CVE-2025-36154

Medium · 6.2

CVSS

6.2

EPSS

0.1%

Published

Dec 24, 2025

CISA due date

—

The record

IBM Concert 1.0.0 through 2.1.0 stores sensitive information in cleartext during recursive docker builds which could be obtained by a local user.

Ecosystem	Package	Introduced	Fixed