https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 08:20:02 +0000 https://db.gcve.eu/vuln/cve-2026-12566 <p><strong>Affected:</strong> Black Lantern Security BBOT</p> <p>The docker_pull module uses the realm parameter from a Docker registry&#39;s WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication request to an arbitrary endpoint, potentially leaking authentication tokens.</p> <p><strong>Affected:</strong> Black Lantern Security BBOT</p> <p>The docker_pull module uses the realm parameter from a Docker registry&#39;s WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication request to an arbitrary endpoint, potentially leaking authentication tokens.</p> https://db.gcve.eu/vuln/cve-2026-12566 https://db.gcve.eu/vuln/ghsa-3mp7-vp6j-2mxx <p><strong>Affected:</strong> PyPI: bbot</p> <p>The `docker_pull` module uses the `realm` parameter from a Docker registry&#39;s `WWW-Authenticate` response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication request to an arbitrary endpoint, potentially leaking authentication tokens.</p> <p><strong>Affected:</strong> PyPI: bbot</p> <p>The `docker_pull` module uses the `realm` parameter from a Docker registry&#39;s `WWW-Authenticate` response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication request to an arbitrary endpoint, potentially leaking authentication tokens.</p> https://db.gcve.eu/vuln/ghsa-3mp7-vp6j-2mxx https://db.gcve.eu/vuln/pysec-2026-2391 <p><strong>Affected:</strong> PyPI: bbot</p> <p>The `docker_pull` module uses the `realm` parameter from a Docker registry&#39;s `WWW-Authenticate` response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication request to an arbitrary endpoint, potentially leaking authentication tokens.</p> <p><strong>Affected:</strong> PyPI: bbot</p> <p>The `docker_pull` module uses the `realm` parameter from a Docker registry&#39;s `WWW-Authenticate` response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication request to an arbitrary endpoint, potentially leaking authentication tokens.</p> https://db.gcve.eu/vuln/pysec-2026-2391