{"schema_version":"1","data":[{"id":22192,"advisory_id":"f3da80fa-303e-4153-b64c-554b5c37d479","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110254","source_published_at":"2026-10-13T19:05:28.559+00:00","published_at":"2026-10-25T05:57:55.68624+00:00","extraction_method":"structured","technologies":["core-cve","dockhand"],"cve_ids":["CVE-2026-110254"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory","summary":"Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.","evidence":"cve:CVE-2026-110254","products":[{"name":{"value":"dockhand","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-110254","aliases":["CVE-2026-110254"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"repo":"https://github.com/Finsys/dockhand","vendor":"Finsys","product":"dockhand","versions":[{"status":"affected","version":"0","lessThan":"1.0.45","versionType":"semver"},{"status":"unaffected","version":"1.0.45","versionType":"semver"}],"packageURL":"pkg:github/Finsys/dockhand","defaultStatus":"unaffected"}],"modified":"2026-10-14T15:56:52.381Z","provider":"cve","references":["https://github.com/Finsys/dockhand/security/advisories/GHSA-8rv7-48hx-jfw9","https://www.vulncheck.com/advisories/dockhand-before-1.0.45-ssrf-via-ipv6-transition-address-bypass-in-ipcategory"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-110254","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T14:49:45.640838Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T15:56:52.381Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-13T19:05:28.559Z"}}},"related_cves":[{"value":"CVE-2026-110254","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":20701,"advisory_id":"ba3e5448-c2ea-4d4a-883d-dc3dccb659ba","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110255","source_published_at":"2026-10-13T19:05:29.158+00:00","published_at":"2026-10-25T05:32:14.870053+00:00","extraction_method":"structured","technologies":["core-cve","dockhand"],"cve_ids":["CVE-2026-110255"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint","summary":"Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.","evidence":"cve:CVE-2026-110255","products":[{"name":{"value":"dockhand","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-110255","aliases":["CVE-2026-110255"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/Finsys/dockhand","vendor":"Finsys","product":"dockhand","versions":[{"status":"affected","version":"0","lessThan":"1.0.43","versionType":"semver"},{"status":"unaffected","version":"1.0.43","versionType":"semver"}],"packageURL":"pkg:github/Finsys/dockhand","defaultStatus":"unaffected"}],"modified":"2026-10-13T19:22:22.585Z","provider":"cve","references":["https://github.com/Finsys/dockhand/security/advisories/GHSA-f2mx-74xq-g4p9","https://www.vulncheck.com/advisories/dockhand-before-1.0.43-ssrf-via-api-templates-compose-endpoint"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-110255","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T19:21:57.438279Z"}}}],"references":[{"url":"https://github.com/Finsys/dockhand/security/advisories/GHSA-f2mx-74xq-g4p9","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T19:22:22.585Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-13T19:05:29.158Z"}}},"related_cves":[{"value":"CVE-2026-110255","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":20686,"advisory_id":"caa57725-8f10-4e9a-a7d1-100acafd5ebb","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110256","source_published_at":"2026-10-13T19:05:29.809+00:00","published_at":"2026-10-25T05:32:05.854476+00:00","extraction_method":"structured","technologies":["core-cve","dockhand"],"cve_ids":["CVE-2026-110256"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth","summary":"Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.","evidence":"cve:CVE-2026-110256","products":[{"name":{"value":"dockhand","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-110256","aliases":["CVE-2026-110256"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.7,"attackVector":"NETWORK","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/Finsys/dockhand","vendor":"Finsys","product":"dockhand","versions":[{"status":"affected","version":"0","lessThan":"1.0.19","versionType":"semver"},{"status":"unaffected","version":"1.0.19","versionType":"semver"}],"packageURL":"pkg:github/Finsys/dockhand","defaultStatus":"unaffected"}],"modified":"2026-10-13T19:05:29.809Z","provider":"cve","references":["https://github.com/Finsys/dockhand/security/advisories/GHSA-vmm5-cjvh-7vmv","https://www.vulncheck.com/advisories/dockhand-before-1.0.19-username-enumeration-via-ldap-injection-in-tryldapauth"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-13T19:05:29.809Z"}}},"related_cves":[{"value":"CVE-2026-110256","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":7911,"advisory_id":"d3d52b85-17a8-49c7-9649-501061b798f5","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53988","source_published_at":"2026-09-29T19:55:59.316+00:00","published_at":"2026-10-24T22:52:32.800635+00:00","extraction_method":"structured","technologies":["core-cve","dockhand"],"cve_ids":["CVE-2026-53988"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints","summary":"Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations, enabling denial of service or, when combined with write access to the tracked git branch, container escape and full host compromise via attacker-controlled docker-compose.yml with privileged bind mounts.","evidence":"cve:CVE-2026-53988","products":[{"name":{"value":"dockhand","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-53988","aliases":["CVE-2026-53988"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":9.2,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":10,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Finsys/dockhand","vendor":"Finsys","product":"dockhand","versions":[{"status":"affected","version":"0","lessThan":"1.0.40","versionType":"semver"}],"packageURL":"pkg:github/Finsys/dockhand","defaultStatus":"unaffected"}],"modified":"2026-10-02T12:24:18.939Z","provider":"cve","references":["https://github.com/Finsys/dockhand/releases/tag/v1.0.40","https://www.vulncheck.com/advisories/dockhand-unauthenticated-webhook-trigger-via-git-webhook-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53988","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-02T12:24:04.521448Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T12:24:18.939Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-29T19:55:59.316Z"}}},"related_cves":[{"value":"CVE-2026-53988","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4008,"advisory_id":"e91bb501-a450-4349-956d-710219953655","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53989","source_published_at":"2026-09-29T19:42:43.035+00:00","published_at":"2026-10-24T21:44:53.107269+00:00","extraction_method":"structured","technologies":["core-cve","dockhand"],"cve_ids":["CVE-2026-53989"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint","summary":"Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authenticated users to attacker-controlled sites by injecting an unvalidated redirect query parameter. Attackers can craft a malicious link targeting the OIDC callback flow to capture authorization codes via the Referer header and conduct follow-up credential phishing against any Dockhand account after a legitimate login.","evidence":"cve:CVE-2026-53989","products":[{"name":{"value":"dockhand","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-53989","aliases":["CVE-2026-53989"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":4.7,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"repo":"https://github.com/Finsys/dockhand","vendor":"Finsys","product":"dockhand","versions":[{"status":"affected","version":"0","lessThan":"1.0.36","versionType":"semver"}],"packageURL":"pkg:github/Finsys/dockhand","defaultStatus":"unaffected"}],"modified":"2026-09-29T20:20:20.324Z","provider":"cve","references":["https://github.com/Finsys/dockhand/releases/tag/v1.0.36","https://www.vulncheck.com/advisories/dockhand-open-redirect-via-oidc-initiation-endpoint"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53989","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T20:20:09.468811Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T20:20:20.324Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-29T19:57:01.422Z"}}},"related_cves":[{"value":"CVE-2026-53989","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":22192,"next_before":4008}