execution of the goroutine of container attach...

@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

Impact A path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with techdocs.generator.runIn: local. When processing documentation from untrusted sources, symlinks within the docs directory are...

GHSA-W669-JJ7H-88M9 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator

Impact A path traversal vulnerability in the TechDocs local generator allows attackers to read arbitrary files from the host filesystem when Backstage is configured with techdocs.generator.runIn: local. When processing documentation from untrusted sources, symlinks within the docs directory are...

PT-2026-5722

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.1.29 Description A command injection issue exists in the Docker sandbox execution mechanism due to unsafe handling of the PATH environment variable when constructing shell commands. An authenticated user with th...

EulerOS 2.0 SP13 : docker-runc (EulerOS-SA-2026-1220)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 throug...

PT-2026-6421

Summary 1. A hardcoded secret key used for signing JWTs is checked into source code 2. ManyAPI routes do not check authentication Details I am using the publicly available docker image at ghcr.io/maziggy/bambuddy 1. Hardcoded JWT Secret Key...

CVE-2026-24763: Improper Neutralization of Special Elements used in an OS Command

OpenClaw formerly Clawdbot is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw’s Docker sandbox execution mechanism due to unsafe handling of the PATH environment variable when constructing shell commands. An...

OpenClaw operating system command injection vulnerability

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw there is an operating system command injection vulnerability , the vulnerability stems from the Docker sandbox execution mechanism when constructing shell commands on the PATH environment variable handling insecurity ,...

EulerOS 2.0 SP13 : docker-runc (EulerOS-SA-2026-1208)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 throug...

Exploit for Unrestricted Upload of File with Dangerous Type in Gvectors Wpdiscuz

wpDiscuz-7.0.4-PoC-RCE - wpDiscuz 7.0.4 - Unauthenticated RCE...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-geoipfilter, flux-kustomize-controller, gitness, fuse-overlayfs-snapshotter, kor, newrelic-nri-statsd, whereabouts, docker-credential-ecr-login, undock, age, aws-eks-pod-identity-agent, cilium-cli, pgpool2exporter, clickhouse-operator, aws-flb-cloudwatc...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: gptscript, tofu-controller, chisel, flux-notification-controller, crossplane-provider-aws-dynamodb, sftpgo-plugin-geoipfilter, fluxcd-kustomize-mutating-webhook, rancher-loglevel, src, flux-kustomize-controller, nats-top, esbuild, ferretdb, gitness, mattermost, extis...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: gptscript, tofu-controller, chisel, flux-notification-controller, crossplane-provider-aws-dynamodb, sftpgo-plugin-geoipfilter, fluxcd-kustomize-mutating-webhook, rancher-loglevel, src, flux-kustomize-controller, nats-top, mattermost, ferretdb, gitness, extism, juicef...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-geoipfilter, flux-kustomize-controller, gitness, fuse-overlayfs-snapshotter, kor, newrelic-nri-statsd, whereabouts, docker-credential-ecr-login, undock, age, aws-eks-pod-identity-agent, cilium-cli, pgpool2exporter, clickhouse-operator, aws-flb-cloudwatc...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: gptscript, tofu-controller, chisel, flux-notification-controller, crossplane-provider-aws-dynamodb, sftpgo-plugin-geoipfilter, fluxcd-kustomize-mutating-webhook, rancher-loglevel, src, flux-kustomize-controller, nats-top, mattermost, ferretdb, gitness, extism, juicef...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-geoipfilter, flux-kustomize-controller, gitness, fuse-overlayfs-snapshotter, kor, newrelic-nri-statsd, whereabouts, docker-credential-ecr-login, undock, age, aws-eks-pod-identity-agent, cilium-cli, pgpool2exporter, clickhouse-operator, aws-flb-cloudwatc...

CVE-2026-25116

Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the UserConfigController allows any remote user to overwrite the system's docker-compose.yml configuration file. By exploiting insecure URN...

CVE-2026-25152

The CVE-2026-25152 entry concerns the Backstage @backstage/plugin-techdocs-node, where versions before 1.13.11 and 1.14.1 allow path traversal via the TechDocs local generator when techdocs.generator.runIn is set to local. This permits reading arbitrary host files as MkDocs follows symlinks in do...