Lucene search
+L

1278 matches found

Kitploit
Kitploit
added 2026/09/10 5:18 p.m.5 views

HTB-Silentium-Writeup

HTB - Silentium Writeup Machine Info Name: Silentium OS: Linux Difficulty: Easy CVEs: CVE-2025-58434, CVE-2025-59528, CVE-2025-8110 Enumeration Nmap Scan root@kitploit: nmap -sC -sV -p- --min-rate 5000 -oN nmap.txt Open ports: 22 SSH, 80 HTTP Virtual Hostsstaging.silentium.htb runs Flowise 3.0.5...

10CVSS7.1AI score0.86218EPSS
SaveExploits53References3
Kitploit
Kitploit
added 2026/09/10 2:52 p.m.10 views

CVE-2026-31413-BPF-Container-Escape

CVE-2026-31413: One Byte in the BPF Verifier to Container Escape I found a soundness bug in the Linux BPF verifier - a + 1 in a pushstack call that causes the verifier to skip an ALU instruction on a forked path. For BPFOR, this means the verifier tracks dst = 0 while the CPU computes 0 | K = K. ...

7.8CVSS7.2AI score0.00221EPSS
SaveExploits2References6
Kitploit
Kitploit
added 2026/09/10 2:43 p.m.6 views

CVE-2025-9074-Docker-Desktop-Container-Escape

CVE-2025-9074: Docker Desktop Container Escape PoC Proof of Concept exploit for CVE-2025-9074 - a critical container escape vulnerability in Docker Desktop that allows unauthenticated access to the Docker Engine API. Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2025-9074 CVSS Score|...

9.3CVSS8.1AI score0.01629EPSS
SaveExploits15References1
Kitploit
Kitploit
added 2026/09/10 1:33 p.m.5 views

CVE-2024-21626-PoC

CVE-2024-21626 Root cause & Proof of Concept How to use poc-autoplay? root@kitploit: make install make uninstall 1. Root cause In runc versions ≤ 1.1.11, when opening the host's /sys/fs/cgroup directory to set cgroups, the file descriptor is left open for the container initialization process...

8.6CVSS7AI score0.18087EPSS
SaveExploits18
Kitploit
Kitploit
added 2026/09/10 11:03 a.m.3 views

Holistic-Deconstruction-of-CVE-2019-5736-

= doi.org/10.5281/zenodo.18304765 = orcid.org/0009-0007-7728-256X README.md 💀 CVE-2019-5736: runc Container Breakout Deconstruction Advanced Purple Teaming & Forensic Analysis of Host Root Escape 🛡️ Overview This repository contains a high-fidelity deconstruction and Proof-of-Concept PoC for...

9.3CVSS7.1AI score0.98452EPSS
SaveExploits35
NVD
NVD
added 2026/09/10 9:17 a.m.8 views

CVE-2026-84042

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking krun.usepasst, crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun = 1.29...

7.8CVSS0.001EPSS
SaveExploits0References3
NVD
NVD
added 2026/09/10 9:17 a.m.7 views

CVE-2026-88265

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

5.6CVSS0.00119EPSS
SaveExploits0References3
CVE
CVE
added 2026/09/10 8:24 a.m.17 views

CVE-2026-84042

crun is a lightweight OCI container runtime. This flaw affects builds that include libkrun with passt networking enabled (krun.use_passt). When a container is started rootful , crun can execute an attacker-controlled payload embedded in the container image with host root privileges , effectively ...

7.8CVSS0.001EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/09/10 8:24 a.m.38 views

CVE-2026-84042 Crun: crun: rootful krun with passt executes container payload as host root

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking krun.usepasst, crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun = 1.29...

7.8CVSS0.001EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/09/10 8:08 a.m.13 views

CVE-2026-84042

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking krun.usepasst, crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun = 1.29...

7.8CVSS0.001EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/10 5:43 a.m.5 views

CVE-2025-9074

CVE-2025-9074 – Full Docker Escape on Windows & macOS Docker Desktop 📌 Description Docker Desktop exposes the internal Docker Engine API at http://192.168.65.7:2375 to any running container — with no authentication and no access control. Because the engine itself can mount the host filesystem, a...

