GHSA-95C3-6VVW-4MRQ MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience

SECURITY registry001 Vulnerability Report While analyzing the code logic, an area that may lead to unintended behavior under specific conditions was discovered. Overview - Verified Version: c5c4b9e8890dd5754bee889b2f1417f4fe3b5ce5 - Vulnerability Type: Authentication bypass via cross-registry OID...

BIT-DOCKER-CLI-2021-41092 Docker CLI leaks private registry credentials to registry-1.docker.io

Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running docker login my-private-registry.example.com with a misconfigured configuration file typically /.docker/config.json listing a credsStore or credHelpers that could not be...

Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file

Summary The user-provided string repository in the helmv3 manager is appended to the helm registry login command without proper sanitization. Details Adversaries can provide a maliciously crafted Chart.yaml in conjunctions with a tweaked Renovate configuration file to trick Renovate to execute...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: falco-exporter, fulcio, redka, kubernetes-event-exporter, kube-state-metrics, gobump, cluster-api-gcp-controller, helm-set-status, kafka-proxy, rancher-machine, slsa-verifier, contour, go-bindata, terraform, vexctl, mage, spire-controller-manager, k3d, thanos-operato...

Malicious Package

Overview artifactregistry-login is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Security update for SUSE Manager Client Tools

This update fixes the following issues: salt: Build all python bindings for all flavors Fixed the condition of alternatives for Tumbleweed and Leap 16 Handle logger exception when flushing already closed file Included passlib as a recommended dependency Make minion reconnecting on changing master...

Security update for SUSE Manager Client Tools

This update fixes the following issues: salt: Revert setting SELinux context for minion service bsc1233667 Removed System V init support Fix the condition of alternatives for Tumbleweed and Leap 16 Build all python bindings for all flavors Make minion reconnecting on changing master IP bsc1228182...

container-tools:2.0 security update

buildah 1.11.6-8.0.1 - Reduce unnecessary writable mounts in NaiveDiffDriver Orabug: 31025483 - Fixes troubles with oracle registry login Orabug: 29937283 1.11.6-8 - exclude i686 arch - Related: 1821193 1.11.6-7 - fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file...

container-tools:1.0 security update

buildah 1.5-8.gite94b4f9.0.1 - Fixes troubles with oracle registry login Orabug: 29937283 1.5-8.gite94b4f9 - bump release to preserve upgrade path - Related: 1821193 1.5-4.gite94b4f9 - fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build proces...

container-tools:2.0 security update

buildah 1.11.6-7.0.1 - Fixes troubles with oracle registry login Orabug: 29937283 1.11.6-7 - fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build process' - Resolves: 1819393 conmon 2:2.0.6-1.0.1 - Remove upstream references Orabug: 30871880...

container-tools:ol8 security, bug fix, and enhancement update

buildah 1.11.6-4.0.1 - Fixes troubles with oracle registry login Orabug: 29937283 1.11.6-4 - compile in FIPS mode - Related: RHELPLAN-25138 1.11.6-3 - be sure to use golang = 1.12.12-4 - Related: RHELPLAN-25138 1.11.6-2 - fix chroot: unmount with MNTDETACH instead of UnmountMountpoints - bug...