Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
57 results · page 1 of 2
Oct 16, 2026Mailu is a mail server distributed as a set of Docker images.CVE-2026-86009 · Other software · Mailu · reported by GitHubHigh 8.2
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
- Product
- Mailu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Mailu is a mail server distributed as a set of Docker images.CVE-2026-86008 · Other software · Mailu · reported by GitHubHigh 7.2
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.
- Product
- Mailu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.CVE-2026-105039 · Other software · EnergizeLab · reported by cve@takeonme.orgCritical 9.6
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
- Product
- station-middleware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtakeonme.org
Oct 15, 2026EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server byCVE-2026-105037 · Other software · EnergizeLab · reported by cve@takeonme.orgCritical 9.9
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.
- Product
- station-middleware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtakeonme.org
Oct 9, 2026The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use.CVE-2026-105278 · Other software · Grid Protection Alliance · reported by ics-cert@hq.dhs.govCritical 9.3
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.
- Product
- openPDC (Docker image)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026Mailu is a mail server distributed as a set of Docker images.CVE-2026-85751 · Other software · Mailu · reported by GitHubCritical 9.8
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.
- Product
- Mailu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated CVE-2026-91936 · Other software · FlowiseAI · reported by VulnCheckHigh 8.3
Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tag_version and node_version to execute arbitrary commands and steal AWS credentials and Docker Hub tokens.
- Product
- Flowise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 31, 2026The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content.CVE-2026-82838 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 6.4
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.
- Product
- venueless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Mailu is a mail server as a set of Docker images.CVE-2026-49217 · Other software · Mailu · reported by GitHubHigh 7.5
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.
- Product
- Mailu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renoCVE-2026-76227 · Other software · renovatebot · reported by VulnCheckMedium 6.8
Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, renovate-ee-server, renovate-ee-worker) from 13.3.0 before 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
- Product
- renovate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 3, 2026Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverseCVE-2026-20896 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Critical 9.8
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
- Product
- Gitea Open Source Git Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Sep 29, 2025Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.862 and Application prior to 20.0.2014 (VA and SaaS deployments) contain Docker imagesCVE-2025-34209 · Other software · Vasion · reported by VulnCheckCritical 9.4
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.862 and Application prior to 20.0.2014 (VA and SaaS deployments) contain Docker images with the private GPG key and passphrase for the account *no‑reply+virtual‑appliance@printerlogic.com*. The key is stored in cleartext and the passphrase is hardcoded in files. An attacker with administrative access to the appliance can extract the private key, import it into their own system, and subsequently decrypt GPG-encrypted files and sign arbitrary firmware update packages. A maliciously signed update can be uploaded by an admin‑level attacker and will be executed by the appliance, giving the attacker full control of the virtual appliance. This vulnerability has been identified by the vendor as: V-2023-010 — Hardcoded Private Key.
- Product
- Print Virtual Appliance Host
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.printerlogic.comhelp.printerlogic.com
May 13, 2025The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated acCVE-2025-22248 · Other software · VMware · reported by security@vmware.comCritical 9.4
The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself uses to perform streaming replication checks against nodes, and should not be at trust level. This allows to log into a PostgreSQL database using the repgmr user without authentication. If Pgpool is exposed externally, a potential attacker could use this user to get access to the service. This is also present within the bitnami/postgres-ha Kubernetes Helm chart.
- Product
- Bitnami
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2025In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on imCVE-2025-32755 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comCritical 9.1
In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
- Product
- Jenkins jenkins/ssh-slave Docker images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2025In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based onCVE-2025-32754 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comCritical 9.1
In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
- Product
- Jenkins jenkins/ssh-agent Docker images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout.CVE-2025-32111 · Other software · acme.sh project · reported by MITREHigh 8.7
The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout.
- Product
- acme.sh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2024IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easiCVE-2023-38369 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.2
IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 261196.
- Product
- Security Verify Access Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 10, 2022The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless.CVE-2022-43679 · Other software · Owncloud · reported by MITREMedium 4.2
The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config useless. This could be abused to spoof the URL in password-reset e-mail messages.
- Product
- Owncloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordowncloud.comowncloud.com
Jan 19, 2022When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in plaiCVE-2021-31821 · Other software · Octopus Deploy · reported by security@octopus.comMedium 5.5
When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in plaintext. This does not affect the Linux Docker image
- Product
- Octopus Tentacle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Oct 5, 2021The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveCVE-2021-35497 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 7.5
The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO
- Product
- TIBCO ActiveSpaces - Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2021In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemonCVE-2021-21285 · Other software · moby · reported by GitHubMedium 6.5
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.
