cve-2024-21626

CVE-2024-21626 Обзор Этот репозиторий содержит примеры кода для приложения, уязвимого к CVE-2024-21626, а также eBPF-гаджет для обнаружения попыток эксплуатации. Этот репозиторий был создан в рамках этой записи в блоге. Гаджет, используемый для обнаружения данной уязвимости, предназначен только д...

lxd_root

Повышение привилегий в Linux через LXD Обзор У участников локальной группы lxd в Linux-системах есть множество способов повысить свои привилегии до root. Этот репозиторий содержит примеры полностью автоматизированных локальных root-эксплойтов. Подробное объяснение уязвимости и прохождение эксплой...

CVE-2024-21626

Эксплуатация: 1.git clone https://github.com/cdxiaodong/CVE-2024-21626 2.docker-compose up Проверка: если получен /etc/passwd хоста, значит уязвимость присутствует. Окружение: runc: =v1.0.0-rc93,=1.1.11 Принцип и детали атаки: В затронутых версиях runc во время инициализации происходит утечка...

cve-2025-9074-poc

CVE-2025-9074 учебный PoC / код доказательства концепции Этот репозиторий содержит PoC, демонстрирующий в образовательных целях риск создания привилегированного контейнера с доступом на чтение/запись к файловой системе хоста через неаутентифицированный удалённый API Docker Engine. Исполняемый фай...

CVE-2025-9074-docker-escape

CVE-2025-9074-Docker Escape HTB MonitorsFour Этот код предназначен только для образовательных целей и контролируемых сред, таких как лаборатории Hack The Box. Не использовать в системах без авторизации. Этот репозиторий содержит эксплойт для уязвимости Docker Remote API exposed без аутентификации...

GHSA-6RH5-QQ4Q-97XH vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Summary NodeVM's builtin wildcard policy can allow sandboxed code to access fs/promises even when the embedder denies fs. With the following configuration: js require: builtin: '', '-fs', '-childprocess' require'fs' and require'childprocess' are blocked, but require'fs/promises' and...

CVE-2024-21626-PoC

CVE-2024-21626 Корневая причина & Proof Of Code Как использовать poc-autoplay? make install make uninstall 1. Корневая причина Уязвимость возникает из-за того, что в runc версии v1.1.11 и ниже при открытии каталога /sys/fs/cgroup хоста для настройки cgroup этот файловый дескриптор не закрывается ...

CVE-2025-34159

CVE-2025-34159: Внедрение Docker Compose в Coolify Обзор уязвимости Поле| Значение ---|--- CVE ID| CVE-2025-34159 Затрагивает| Coolify ≤ v4.0.0-beta.420.6 Исправлено в| v4.0.0-beta.420.7 Серьёзность| Critical CVSS 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE| CWE-78 OS...

CVE-2025-9074

CVE-2025-9074 – Полный выход из Docker на Windows и macOS Docker Desktop 📌 Описание Docker Desktop открывает внутренний API Docker Engine по адресу http://192.168.65.7:2375 для любого работающего контейнера — без аутентификации и без контроля доступа. Поскольку сам движок может монтировать файлов...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1789979782)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789979782 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated...

Rocky Linux 9.6 [TuxCare] Security Update: podman / podman-docker / podman-plugins / podman-remote / etc (ALMALINUX9.6:CLSA-2026:1782987821)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782987821 advisory. - Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path...

Rocky Linux 9.6 [TuxCare] Security Update: runc (ALMALINUX9.6:CLSA-2026:1783518302)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783518302 advisory. - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1,...

CLEANSTART-2024-XJ51471 flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers

Security vulnerability affects the buildah package. A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host filesystem into build containers...

AlmaLinux 9.2 [TuxCare] Security Update: podman / podman-docker / podman-gvproxy / podman-plugins / etc (ALMALINUX9.2:CLSA-2026:1782985538)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782985538 advisory. - Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1746188134)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746188134 advisory. - A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host...

CVE-2026-85526

Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...

UBUNTU-CVE-2026-85526

Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...

CVE-2026-85526: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...

DEBIAN-CVE-2026-96282

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be...

CVE-2026-96282

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be...