capsule

Capsule Getting Started • Documentation • Issues • Contributing Overview Capsule is a runtime for executing untrusted code in isolated environments. Each task runs inside its own WebAssembly sandbox, providing: Isolated execution : Each task runs isolated from your host system Resource limits : S...

WPTimeCapsulePOC

Backup and Staging by WP Time Capsule 1.21.16 - Authentication Bypass Proof Of Concept An authentication bypass was recently discovered https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/ on WP Time Capsule 1.21.16 . This PoC prove how the issue works and how it can be...

CVE-2024-8856

CVE-2024-8856: Vulnerabilidad de subida arbitraria de archivos en el plugin WP Time Capsule de WordPress Resumen CVE-2024-8856 es una vulnerabilidad de seguridad encontrada en el plugin WP Time Capsule para WordPress que permite a usuarios no autenticados subir archivos arbitrarios al servidor...

CVE-2024-8856

CVE-2024-8856 This tool scans WordPress websites for vulnerabilities in the WP Time Capsule plugin related to CVE-2024-8856. It identifies plugin versions below "1.22.22" as vulnerable and logs results to "vuln.txt". Simple and efficient, it helps security researchers and admins detect and addres...

The vulnerability of the __efi_capsule_setup_info() function in the drivers/firmware/efi/capsule-loader.c file of the Linux kernel’s firmware module allows a hacker to trigger a system failure.

The vulnerability of the eficapsulesetupinfo function in the drivers/firmware/efi/capsule-loader.c file of the Linux kernel firmware module is related to incorrect calculation of buffer size. Exploiting this vulnerability could allow an attacker to cause a system failure...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A issue was discovered in the Linux kernel through version 5.19.8. In the file drivers/firmware/efi/capsule-loader.c, there is a race condition that leads to a use-after-free situation...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-6.1, Linux-5.15

In the Linux kernel, the following vulnerabilities have been resolved: efi/capsule-loader: corrected incorrect allocation size gcc-14 reports that the allocation using sizeofvoid on 32-bit architectures is insufficient for a 64-bit physaddrt: drivers/firmware/efi/capsule-loader.c: In the function...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100747)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100747 advisory. In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect sizeof in phys array reallocation The krealloc call for...

CVE-2026-65835

creationtimestamp| type| source ---|---|--- 2026-07-31 18:35:41+00:00| published-proof-of-concept| https://github.com/projectcapsule/capsule/security/advisories/GHSA-jr6p-8pjj-mfx6...

CVE-2026-65834

creationtimestamp| type| source ---|---|--- 2026-07-31 18:35:08+00:00| published-proof-of-concept| https://github.com/projectcapsule/capsule/security/advisories/GHSA-68cj-mvg9-rgm2...

Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

Summary CVE-2026-22872 GHSA-qjjm-7j9w-pw72 reported that a Tenant Owner could create cluster-scoped resources e.g. ClusterRole, ValidatingWebhookConfiguration through a TenantResource, because the controller applies them with its cluster-admin ServiceAccount and SetNamespace is ineffective for...

GHSA-68CJ-MVG9-RGM2 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Summary CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and ForbiddenAnnotations.Regex are never validated by any admission webhook. A Cluster Admin can persist a malformed regex to etcd without being blocked. Once stored, every Node CREATE, UPDATE, or PATCH request triggers...

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Summary CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and ForbiddenAnnotations.Regex are never validated by any admission webhook. A Cluster Admin can persist a malformed regex to etcd without being blocked. Once stored, every Node CREATE, UPDATE, or PATCH request triggers...

EUVD-2026-51295

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests...

CVE-2026-65834

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...

CVE-2026-65835

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the...

CVE-2026-65835 Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the...

CVE-2026-65835 Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the...

CVE-2026-65835

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRawItem and handleGeneratorItem, did not apply the...

CVE-2026-65835

CVE-2026-65835 affects Capsule (Kubernetes multi-tenant framework) v0.13.0–v0.13.8. After the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go failed to apply the ResourceReference.LoadResources and IsNamespacedGVK guard used by Na...