Docker — PoC Archive

Docker — CopyEscape: Container-to-Host Escape via docker cp Race Condition (CVE-2026-17106)

Sat, 15 Aug 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — binary · CVE-2026-17106. Status: Patched. Affects: Docker Engine / Docker Desktop, docker cp CLI command. Tags: docker, container-escape, race-condition, symlink, path-traversal, runc, host-takeover, linux, macos, CWE-367, CWE-59, CVE-2026-17106.

MariaDB — Low-Privilege Remote Code Execution via ST_Area OOB Read + SYS_REFCURSOR Use-After-Free

Sun, 09 Aug 2026 00:00:00 +0000

Critical severity (CVSS 8.8) — binary · MDEV-40328 (ST_Area OOB read); cursor-array UAF has no assigned CVE yet. Status: Unpatched. Affects: MariaDB Server, ST_Area() geometry function and SYS_REFCURSOR cursor-array management. Tags: mariadb, database, rce, low-privilege, heap, oob-read, use-after-free, aslr-bypass, pie-bypass, coop, vtable, cursor, st-area, multipolygon, CWE-125, CWE-416, docker, v12-security.

Gitea Docker Image Reverse-Proxy Authentication Bypass — "One Header, Any User" (CVE-2026-20896)

Sat, 11 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — web · CVE-2026-20896 (GHSA-f75j-4cw6-rmx4). Status: Weaponized (public PoC + detector script, actively exploited in the wild per Sysdig). Affects: Gitea — official Docker images (gitea/gitea), both root and rootless variants. Tags: gitea, docker, authentication-bypass, reverse-proxy, header-spoofing, unauthenticated, remote, cwe-290, actively-exploited.

Spring Cloud Gateway Actuator RCE — Vulnerable Environment Lab (CVE-2025-41243)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 10) — web · CVE-2025-41243. Status: PoC. Affects: Spring Cloud Gateway (spring-cloud-starter-gateway 4.1.0 on spring-boot-starter-parent 3.3.0), with Actuator's gateway endpoint exposed. Tags: spring-cloud-gateway, actuator, spel-injection, rce, java, docker, lab-environment.

RediShell: Redis Lua Scripting Use-After-Free Leading to JOP-Chained Remote Code Execution (CVE-2025-49844)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.9) — binary · CVE-2025-49844. Status: Weaponized. Affects: Redis (embedded Lua scripting engine). Tags: redis, lua, use-after-free, uaf, memory-corruption, jop, jump-oriented-programming, shellcode, iced-x86, docker, cwe-416, rce.

Monsta FTP Pre-Authentication Remote Code Execution via Arbitrary File Upload (CVE-2025-34299)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — network · CVE-2025-34299. Status: Weaponized. Affects: Monsta FTP (web-based FTP manager). Tags: monsta-ftp, rce, pre-auth, unrestricted-file-upload, cwe-434, php, ftp, docker, nuclei, kev.

IngressNightmare: Kubernetes ingress-nginx Admission Controller Shared-Library Injection RCE (CVE-2025-1974)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 9.8) — cloud · CVE-2025-1974. Status: Weaponized. Affects: Kubernetes ingress-nginx admission controller. Tags: kubernetes, ingress-nginx, ingressnightmare, admission-controller, nginx, ssl-engine, shared-library-injection, cluster-secrets, docker, python, c, cwe-94.

Grafana Enterprise SCIM User ID Collision / Impersonation (CVE-2025-41115)

Mon, 06 Jul 2026 00:00:00 +0000

Critical severity (CVSS 10) — web · CVE-2025-41115. Status: PoC. Affects: Grafana Enterprise / Grafana Cloud, SCIM provisioning component (/api/scim/v2/Users). Tags: grafana, grafana-enterprise, scim, user-impersonation, privilege-escalation, id-collision, python, docker, cwe-287.

OpenLearnX Unauthenticated RCE via Container Volume Mount (CVE-2026-41900)