CVE-2026-41651

CVE-2026-41651 root@kitploit: CVSS 3.x : 7.8 HIGH CWE : CWE-367 Time-of-Check Time-of-Use Fix : PackageKit 1.3.5+ Affects : PackageKit 1.0.2 – 1.3.4 PackageKit の D-Bus トランザクションハンドラにおける TOCTOU レースコンディションを介したローカル権限昇格。 特権を持たないローカルユーザーは、任意のパッケージを root としてインストールできます — ローカルセッションを持っていること以外の認証は不要です。 ラボ /...

CVE-2025-6018-6019

CVE-2025-6018 CVE-2025-6019 PoC エクスプロイト ローカル特権昇格 LPE - openSUSE / SUSE Linux Enterprise 15 CVE-2025-6018 および CVE-2025-6019 に対する動作するPoC/エクスプロイト - openSUSE Leap 15.x および SUSE Linux Enterprise 15.x 上で、非特権ユーザーから root への特権昇格 🎯 クイックサマリー CVE ID| 脆弱性| 影響 ---|---|--- CVE-2025-6018| PAM環境変数インジェクション|...

CVE-2026-41651

🔥 CVE-2026-41651 — PackageKit TOCTOU ローカル権限昇格 Pack2TheRoot PackageKit デーモンを標的としたローカル権限昇格エクスプロイト。 TOCTOU 競合状態の脆弱性を利用して、非特権ローカルユーザーから root に権限昇格します。 📌 概要 CVE-2026-41651 別名 Pack2TheRoot は、多くの Linux ディストリビューションでパッケージ管理抽象化に使用されるシステムサービス PackageKit における重大な TOCTOU Time-Of-Check to Time-Of-Use 競合状態の脆弱性です...

CVE-2025-6018-6019-PoC

CVE-2025-6018 & CVE-2025-6019: ローカル特権昇格PoC 脆弱なLinuxシステム上でCVE-2025-6018 PAM/Polkitアクティブセッションバイパス と CVE-2025-6019 libblockdev SUIDマウントの欠陥 を連鎖させ、rootアクセス を達成するための堅牢なProof of Concept（PoC）です。 免責事項 このツールは教育目的および許可されたセキュリティ研究専用 です。所有していない、または明示的な許可を得ていないシステムでは使用しないでください。 脆弱性チェーン...

UBUNTU-CVE-2026-19816

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

PT-2026-91454

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPO REMOVE ||...

CVE-2026-78422

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

CVE-2026-78422 zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

EUVD-2026-68593

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

Linux Distros Unpatched Vulnerability : CVE-2026-78422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the...

PT-2026-82587

openssl encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

Exploit for Incorrect Authorization in Suse Pam-Config

CVE-2025-6018 & CVE-2025-6019 PoC A Proof of Concept for chai...

CVE-2025-67859

The CVE-2025-67859 entry relates to an improper authentication vulnerability in the TLP power daemon (Polkit-related) that allows a local user to arbitrarily change the active power profile and the daemon’s log settings. Affected software is TLP (versions 1.9 before 1.9.1). The issue is categoriz...

CVE-2025-67859 Polkit Authorization Check can be Bypassed in the TLP power daemon

A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1...

PT-2026-1887

Name of the Vulnerable Software and Affected Versions TLP versions prior to 1.9.1 TLP version 1.9.0 Description TLP version 1.9.0 introduces a profiles daemon that provides a D-Bus interface. A flaw exists in this daemon that allows local attackers to bypass Polkit authentication. This bypass is...

[USN-1962-1] ubuntu-system-service vulnerability

========================================================================== Ubuntu Security Notice USN-1962-1 September 18, 2013 ubuntu-system-service vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its...