clair

Clair 注意 : 在开发过程中，main 分支可能处于 不稳定甚至损坏状态 。 请使用 releases 页面而非 main 分支来获取稳定二进制文件。 Clair 是一个开源项目，用于对应用容器（当前包括 OCI 和 docker 格式）中的漏洞进行 静态分析。 客户使用 Clair API 对容器镜像进行索引，然后将其与已知漏洞进行匹配。 我们的目标是实现对基于容器的基础设施安全性的更透明观察。因此，该项目取名为 Clair，源自法语词汇，意为 清晰、明亮、透明 。 文档 包含了关于 Clair 架构和操作的全部说明。 社区 邮件列表: [email protected]...

pisc

Comprobador de Seguridad de Imágenes OCI Públicas ¿Qué es? PISC Comprobador de Seguridad de Imágenes OCI Públicas o de imágenes docker es una herramienta de línea de comandos para evaluar la seguridad de imágenes de contenedores OCI. Sale con código 1 si se cumple alguna de las siguientes...

layerleak

layerleak Layerleak 是一个只读的 OCI 镜像密钥扫描器。它无需 Docker 守护进程即可解析公共镜像引用，根据 OCI 摘要验证下载的内容，重建层状态，检查已删除的构件和镜像元数据，并返回经过脱敏、带有来源信息的发现结果。 它支持 Docker Hub、GHCR、Quay、GCR、MCR、Amazon ECR Public 以及其他兼容 OCI 的注册表。结果可以保存为 JSON，并持久化到 PostgreSQL 中供捆绑的 API 使用。 文档 OpenAPI 规范 变更日志 安全策略 贡献指南 此开发树记录了...

terrier

Terrier Terrier 是一款镜像和容器分析工具，可用于扫描 OCI 镜像和容器，根据其哈希值识别并验证特定文件的存在。关于 Terrier 的详细说明可参见 Heroku 博客：https://blog.heroku.com/terrier-open-source-identifying-analyzing-containers。 安装 二进制文件 如需通过二进制文件安装，请访问 发布页面。 通过 Go 安装 $ go get github.com/heroku/terrier 从源码构建 通过 Go $ go build 或 $ make all 用法 $ ./terrier...

cosign

cosign 使用 Sigstore 对 OCI 容器（及其他制品）进行签名！ Cosign 旨在让签名成为无形的基础设施 。 Cosign 支持： 使用 Sigstore 公共 Fulcio 证书颁发机构和 Rekor 透明日志进行“无密钥签名”（默认） 硬件与 KMS 签名 使用 cosign 生成的加密私钥/公钥对进行签名 在 OCI 注册表中进行容器签名、验证与存储。 自带 PKI 信息 Cosign 是 sigstore 项目的一部分。 我们还使用一个 slack 频道！ 点击此处获取邀请链接。 安装 有关 Homebrew、Arch、Nix、GitHub Action 和...

grype

Grype A vulnerability scanner for container images and filesystems. Features Scan container images , filesystems , and SBOMs for known vulnerabilities see the docs for a full list of supported scan targets Supports major OS package ecosystems Alpine, Debian, Ubuntu, RHEL, Oracle Linux, Amazon...

dive

dive 一个用于探索 Docker 镜像、层内容以及发现缩小 Docker/OCI 镜像大小方法的工具。 要分析一个 Docker 镜像，只需使用镜像标签/ID/摘要运行 dive： dive 或者你可以直接通过 Docker 使用 dive： alias dive="docker run -ti --rm -v /var/run/docker.sock:/var/run/docker.sock docker.io/wagoodman/dive" dive 例如 dive nginx:latest 或者如果你想构建镜像然后直接进行分析： dive build -t . 在 macOS...

GO-2026-6597 Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd

Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd...

CVE-2026-5530

CVE-2026-5530 SSRF en Ollama mediante redirección de registro OCI con exfiltración completa de la respuesta. Informe: https://davidrochester.com/posts/cve-2026-5530 Divulgación Se contactó con Ollama en múltiples ocasiones sin obtener respuesta. Uso Tres modos: enum, exfil y probe. Enum Encuentra...

CVE-2026-67620-poc

CVE-2026-67620 — Flowise SSRF via incomplete cloud-metadata deny-list Oracle OCI + Alibaba Cloud Product: FlowiseAI/Flowise — visual LLM / AI-agent builder 54k ★ Affected versions: ≤ 3.1.4 — confirmed still vulnerable in 3.1.4 , the latest release re-verified 2026-08-06 Vulnerability: Server-Side...

cve-2026-59891-control-lab

Laboratorio de Regresión y Control CVE-2026-59891 Proyecto de laboratorio aislado y auditoría de solo lectura que compara las versiones vulnerable y corregida reales de @sigstore/oci con la misma entrada y comprueba las condiciones de exposición según el entorno. El CVE Reporter de este proyecto ...

OCI-Ansible-Fix-CVE-2026-31431

CVE-2026-31431 Corrección con Ansible Este playbook corrige CVE-2026-31431, también conocido como Copy Fail, en instancias Linux en OCI. CVE-2026-31431 es un problema de escalada de privilegios local en la implementación algifaead del kernel de Linux utilizada por la API de criptografía en espaci...

Rocky Linux 8.6 [CIQ] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0857)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260857 advisory. This advisory aggregates security fixes for the oci-seccomp-bpf-hook SRPM in CIQ LTS 8.6. It addresses 37 CVEs: CVE-2021-36221, CVE-2021-41190,...

Rocky Linux 8.6 [CIQ] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-debuginfo / etc (ciqsa-2026_1094)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261094 advisory. This advisory aggregates security fixes for the oci-seccomp-bpf-hook SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2024-21626. Tenable has extracted the preceding...

Rocky Linux 8.6 [CIQ] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0122)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260122 advisory. This advisory aggregates security fixes for the oci-seccomp-bpf-hook SRPM in CIQ LTS 8.6. It addresses 33 CVEs: CVE-2018-25091, CVE-2024-34155,...

Rocky Linux 8.8 [CIQ] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0800)

The Rocky Linux 8.8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260800 advisory. This advisory aggregates security fixes for the oci-seccomp-bpf-hook SRPM in CIQ LTS 8.8. It addresses 39 CVEs: CVE-2020-10756, CVE-2021-3592,...

AlmaLinux 9.2 [TuxCare] Security Update: oci-seccomp-bpf-hook (ALMALINUX9.2:CLSA-2026:1784707996)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784707996 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

Linux Distros Unpatched Vulnerability : CVE-2026-97025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users o...

kern

kern: a fast, rootless container runtime and sandbox with no daemon. It runs workloads, including agent tool calls and code generated by an LLM, in real containers enforced by the kernel. A real, kernel-enforced container in a few milliseconds, out of one static binary with no daemon. MCP support...

CVE-2026-97025

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...