cve-2025-9074-poc

CVE-2025-9074 учебный PoC / код доказательства концепции Этот репозиторий содержит PoC, демонстрирующий в образовательных целях риск создания привилегированного контейнера с доступом на чтение/запись к файловой системе хоста через неаутентифицированный удалённый API Docker Engine. Исполняемый фай...

cve-2024-21626

CVE-2024-21626 개요 이 저장소는 CVE-2024-21626에 취약한 앱을 위한 코드 예제와 공격 시도를 탐지하는 eBPF 가젯을 포함하고 있습니다. 이 저장소는 이 블로그 게시물의 일부로 작성되었습니다. 이 취약점을 탐지하는 데 사용되는 가젯 프로그램은 데모 목적으로만 제공됩니다. 이는 CVE-2024-21626의 완전한 탐지가 아닙니다. 취약점 설명 CVE-2024-21626은 runc 컨테이너 런타임의 취약점으로, v1.1.12 이전 버전에 존재합니다. 이 취약점은 runc가 컨테이너 내에서 명령을 생성하거나...

vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Summary NodeVM's require.external option lets sandboxed code require local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes nodemodules, two defaults combine to fully defeat the sandbox: - require.root defaults to unrestricted...

CVE-2024-21626

CVE-2024-21626 Эксплойт Рабочий каталог docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm Важно указать -w /proc/self/fd/8\ Получите доступ к файловой системе хоста с помощью cat ../../../../../../../../../etc/passwd внутри контейнера Эксплойт Символическая ссылка 1...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1789979782)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789979782 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1746188134)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746188134 advisory. - A flaw was found in Buildah and subsequently Podman Build which allows containers to mount arbitrary locations on the host...

CVE-2026-100597

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

EUVD-2026-87454

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

Duplicate Advisory: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j3hm-6rg5-mchv. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit...

GHSA-P8RW-8QJ3-HF33 Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Summary An authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundl...

EUVD-2026-39477

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts...

Security update for podman

This update for podman fixes the following issues: CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership modification on the host filesystem bsc1268579. CVE-2026-57231: specially crafted image can trick podman run into leakin...

CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...

CVE-2026-63293

The CVE-2026-63293 entry concerns LXD: during image import/unpack, metadata.yaml is not validated as a symlink, enabling a crafted image archive to point to host filesystem paths. This can allow arbitrary file read and write on the host, escalating to full access via symlink traversal. The descri...

CVE-2026-18982

The CVE concerns RHOAI training-operator. Affected component: training-operator within Kubernetes environments. Privilege escalation arises from aggregating training job permissions onto native Kubernetes edit and admin ClusterRoles, combined with unrestricted PodTemplateSpec passthrough. A user ...

EUVD-2026-55822

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

CVE-2026-18982

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and...

PT-2026-69968

Name of the Vulnerable Software and Affected Versions RHOAI training-operator affected versions not specified Description A flaw allows users with standard edit or admin roles in any Kubernetes namespace to escalate privileges. By creating training jobs, an attacker can impersonate service...

SUSE CVE-2026-44210

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

AZL-93063 CVE-2026-44210 affecting package kata-containers for versions less than 3.32.0.kata0-1

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...