28959 matches found
CVE-2026-101305
renameat2 did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir2. This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process...
CVE-2026-101306
SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...
CVE-2026-41544 Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and...
CVE-2026-41544
The software QcalAgent is vulnerable to a path traversal vulnerability (CWE-22). If an attacker gains a user account, they can exploit this flaw to read the contents of unexpected files or system data. One source indicates the vulnerability specifically affects the /calapi/renameUpload endpoint, ...
CVE-2026-101306 Multiple jail filesystem root escapes
SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...
EUVD-2026-101867
SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...
CVE-2026-101306
This vulnerability affects all supported versions of FreeBSD . The SCM_RIGHTS file descriptor passing mechanism fails to preserve the FD_RESOLVE_BENEATH flag when a descriptor is transferred. An attacker can exploit this by sending a directory file descriptor to themselves over a Unix domain sock...
CVE-2026-101305 Multiple jail filesystem root escapes
renameat2 did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir2. This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process...
EUVD-2026-101866
renameat2 did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir2. This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process...
CVE-2026-101305
The FreeBSD operating system is affected by a vulnerability where the renameat(2) system call fails to enforce the FD_RESOLVE_BENEATH flag on directory arguments. This flaw allows a process within a jail to escape the jail's filesystem root restriction by renaming a directory relative to a restri...
CVE-2026-101304 Multiple jail filesystem root escapes
When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...
CVE-2026-101304
A vulnerability exists in FreeBSD jails where a process can escape the jail's filesystem root restriction. When fdescfs(4) is mounted with the "nodup" option, opening /dev/fd/N returns a descriptor that fails to inherit FD_RESOLVE_BENEATH or Capsicum capability rights from descriptor N. This allo...
cve-2024-21626
CVE-2024-21626 Overview This repository contains code examples for an app vulnerable to CVE-2024-21626 as well as an eBPF gadget to detect exploitation attempts. This repoistory was created as part of this blog post. The gadget program used to detect this vulnerability is for demonstration purpos...
CVE-2025-32463
Reference: https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot Executing the PoC on Ubuntu 24.04.2 LTS server with Sudo v1.9.15p5, using an unprivileged user with no Sudo rules defined, results in a root shell outside of the chrooted environment. lowpriv@prod:/CVE-2025-3246...
CVE-2026-46300
Security Research & Legal Disclaimer This repository is for educational and authorized security research purposes only. Permitted Use Understanding security vulnerabilities and exploitation concepts in controlled environments local VMs, isolated labs Studying sandbox isolation mechanisms and thei...
Docker-Escape-Miner
Using a published Docker exploit to gain root access and run a bitcoin mining script This uses two open source libraries: nightminer by @ricmoo for python bitcoin mining RunC-CVE-2019-5736 by @twistlock for the docker escape System Requirements This was tested on Kali Linux, with Docker version...
n8n-RCE-CVE-2025-68613
n8n Expression Injection RCE Analysis CVE-2025-68613 This repo contains the lab report I prepared for exploiting the vulnerable n8n service available on the Hackviser platform. In the study, I demonstrated how I performed a sandbox escape by using the expression evaluation mechanism on n8n and...
CrackKeyIso
CVE 2023 28229 Windows CNG KeyIso RPC EoP/SBX Discovered by: @k0shl - @Y3A Educational purposes only!...
CLEANSTART-2026-GV65273 tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory
Security vulnerability affects the openbao package. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory...
