CVE-2026-41651

CVE-2026-41651 CVSS 3.x : 7.8 HIGH CWE : CWE-367 Time-of-Check Time-of-Use Fix : PackageKit 1.3.5+ Affects : PackageKit 1.0.2 – 1.3.4 Local privilege escalation via TOCTOU race condition in PackageKit's D-Bus transaction handler. Any unprivileged local user can install arbitrary packages as root ...

CVE-2025-6018-6019-PoC

CVE-2025-6018 & CVE-2025-6019: Local Privilege Escalation PoC A robust Proof of Concept PoC for chaining CVE-2025-6018 PAM/Polkit Active Session Bypass and CVE-2025-6019 libblockdev SUID Mount Flaw to achieve root access on vulnerable Linux systems. Disclaimer This tool is for educational purpose...

CVE-2025-6018-6019

CVE-2025-6018 CVE-2025-6019 PoC Exploit Local Privilege Escalation LPE - openSUSE / SUSE Linux Enterprise 15 Working PoC/Exploit for CVE-2025-6018 and CVE-2025-6019 - Privilege escalation from unprivileged user to root on openSUSE Leap 15.x and SUSE Linux Enterprise 15.x 🎯 Quick Summary CVE ID|...

CVE-2026-41651

🔥 CVE-2026-41651 — PackageKit TOCTOU Local Privilege Escalation Pack2TheRoot Local Privilege Escalation exploit targeting the PackageKit daemon. Escalates from an unprivileged local user to root through a TOCTOU race condition vulnerability. 📌 Overview CVE-2026-41651 also known as Pack2TheRoot is...

UBUNTU-CVE-2026-19816

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

PT-2026-91454

Name of the Vulnerable Software and Affected Versions PackageKit affected versions not specified Description An authorization flaw exists in PackageKit when using the dnf5 backend. The system skips the polkit authorization check for transactions that include the SIMULATE dry-run flag. However, th...

CVE-2026-78422

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

CVE-2026-78422 zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

EUVD-2026-68593

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

Linux Distros Unpatched Vulnerability : CVE-2026-78422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the...

PT-2026-82587

openssl encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

Exploit for Incorrect Authorization in Suse Pam-Config

CVE-2025-6018 & CVE-2025-6019 PoC A Proof of Concept for chai...

CVE-2025-67859

The CVE-2025-67859 entry relates to an improper authentication vulnerability in the TLP power daemon (Polkit-related) that allows a local user to arbitrarily change the active power profile and the daemon’s log settings. Affected software is TLP (versions 1.9 before 1.9.1). The issue is categoriz...

CVE-2025-67859 Polkit Authorization Check can be Bypassed in the TLP power daemon

A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1...

PT-2026-1887

Name of the Vulnerable Software and Affected Versions TLP versions prior to 1.9.1 TLP version 1.9.0 Description TLP version 1.9.0 introduces a profiles daemon that provides a D-Bus interface. A flaw exists in this daemon that allows local attackers to bypass Polkit authentication. This bypass is...

[USN-1962-1] ubuntu-system-service vulnerability

========================================================================== Ubuntu Security Notice USN-1962-1 September 18, 2013 ubuntu-system-service vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its...