cve-2025-9074-poc

CVE-2025-9074 PoC éducatif / Preuve de concept Ce dépôt contient un PoC à des fins éducatives démontrant le risque de pouvoir créer un conteneur privilégié avec accès en lecture/écriture au système de fichiers hôte en exploitant les API distantes non authentifiées de Docker Engine. Le fichier...

cve-2024-21626

CVE-2024-21626 Aperçu Ce dépôt contient des exemples de code pour une application vulnérable à CVE-2024-21626 ainsi qu'un gadget eBPF pour détecter les tentatives d'exploitation. Ce dépôt a été créé dans le cadre de cet article de blog. Le programme gadget utilisé pour détecter cette vulnérabilit...

vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Summary NodeVM's require.external option lets sandboxed code require local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes nodemodules, two defaults combine to fully defeat the sandbox: - require.root defaults to unrestricted...

CVE-2024-21626

CVE-2024-21626 Exploit répertoire de travail docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm Il est important de mettre -w /proc/self/fd/8\ Accédez au système de fichiers de l'hôte avec cat ../../../../../../../../../etc/passwd à l'intérieur du conteneur Exploit Symli...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1789979782)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789979782 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1746188134)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746188134 advisory. - A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host...

CVE-2026-100597

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

EUVD-2026-87454

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

Duplicate Advisory: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j3hm-6rg5-mchv. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit...

GHSA-P8RW-8QJ3-HF33 Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Summary An authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundl...

EUVD-2026-39477

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts...

Security update for podman

This update for podman fixes the following issues: CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership modification on the host filesystem bsc1268579. CVE-2026-57231: specially crafted image can trick podman run into leakin...

CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...

CVE-2026-63293

The CVE-2026-63293 entry concerns LXD: during image import/unpack, metadata.yaml is not validated as a symlink, enabling a crafted image archive to point to host filesystem paths. This can allow arbitrary file read and write on the host, escalating to full access via symlink traversal. The descri...

CVE-2026-18982

The CVE concerns RHOAI training-operator. Affected component: training-operator within Kubernetes environments. Privilege escalation arises from aggregating training job permissions onto native Kubernetes edit and admin ClusterRoles, combined with unrestricted PodTemplateSpec passthrough. A user ...

EUVD-2026-55822

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

PT-2026-69968

Name of the Vulnerable Software and Affected Versions RHOAI training-operator affected versions not specified Description A flaw allows users with standard edit or admin roles in any Kubernetes namespace to escalate privileges. By creating training jobs, an attacker can impersonate service...

SUSE CVE-2026-44210

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

AZL-93063 CVE-2026-44210 affecting package kata-containers for versions less than 3.32.0.kata0-1

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...