OWASP DockSec v2026.9.20 Released

DockSec is an OWASP Lab Project combining scanners like Trivy, Hadolint, and Docker Scout with multi-LLM support to turn Docker security scan results into actionable, plain-English fixes.

A new version, v2026.9.20, just landed - 24 merged pull requests, the biggest release in a while.

The headline additions are a deterministic core with structured findings and EPSS-based priority scoring, plus AI correlation and exploit chain analysis to connect related findings. A new --fix command can apply fixes directly, self-scanning CI integration and signed releases add supply-chain trust, and reports gained a Markdown format for CI/CD along with Jinja2-based HTML templates replacing the old string substitution. On the fix side: compose scan failures now surface properly per-service, connection-string passwords get masked in output, and the container image is now published to GHCR.

New Features
Deterministic core: structured findings, EPSS priority scoring
AI correlation and exploit chain analysis
--fix command, self-scanning CI, signed releases
Markdown report format for CI/CD
Jinja2 templates replacing string-substitution HTML reports
Container image publishing to GHCR

Bug Fixes
Per-service compose scan failure reporting
Password masking in connection-string URLs
Compose exit codes, config formats, path validation fixes
JSON-string list tolerance in AI model output

Full release notes and complete changelog: v2026.9.20

Happy scanning! :-)

• News
• Tools
• Ai