CVE-2026-41651

🔥 CVE-2026-41651 — PackageKit TOCTOU Local Privilege Escalation Pack2TheRoot Эксплойт локального повышения привилегий, нацеленный на демон PackageKit. Повышает привилегии от непривилегированного локального пользователя до root через уязвимость состояния гонки TOCTOU. 📌 Обзор CVE-2026-41651 также...

CVE-2026-78422

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

CVE-2026-78422 zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

EUVD-2026-68593

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

CVE-2025-6018-6019-PoC

CVE-2025-6018 & CVE-2025-6019: 로컬 권한 상승 PoC 취약한 Linux 시스템에서 root 액세스 를 달성하기 위해 CVE-2025-6018PAM/Polkit 활성 세션 우회 및 CVE-2025-6019libblockdev SUID 마운트 결함을 연결하는 강력한 개념 증명PoC입니다. 면책 조항 이 도구는 교육 목적 및 승인된 보안 연구 전용 입니다. 소유하지 않았거나 명시적 테스트 권한이 없는 시스템에는 사용하지 마십시오. 취약점 체인 이 익스플로잇은 일반 사용자에서 root로 권한을 상승시키기 위해...

CVE-2026-41651

CVE-2026-41651 root@kitploit: CVSS 3.x : 7.8 HIGH CWE : CWE-367 Time-of-Check Time-of-Use Fix : PackageKit 1.3.5+ Affects : PackageKit 1.0.2 – 1.3.4 PackageKit의 D-Bus 트랜잭션 핸들러에서 TOCTOU 레이스 컨디션을 통한 로컬 권한 상승입니다. 권한이 없는 모든 로컬 사용자는 로컬 세션 외에 추가 인증 없이 루트 권한으로 임의의 패키지를 설치할 수 있습니다. 랩 / 승인된 테스트 전용 HTB, CT...

Linux Distros Unpatched Vulnerability : CVE-2026-78422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the...

CVE-2025-6018-6019

CVE-2025-6018 CVE-2025-6019 PoC Эксплойт Локальное повышение привилегий LPE - openSUSE / SUSE Linux Enterprise 15 Рабочий PoC/Эксплойт для CVE-2025-6018 и CVE-2025-6019 - Повышение привилегий от непривилегированного пользователя до root на openSUSE Leap 15.x и SUSE Linux Enterprise 15.x 🎯 Краткая...

Exploit for Incorrect Authorization in Suse Pam-Config

CVE-2025-6018 & CVE-2025-6019 PoC A Proof of Concept for chai...

CVE-2025-67859

The CVE-2025-67859 entry relates to an improper authentication vulnerability in the TLP power daemon (Polkit-related) that allows a local user to arbitrarily change the active power profile and the daemon’s log settings. Affected software is TLP (versions 1.9 before 1.9.1). The issue is categoriz...

CVE-2025-67859 Polkit Authorization Check can be Bypassed in the TLP power daemon

A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1...

PT-2026-1887

Name of the Vulnerable Software and Affected Versions TLP versions prior to 1.9.1 TLP version 1.9.0 Description TLP version 1.9.0 introduces a profiles daemon that provides a D-Bus interface. A flaw exists in this daemon that allows local attackers to bypass Polkit authentication. This bypass is...

[USN-1962-1] ubuntu-system-service vulnerability

========================================================================== Ubuntu Security Notice USN-1962-1 September 18, 2013 ubuntu-system-service vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its...