AZL-97032 CVE-2026-61711 affecting package moby-engine for versions less than 25.0.3-20

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

EUVD-2026-62838

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

EUVD-2026-62468

Renovate versions from 42.68.1 before 42.96.3 and from 42.68.1 before 43.4.4, including corresponding Docker images renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker =13.3.0 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As ...

CVE-2026-76227 Renovate 42.68.1 before 42.96.3 Environment Variable Exposure

Renovate versions from 42.68.1 before 42.96.3 and from 42.68.1 before 43.4.4, including corresponding Docker images renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker =13.3.0 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As ...

CVE-2026-76227 Renovate 42.68.1 before 42.96.3 Environment Variable Exposure

Renovate versions from 42.68.1 before 42.96.3 and from 42.68.1 before 43.4.4, including corresponding Docker images renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker =13.3.0 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As ...

CVE-2026-76227

Renovate versions 42.68.1 through 42.96.2 (and 42.68.1 through 43.4.3), along with corresponding Docker images, fail to restrict environment variables to an allowlist when spawning child processes. The root cause was an inadvertent removal of the filtering logic during a migration to the execa li...

CVE-2026-76227 Renovate 42.68.1 before 42.96.3 Environment Variable Exposure

Renovate versions from 42.68.1 before 42.96.3 and from 42.68.1 before 43.4.4, including corresponding Docker images renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker =13.3.0 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As ...

Exploit for Missing Authorization in Portainer

CVE-2026-44848 — Portainer: Missing Authorization on Docker Pl...

CVE-2026-17106

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

AZL-97004 CVE-2026-17106 affecting package docker-cli for versions less than 25.0.7-5

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

CVE-2026-19671 Improper handling of highly compressed data (data amplification) in CISA Malcolm

Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...

GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...

ANT-2026-6FH6D5TF · supabase/supabase · other

other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-6FH6D5TF: Hardcoded Realtime tenant-credential encryption key with no override In docker/docker-compose.yml the...

CVE-2026-10722 vulnerabilities

Vulnerabilities for packages: nerdctl, splunk-otel-collector, docker, delve, cilium, gitaly, hubble, hubble-ui, runc, witness, k3s, vitess, kuma, containerd, falcoctl, kubescape-operator, kubescape...

GHSA-XHGW-QWWF-PG32 vulnerabilities

Vulnerabilities for packages: nerdctl, splunk-otel-collector, docker, delve, cilium, gitaly, hubble, hubble-ui, runc, witness, k3s, vitess, kuma, containerd, falcoctl, kubescape-operator, kubescape...

Amazon Linux 2 : docker, --advisory ALAS2DOCKER-2026-138 (ALASDOCKER-2026-138)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2026-138 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has extract...

Amazon Linux 2023 : docker (ALAS2023-2026-2062)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2062 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has extracted the preceding description block directly from the tested product security...

Amazon Linux 2 : docker, --advisory ALAS2NITRO-ENCLAVES-2026-116 (ALASNITRO-ENCLAVES-2026-116)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-116 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable has...

Exploit for Classic Buffer Overflow in Cisco Secure_Endpoint

ZendTo 6.15-8 / ClamAV exact-profile RCE and root-variant repr...

CVE-2025-27771 Uptrain vulnerable to remote code execution via `/add_prompts` endpoint

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...