CVE-2024-1086

CVE-2024-1086 Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tools or runtimes. Moby’s networking implementation allows for multiple networks to be defined, each with its own IP address range and gateway. This feature is...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: fixed information leakage in /proc/net/ptype In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the newly added packettype by reading the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: skip expectations in other netns via proc This resolves the issue where expectations related to other netnames are skipped when processing network traffic. Similar to the issue addressed in...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: iptables: Fixed null-ptr-deref in iptablenattableinit. We received a report that iptables-restore sometimes triggered null-ptr-deref at boot time. 0 The problem is that iptablenattableinit is exposed to user space befo...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

Linux Kernel nftables: Vulnerability involving local privilege escalation after free operations; nftchainlookupbyid fails to check whether a chain is active, and CAPNETADMIN is present in any user or network namespace...

Astra Linux – Vulnerability in Linux, Linux 5.10

A non-privileged write-to-file handler flaw exists in the Linux kernel’s control groups and namespaces subsystem. This flaw allows users to gain access to certain less-privileged processes that are controlled by cgroups, even when those processes have higher-privileged parent processes. This issu...

Astra Linux – Vulnerability in Linux, Linux 5.10

A heap-based buffer overflow flaw was discovered in the way the legacyparseparam function in the Linux kernel’s Filesystem Context functionality verifies the length of the supplied parameters. A non-privileged user if non-privileged user namespaces are enabled, otherwise requiring CAPSYSADMIN...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: Radiotap: Reject Radiotap with unknown bits The Radiotap parser is currently only used with the radiotap namespace not with vendor namespaces. However, if the undefined field 18 is used, the alignment/size of the data is al...

Astra Linux – Vulnerability in runc-app

Runc is a CLI tool for spawning and running containers according to the OCI specification. Runc versions 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be exploited by creating empty files or directories in arbitrary locations within the host filesystem. This is achieved by sharing a...

Astra Linux – Vulnerability in Linux

The overlayfs implementation in the Linux kernel failed to properly validate, regarding user namespaces, the setting of file capabilities on files in the underlying file system. Due to the combination of unprivileged user namespaces and a patch carried in the Ubuntu kernel that allows unprivilege...

Astra Linux – Vulnerability in Linux, Linux 5.10

There is a use-after-free in the Linux kernel’s tcnewtfilter module, which could allow a local attacker to gain privilege escalation. This vulnerability requires unprivileged user namespaces for exploitation. We recommend upgrading to a version after commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftables – Fixed an inverted genmask check in nftmapcatchallactivate. nftmapcatchallactivate includes an inverted element activity check compared to its non-catchall counterpart, nftmapelemactivate, and compared to...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Scrubbing packets on bpfredirectpeer When bpfredirectpeer is used to redirect packets to a device in another network namespace, the packets are not scrubbed. This can lead to information about the packets being “misused” in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: AppArmor: Fixed the issue by limiting the number of levels of policy namespaces. Currently, the number of policy namespaces is not bounded, relying on the user namespace limits. However, policy namespaces are not strictly tied to...

lure

lure Análisis local de binarios Linux. Cero nube. Cero root. Cero coste. lure es una herramienta local de análisis y sandboxing de ELF Linux para investigadores de seguridad, ingenieros inversos y jugadores de CTF. La versión 0.7.1 añade soporte para binarios ARM64 mediante emulación en modo...

CVE-2026-77968

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

PT-2026-87034

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

CVE-2026-82277 Argo Rollouts Dashboard Unauthenticated Mutating Operations

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-55585 QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parseexpr without restricted...