CVE-2026-5817-PoC

CVE-2026-5817: Docker Model Runner コンテナからホストへのRCE / エスケープ Docker Desktop 4.40.0〜4.67.x ホスト上の任意のコンテナは、2つのHTTPリクエストでホスト上でコードを実行できます。ソケットのマウントも --privileged もケーパビリティも不要です。 仕組み すべてのコンテナは、認証なしで model-runner.docker.internal のModel Runnerに到達できます。Model...

CVE-2026-54918 NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOXDTLIBRARYURL in tests/testconfiguration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the...

CVE-2026-54918: External Control of System or Configuration Setting

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOXDTLIBRARYURL in tests/testconfiguration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the...

PT-2026-39212

Name of the Vulnerable Software and Affected Versions Postiz versions prior to commit da44801 Description A Pwn Request issue in the Build and Publish PR Docker Image workflow located in '.github/workflows/pr-docker-build.yml' allows unauthenticated users to execute arbitrary code during the Dock...