bubblewrap

Bubblewrap 许多容器运行时工具，如 systemd-nspawn、docker 等，专注于为系统管理员和编排工具（例如 Kubernetes）提供运行容器的基础设施。 这些工具不适合提供给非特权用户，因为将此类访问权限转化为宿主机上完全特权级的 root shell 是轻而易举的。 用户命名空间 Linux 内核中有一个名为用户命名空间的特性，它允许非特权用户使用容器功能。Bubblewrap 利用这些特性来构建沙箱，从而允许任何用户使用该工具。 从历史上看，bubblewrap 还曾为不支持非特权用户命名空间的系统提供 setuid 模式。然而，该模式已被移除。 最初的...

Exploit for CVE-2026-59734

🚨 CVE-2026-59734 — Coolify RCE Exploit OS Command Inject...

CVE-2026-44939

A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/tokenclusterId.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers...

CVE-2026-44939 Command injection through unsanitized YAML parameter in Rancher

A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/tokenclusterId.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers...

PT-2026-50872

Name of the Vulnerable Software and Affected Versions Rancher Manager versions prior to 2.14.2 Description A command injection issue exists in the import endpoint "/v3/import/token clusterId.yaml". This occurs due to unsanitized YAML parameters, which could allow remote attackers to break out of ...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal due to incorrect matching in the limit container paths process. An attacker can bypass intended path restrictions by placing containers in sibling directories with similar names, allowing unauthorized container...

OpenClaw OS Command Injection Vulnerability (CNVD-2026-13291)

OpenClaw is openclaw open source an intelligent artificial assistant. OpenClaw there is an operating system command injection vulnerability , the vulnerability stems from the Docker sandbox execution mechanism when constructing shell commands on the PATH environment variable handling insecurity ,...

EUVD-2018-1897

Malware in sbrugna...

EUVD-2021-2599

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2020-25039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution. CVE-2020-25039...

The vulnerability of the software for managing modules and services within Kubernetes Submariner Operators, related to errors in privilege management, allows a perpetrator to execute any container on a node.

The vulnerability of the software for installing, configuring, and managing Submariner in the Kubernetes Submariner Operator is related to errors in privilege management. Exploiting this vulnerability could allow a malicious actor to execute arbitrary containers on nodes remotely...

OESA-2024-1251 cri-o security update

Open Container Initiative-based implementation of Kubernetes Container Runtime Interface. Security Fixes: Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to t...

CVE-2024-23653

CVE-2024-23653 involves BuildKit allowing a container with elevated privileges via interactive APIs unless entitlement checks are enforced. Description notes that privileged containers are normally gated by security.insecure entitlement and user authorization, and that the issue has been fixed in...

[SECURITY] Fedora 36 Update: containerd-1.6.19-1.fc36

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

[SECURITY] Fedora 36 Update: containerd-1.6.14-2.fc36

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

[SECURITY] Fedora 37 Update: containerd-1.6.14-2.fc37

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

CVE-2022-41835 F5OS vulnerability CVE-2022-41835

In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and impact the F5OS controller...

[SECURITY] Fedora 37 Update: containerd-1.6.8-2.fc37

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

[SECURITY] Fedora 36 Update: containerd-1.6.6-5.fc36

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

[SECURITY] Fedora 36 Update: containerd-1.6.6-4.fc36

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...