UBUNTU-CVE-2026-97029

Flatpak's process ID namespace separation does not prevent a sandboxed app's kill0, signal or killpg0, signal calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processe...

CVE-2026-97029

A vulnerability in Flatpak allows a sandboxed application to bypass process ID namespace separation . Specifically, the kill(0, signal) or killpg(0, signal) calls can reach processes outside the sandbox if they share the same process group . A malicious or compromised Flatpak app can exploit this...

Trespasser

CVE-2026-74970 · Firefox Fission site-isolation bypass via missing PipelineId namespace check This directory holds an honest reproduction scaffold for a Fission site-isolation authorization bypass in Firefox WebRender. Under Fission each content process owns a distinct PipelineId namespace, but t...

Linux Distros Unpatched Vulnerability : CVE-2026-97029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flatpak's process ID namespace separation does not prevent a sandboxed app's kill0, signal or killpg0, signal calls from reaching processes outside the sandbox...

SUSE CVE-2026-97476

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

CVE-2026-98021

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS by triggering excessive memory consumption on the host. When creating or updating network interfaces through the routing netlink rtnetlink interface, the kernel fails to validate and enforce maximum limits on the...

CVE-2026-98009

A flaw was found in the Linux kernel's Enhanced Transmission Selection ETS network scheduler. A local user with network administration privileges, including an unprivileged user inside a user namespace, can configure traffic control queue disciplines with invalid or unconstrained quantum...

tugtainer-1.30.2-CVE-2026-55494-and-CVE-2026-62308-to-RCE

Tugtainer v1.30.2 RCE 이 RCE는 2개의 취약점을 악용하여 얻습니다. CVE-2026-55494 CVE-2026-62308 간단히 말해, SSRF 취약점을 악용하여 내부 네트워크의 인증되지 않은 서비스를 호출하고 tugtainer와 동일한 PID를 공유하는 도커를 생성합니다. 이를 통해 /proc/1/root를 경유하여 tugtainer 도커의 파일 시스템에 접근할 수 있게 되며, 생성된 도커는 루트 수준 권한을 가지므로 기술적으로 tugtainer 도커 시스템에 대한 루트 권한을 갖게 됩니다. 설정 이 저장...

CVE-2026-46331

CVE-2026-46331 - "pedit COW" 脆弱性評価および緩和ガイド このリポジトリには、Linuxカーネルにおけるローカル権限昇格の脆弱性 CVE-2026-46331 （ "pedit COW" として知られる）への曝露を確認し、一時的な緩和策を適用するための基本的な管理ツールが含まれています。 リポジトリの内容 1. check.sh : 現在のカーネルバージョンとユーザー namespaces の設定を検証し、システムのリスクレベルを評価するローカル診断スクリプトです。 2. fixvulnerabilidad.sh : 非特権 namespaces...

CVE-2026-2270

A flaw was found in Kubernetes kube-controller-manager. The StatefulSet controller restores ControllerRevision data onto the whole StatefulSet object, including metadata. A user with namespace-scoped write access to StatefulSet and ControllerRevision can cause the controller to create a pod in...

GO-2026-6521 Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule

Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule...

GO-2026-6520 Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement in github.com/projectcapsule/capsule

Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement in github.com/projectcapsule/capsule...

CVE-2026-88808

The Fleet agent in SUSE Rancher Fleet contains a vulnerability where it writes resources to downstream clusters using its own cluster-admin credentials instead of the specific ServiceAccount pinned to the deployment. This flaw impacts multi-tenancy environments where different teams share downstr...

CVE-2026-88808 Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2026-88808 Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2026-88808 Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...

CVE-2026-93540 Fleet applies namespace labels and annotations without the bundle's service account privileges

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a...

CVE-2026-93540 Fleet applies namespace labels and annotations without the bundle's service account privileges

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a...

CVE-2026-93540: Incorrect Privilege Assignment

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a...

SUSE SLES16 Security Update : jsoup, re2j (SUSE-SU-2026:23867-1)

"The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:23867-1 advisory. This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited namespace map on every...