Docker is a set of platform-as-a-service products that use OS-level virtualization to deliver software in packages called containers.

Docker

Datadog is a monitoring service for cloud-scale applications, providing monitoring of servers, databases, tools, and services through a SaaS-based data analytics platform.

Datadog Agent

Podman is an open-source project that is available on most Linux platforms and resides on GitHub. Podman is a daemonless container engine for developing, managing, and running Open Container Initiative (OCI) containers and container images on your Linux system. Podman provides a Docker-compatible command line front end that can simply alias the Docker CLI, `alias docker=podman`.

Podman

A simple and comprehensive vulnerability scanner for containers, suitable for CI.

Trivy

The Google OS Config agent runs on your GCP VM and uses the specifications in the guest policy to maintain it in a desired state.

Google OS Config Agent

AlmaLinux OS is an open-source, community-driven Linux operating system that fills the gap left by the discontinuation of the CentOS Linux stable release. AlmaLinux OS is a 1:1 binary compatible fork of RHEL®, guided and built by the community.

Alma Linux

CBL Marine is an open source distro, created by Microsoft. Mainly used in Azure cloud and Microsoft Internally.

CBL Mariner

Wolfi is a community Linux OS designed for the container and cloud-native era; it is a Linux distribution based on Alpine.

Wolfi

Chainguard is a Linux distribution based on Alpine. It's the commercial version of the Wolfi distro.

Chainguard

Kubescape CLI is an open-source Kubernetes security platform that helps identify and fix misconfigurations in Kubernetes clusters. It scans Kubernetes YAML files, Helm charts, and live clusters against various security frameworks and best practices. Kubescape CLI provides detailed risk scoring, compliance reports, and remediation suggestions to improve the security posture of Kubernetes environments.

Kubescape CLI

MinimOS is a minimalist operating system designed for simplicity and efficiency. It aims to provide only essential functionalities, making it lightweight and suitable for resource-constrained environments. MinimOS is often used in embedded systems or as a base for custom operating system development.

MinimOS

Debian GNU/Linux is a Linux distribution composed of free and open-source software.

Linux Debian

Ubuntu is a Linux distribution based on Debian, mostly composed of free and open-source software. Ubuntu is officially released in three editions: Desktop, Server, and Core for internet of things devices and robots. All the editions can run on the computer alone or in a virtual machine.

Linux Ubuntu

Red Hat Enterprise Linux is a Linux distribution developed by Red Hat for the commercial market.

Linux Red Hat

Linux openSUSE

The Amazon Linux is a supported and maintained Linux image provided by Amazon Web Services for use on Amazon Elastic Compute Cloud (Amazon EC2).

Amazon Linux

Alpine Linux is a Linux distribution based on musl and BusyBox, designed for security, simplicity, and resource efficiency.

Linux Alpine

Oracle Linux is a Linux distribution packaged and freely distributed by Oracle, available partially under the GNU General Public License since late 2006. It is compiled from Red Hat Enterprise Linux source code, replacing Red Hat branding with Oracle's.

Linux Oracle

Container-Optimized OS is an operating system image for Compute Engine VMs that is optimized for running Docker containers.

Container-Optimized OS

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.

CVE-2025-52881

AlmaLinux

AlmaLinux Security Advisory

Alpine

Alpine Security Tracker

CBL-Mariner

Container-Optimized OS Release Notes

Debian

Debian Security Tracker

GoLang

GitHub Advisory Database

Minimus

Red Hat

Red Hat Errata

Ubuntu

Ubuntu Security Tracker

runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

CVE-2025-52565

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack:  an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

CVE-2025-31133

Esri ArcGIS Server is a powerful component that hosts and distributes GIS services and resources over the web. It enables organizations to share spatial data, maps, and geoprocessing services through web, desktop, and mobile applications. As a scalable and secure platform, ArcGIS Server integrates seamlessly with other Esri products and solutions to enhance overall GIS capabilities.

ArcGIS Server

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.

CVE-2025-57870

Linux

Linux Kernel

Windows

Windows Cumulative Update

VulnCheck NVD++

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

CVE-2025-59287

WordPress is a content management system paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system, referred to within WordPress as Themes.

WordPress

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 1.2.35 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2025-12482

GitLab is a web-based Git repository manager with wiki and issue-tracking features. GitLab is similar to GitHub, but GitLab has an open-source version, unlike GitHub.

GitLab

GitLab Enterprise is a self-hosted, scalable, and secure platform that provides DevOps and CI/CD capabilities for software development teams. It offers advanced features, integrations, and support for organizations requiring enhanced collaboration and security. GitLab Enterprise is available in two tiers: Premium and Ultimate.

Gitlab Enterprise

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to cause a denial of service condition by submitting specially crafted markdown content with nested formatting patterns.

CVE-2025-12983

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to bypass access control restrictions and view GitLab Pages content intended only for project members by authenticating through OAuth providers.

CVE-2025-7736

An issue has been discovered in GitLab CE/EE affecting all versions  from 17.6  before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that, under specific conditions, could have allowed unauthorized users to view confidential branch names by accessing project issues with related merge requests.

CVE-2025-7000

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.

CVE-Kennung	Strenge	Punktzahl	Technologieen	Name der Komponente	CISA KEV-Exploit	Hat fix	Veröffentlichungsdatum
CVE-2025-52881	HIGH	7.3	Docker	runc-debugsource	Nein	Ja	Nov 06, 2025
CVE-2025-52565	HIGH	8.4	Podman	conmon	Nein	Ja	Nov 06, 2025
CVE-2025-31133	HIGH	7.3	Podman	python3-podman	Nein	Ja	Nov 06, 2025
CVE-2025-57870	CRITICAL	10	ArcGIS Server	cpe:2.3:a:esri:arcgis_server	Nein	Ja	Oct 22, 2025
CVE-2025-59287	CRITICAL	9.8	N/A	N/A	Ja	Ja	Oct 14, 2025

CVE-Kennung	Strenge	Punktzahl	Technologieen	Name der Komponente	CISA KEV-Exploit	Hat fix	Veröffentlichungsdatum
CVE-2025-12482	HIGH	7.5	WordPress	ameliabooking	Nein	Ja	Nov 16, 2025
CVE-2025-12983	LOW	3.5	GitLab	cpe:2.3:a:gitlab:gitlab	Nein	Ja	Nov 15, 2025
CVE-2025-7736	LOW	3.1	GitLab	cpe:2.3:a:gitlab:gitlab	Nein	Ja	Nov 15, 2025
CVE-2025-7000	MEDIUM	4.3	GitLab	cpe:2.3:a:gitlab:gitlab	Nein	Ja	Nov 15, 2025
CVE-2025-6945	LOW	3.5	GitLab	cpe:2.3:a:gitlab:gitlab	Nein	Ja	Nov 15, 2025

Datenbank für Wiz-Schwachstellen

Nach Technologie erkunden

Beliebte Filter

Hohes Profil

Neuesten

Schwachstellen in Zahlen

Das Gute, das Böse und das Verletzliche

Zusätzliche Wiz-Ressourcen

Cloud Vulnerability DB

PEACH

Sind Sie bereit, Wiz in Aktion zu sehen?