Docker Hub Security Advisory: Personal Access Token Transfer
By BIOS Founding Team
Docker Hub's account-to-organization conversion could reassign a converted account's personal access tokens to a named new owner without rotating the secret or notifying that owner. Docker rated the issue critical.
It was reported and fixed on September 30, and the exposure window ran from August 26, 2024. After reviewing about 304,000 pushes, Docker found no evidence of exploitation. It notified affected users on October 2 and deactivated the transferred tokens on October 8.
Full details: https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/
More from the community
Vue 3.6.0-rc.11
The latest release candidate adds one feature: Vapor slot content can now transition inside a VDOM Transition. It also has about 60 bug fixes, mainly in the Vapor compiler and runtime.
Python 3.15.0 Is Here
Python 3.15.0 is the stable release of the 3.15 series, built from 5,643 commits by 1,012 contributors. Headline changes are explicit lazy imports (PEP 810), a frozendict built-in (PEP 814), a sentinel built-in (PEP 6...
PostgreSQL JDBC 42.7.14 Security Update
The PostgreSQL JDBC project released version 42.7.14 as a security update for two CVEs. The news page gives no vulnerability details or affected-version range, so users should check the linked GitHub advisories.