10 Best Container Image Scanning Tools Compared (2026): Features & Pricing
A 2026 roundup compares ten container image scanners, from free Trivy and Grype to Sysdig, Wiz, and Chainguard.
22
Vendor
Docker
- Mentions · 7d0
- Mentions · 30d8
- All mentions25
- First seenAug 24, 2026
- Last mentioned15d ago
Timeline
25 articles · newest firstZDI-26-758: Docker Buildx Filesystem Entitlements Protection Mechanism Failure Remote Code Execution Vulnerability
ZDI discloses a Docker Buildx entitlements flaw enabling remote code execution after user interaction.
58
CVE-2026-105445: Docker Hub PAT Reassignment Flaw
Docker disclosed CVE-2026-105445, a critical Docker Hub flaw that can reuse reassigned personal access tokens.
74
Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
Docker patched a critical two-year Docker Hub flaw that could let one user push images as another, with no known exploitation.
73
Top 10 Best Container Image Scanning Tools in 2026 [Ranked & Scored]
A 2026 ranking puts Trivy, Sysdig, and Wiz atop container image scanners, favoring context over raw CVE counts.
18
Docker Agent
Hacker News discusses Docker's docker-agent GitHub repo, but the post includes almost no details.
32
10 Best Container Registry Security Tools Compared (2026): Features & Pricing
A 2026 roundup compares 10 container registry security tools, led by free Harbor and Trivy.
16
CopyEscape Docker Flaw Lets Malicious Containers Overwrite Host Files and Gain Root Access
CopyEscape, CVE-2026-17106, lets malicious containers overwrite host files through Docker's archive copy path.
62
Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts
Carbonato installs Hermes Agent on hacked Docker hosts to run Telegram commands and steal AI API keys.
64
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Carbonato botnet infects unauthenticated Docker hosts and installs a Telegram-controlled Hermes AI agent to steal credentials and run commands.
74
Hackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker Servers
CARBONATO botnet hijacks exposed Docker servers and uses Hermes Agent for operator control.
74
Researchers Found a Botnet That Uses an AI Agent to Operate Inside Compromised Servers
CARBONATO infects exposed Docker hosts, persists, spreads to nearby daemons, and runs a Telegram-controlled AI agent.
74
AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway
CARBONATO hijacks exposed Docker hosts, installs an AI agent, and steals LLM API keys to fund its gateway.
76
Docker introduces OCI-based Kits to package agents and their guardrails
Docker launched Cloud Sandboxes and OCI-based Kits that package AI agents together with enforceable guardrails.
46
New Carbonato malware uses AI agents to hijack exposed Docker hosts
Carbonato botnet hijacks exposed Docker hosts, installs Hermes Agent, and spreads by scanning for more daemons.
76
Software sandboxing: The basics (2025)
A technical write-up presents composable seccomp-BPF syscall allowlist policies for sandboxing unprivileged Linux applications, inspired by Docker, systemd, and OpenBSD pledge.
30
Top 10 Best Container Registry Security Tools in 2026
A 2026 buyer's guide scores ten container registry security tools including Aqua, Snyk, JFrog Xray, Prisma Cloud, and Anchore.
25
Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
Docker fixed CVE-2026-77179 (CVSS 9.4), a virtio-fs symlink flaw letting code inside macOS Sandboxes VMs read and modify host files; update to 0.42.0.
56
Critical Docker Sandbox Vulnerabilities Enable Malicious Guests to Escape Isolated microVM Workspaces
Docker patched two sandbox-escape flaws, CVE-2026-77179 and CVE-2026-79994, letting malicious guest workloads access host files and sockets.
62
Docker Sandboxes Vulnerabilities Let Malicious Guests Escape Workspace and Access Host Files
Docker fixed two symlink-race flaws in Docker Sandboxes, CVE-2026-77179 and CVE-2026-79994, letting malicious guests escape the workspace and read host files; fixed in 0.42.0.
55
Seeing is Not Believing: Breaking the Physical-to-Digital Trust Boundary in Robotics
Researchers show a single ROS 2 environment variable lets attackers inject fake telemetry and hijack robots while spoofing downstream remote attestation.
50
ToolHive: The open-source way to run any MCP server securely
Stacklok's open-source ToolHive runs Model Context Protocol servers in isolated containers with per-request identity enforcement, audit logging and a signed registry.
45
Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means
GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.
55
Rootless Docker and Its Hidden Security Trade-Offs
A blog post examines the security trade-offs of running Docker in rootless mode, covering isolation benefits and hidden limitations for defenders.
25
One in four MCP servers opens AI agent security to code execution risk
Noma Security whitepaper finds most popular AI Skills and many MCP servers carry high-risk capabilities, with state changes most prevalent.
62
Related CVEs
by mentions- CVE-2026-77179<1%9.4Symlink Escape in Docker Sandboxes virtio-fs Exposes macOS Host Files
- TOCTOU Symlink Race in Docker Sandboxes Socket Relay Exposes Host Sockets
- CVE-2026-17106<1%7.1Path Traversal via Link Following in Moby go-archive Tar Extraction
- Incorrect privilege assignment in Docker Hub token conversion
- CVE-2026-5817<1%8.8The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when loading model tokenizers, and runs without…
- CVE-2026-5843<1%8.8The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model…
- CVE-2026-28400<1%7.5Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker
- CVE-2026-2664<1%6.8An out of bounds read vulnerability in the grpcfuse kernel module present in the Linux VM in Docker Desktop for Windows, Linux and macOS up to version 4.61.0…
- CVE-2026-33990<1%6.8Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker
Appears with
- Dockerproduct · 8
- Carbonatomalware · 6
- Hermes Agentproduct · 6
- ThreatDownorganization · 5
- Snykvendor · 4
- Sysdigvendor · 4
- Anchorevendor · 4
- Grypeproduct · 4
- Aqua Securityvendor · 4
- Dockerorganization · 4
- JFrogvendor · 4
- Syftproduct · 4
- Palo Alto Networksvendor · 4
- Trivyproduct · 4
- Docker Sandboxesproduct · 4
- JFrog Xrayproduct · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.