- Product
- moby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comgithub.com
Dec 16, 2020The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35197 · Other software · Docker · reported by MITRECritical 9.8
The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user. System using the memcached docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Memcached Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35196 · Other software · Docker · reported by MITRECritical 9.8
The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user. System using the rabbitmq docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Rabbitmq Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35195 · Other software · Docker · reported by MITRECritical 9.8
The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user. System using the haproxy docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Haproxy Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official vault docker images before 0.11.6 contain a blank password for a root user.CVE-2020-35192 · Other software · Hashicorp · reported by MITRECritical 9.8
The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35191 · Websites & servers · Drupal · reported by MITRECritical 9.8
The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Drupal Docker Images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35190 · Other software · Plone · reported by MITRECritical 9.8
The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user.CVE-2020-35186 · Other software · Docker · reported by MITRECritical 9.8
The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. System using the adminer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Adminer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official composer docker images before 1.8.3 contain a blank password for a root user.CVE-2020-35184 · Other software · Docker · reported by MITRECritical 9.8
The official composer docker images before 1.8.3 contain a blank password for a root user. System using the composer docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Composer Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35189 · Other software · Kong · reported by MITRECritical 9.8
The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. System using the kong docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Kong Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35187 · Other software · Influxdata · reported by MITRECritical 9.8
The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user. System using the telegraf docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Telegraf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35185 · Other software · Docker · reported by MITRECritical 9.8
The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. System using the ghost docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Ghost Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user.CVE-2020-35469 · Other software · Softwareag · reported by MITRECritical 9.8
The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. Systems deployed using affected versions of the Terracotta Server OSS container may allow a remote attacker to achieve root access with a blank password.
- Product
- Terracotta Server OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The Appbase streams Docker image 2.1.2 contains a blank password for the root user.CVE-2020-35468 · Other software · Appbase · reported by MITRECritical 9.8
The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected versions of the streams container may allow a remote attacker to achieve root access with a blank password.
- Product
- Streams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user.CVE-2020-35193 · Other software · Sonarsource · reported by MITRECritical 9.8
The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Sonarqube Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user.CVE-2020-35467 · Other software · Docker · reported by MITRECritical 9.8
The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the Docker Docs container may allow a remote attacker to achieve root access with a blank password.
- Product
- Docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020The Blackfire Docker image through 2020-12-14 contains a blank password for the root user.CVE-2020-35466 · Other software · Blackfire · reported by MITRECritical 9.8
The Blackfire Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the Blackfire container may allow a remote attacker to achieve root access with a blank password.
- Product
- Blackfire Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user.CVE-2020-35464 · Other software · Weave · reported by MITRECritical 9.8
Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user. Systems deployed using affected versions of the Weave Cloud Agent container may allow a remote attacker to achieve root access with a blank password.
- Product
- Cloud Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user.CVE-2020-35463 · Other software · Instana · reported by MITRECritical 9.8
Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user. Systems deployed using affected versions of the Instana Dynamic APM container may allow a remote attacker to achieve root access with a blank password.
- Product
- Dynamic APM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user.CVE-2020-35462 · Other software · Coscale Agent Project · reported by MITRECritical 9.8
Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. Systems deployed using affected versions of the CoScale agent container may allow a remote attacker to achieve root access with a blank password.
- Product
- Coscale Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2020Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user.CVE-2020-29591 · Other software · Docker · reported by MITRECritical 9.8
Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deployed using affected versions of the registry container may allow a remote attacker to achieve root access with a blank password.
- Product
- Registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-29602 · Other software · Irssi · reported by MITRECritical 9.8
The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user. System using the irssi docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official notary docker images before signer-0.6.1-1 contain a blank password for a root user.CVE-2020-29601 · Other software · Docker · reported by MITRECritical 9.8
The official notary docker images before signer-0.6.1-1 contain a blank password for a root user. System using the notary docker container deployed by affected versions of the docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Notary Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official spiped docker images before 1.5-alpine contain a blank password for a root user.CVE-2020-29581 · Other software · Docker · reported by MITRECritical 9.8
The official spiped docker images before 1.5-alpine contain a blank password for a root user. Systems using the spiped docker container deployed by affected versions of the docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Spiped Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official storm Docker images before 1.2.1 contain a blank password for a root user.CVE-2020-29580 · Other software · Docker · reported by MITRECritical 9.8
The official storm Docker images before 1.2.1 contain a blank password for a root user. Systems using the Storm Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Storm Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user.CVE-2020-29579 · Other software · Express-gateway · reported by MITRECritical 9.8
The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access.
- Product
- Express-gateway Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official znc docker images before 1.7.1-slim contain a blank password for a root user.CVE-2020-29577 · Other software · ZNC · reported by MITRECritical 9.8
The official znc docker images before 1.7.1-slim contain a blank password for a root user. Systems using the znc docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- ZNC Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user.CVE-2020-29576 · Other software · Eggheads · reported by MITRECritical 9.8
The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user. Systems using the Eggdrop Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access with a blank password.
- Product
- Eggdrop Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user.CVE-2020-29575 · Other software · Docker · reported by MITRECritical 9.8
The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user. Systems using the elixir Linux Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Elixir Alpine Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2020The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user.CVE-2020-29564 · Other software · Hashicorp · reported by MITRECritical 9.8
The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.
- Product
- Consul Docker Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.