9.3CVSS8.1AI score0.01629EPSS
SaveExploits15
Kitploit
Kitploit
added 2026/09/10 1:44 a.m.5 views

CVE-2026-31431-Copy-Fail

CVE-2026-31431 — "Copy Fail": Linux Kernel algifaead Local Privilege Escalation CISA KEV | CVSS 7.8 HIGH | Affects Linux kernels 4.14 – early 2026 9 years Table of Contents 1. Executive Summary 2. Risk Assessment 3. Technical Deep Dive 4. Attack Methodology — Red Team 5. Detection & Incident...

7.8CVSS6.4AI score0.99907EPSS
SaveExploits242References2
Kitploit
Kitploit
added 2026/09/10 1:44 a.m.5 views

CVE-2026-31431-Container-Escape

CVE-2026-31431 Container Escape Container escape via runC...

7.8CVSS6.5AI score0.99907EPSS
SaveExploits242
Kitploit
Kitploit
added 2026/09/10 1:43 a.m.19 views

copy-fail-CVE-2026-31431

CVE-2026-31431 Copy Fail exploit Author: pyroceper Tested on: Ubuntu 25.10 x8664 root@kitploit: $ make $ ./exploit Detected kernel: 6.17.0 Making backup of /etc/passwd to /tmp Backup saved as /tmp/passwd.bak Obtaining root shell... id uid=0pwn gid=0root groups=0root whoami pwn CREDITS & REFERENCE...

7.8CVSS6.6AI score0.99907EPSS
SaveExploits242References2
Kitploit
Kitploit
added 2026/09/10 1:43 a.m.7 views

CVE-2026-31431-Copy-Fail-Container-Escape

CVE-2026-31431-Copy-Fail-Container-Escape Demo https://github.com/user-attachments/assets/2cb0cb67-789a-4461-a0b8-1fe878d9426e Prerequisite Container vulnerable to CVE-2026-31431 Container healthcheck configured and healthcheck CMD known Obtained root access inside the container if not, you can...

7.8CVSS6.5AI score0.99907EPSS
SaveExploits242References2
Kitploit
Kitploit
added 2026/09/10 1:41 a.m.7 views

CVE-2026-31431

CVE-2026-31431 — Copy Fail 中文版 732 Bytes to Root on Every Major Linux Distribution CVE-2026-31431 Copy Fail is a logic bug in the Linux kernel's authencesn cryptographic template. It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any...

7.8CVSS6.6AI score0.99907EPSS
SaveExploits242References2
Kitploit
Kitploit
added 2026/09/10 1:41 a.m.6 views

CVE-2026-31431-PocC

CVE-2026-31431-PoC CVE-2026-31431 PoC reproduced in C, usable for exploitation when Python is not available on the target environment. Vulnerability Basic Information Vulnerability type: Linux kernel AFALG subsystem page cache poisoning, achieving local privilege escalation and possible container...

7.8CVSS6.5AI score0.99907EPSS
SaveExploits242
Kitploit
Kitploit
added 2026/09/10 1:40 a.m.6 views

yc-mk8s-copy-fail-mitigation

Copy Fail / Dirty Frag Mitigation for Yandex Managed Kubernetes Automatic application of mitigation for vulnerabilities CVE-2026-31431, CVE-2026-43284 and CVE-2026-43500 in the Linux kernel on all worker nodes of a Yandex Managed Kubernetes cluster. Vulnerability Description CVE ID: CVE-2026-4328...

8.8CVSS6.5AI score0.99907EPSS
SaveExploits272References3
Kitploit
Kitploit
added 2026/09/10 1:39 a.m.6 views

copy-fail-CVE-2026-31431

Vulnerability Description Root Cause In 2017, the Linux kernel crypto module authencesn introduced an in-place optimization for AEAD Authenticated Encryption with Associated Data operations. This optimization caused read-only pages in the page cache to be incorrectly placed into a writable...

7.8CVSS6.6AI score0.99907EPSS
SaveExploits242
Kitploit
Kitploit
added 2026/09/10 1:39 a.m.6 views

wg.copyfail.patch

CVE-2026-31431 aka Copy.Fail eBPF workaround Why it matters This CVE allows authorized user change cache copy of any readable file, which leads to Local Privilege Escalation aka local root exploit, sandbox/container escape and other issues. It works by creating AFALG socket that is provided by...

7.8CVSS6.5AI score0.99907EPSS
SaveExploits242
Rows per page
Query Builder