CVE-2026-41651

CVE-2026-41651 CVSS 3.x : 7.8 HIGH CWE : CWE-367 Time-of-Check Time-of-Use Fix : PackageKit 1.3.5+ Affects : PackageKit 1.0.2 – 1.3.4 PackageKit의 D-Bus 트랜잭션 핸들러에서 TOCTOU 레이스 컨디션을 통한 로컬 권한 상승입니다. 권한이 없는 모든 로컬 사용자는 로컬 세션 외에 추가 인증 없이 루트 권한으로 임의의 패키지를 설치할 수 있습니다. 랩 / 승인된 테스트 전용 HTB, CTF, 서면 범위가 명시된 작...

CVE-2026-41651

🔥 CVE-2026-41651 — PackageKit TOCTOU Local Privilege Escalation Pack2TheRoot Эксплойт локального повышения привилегий, нацеленный на демон PackageKit. Повышает привилегии от непривилегированного локального пользователя до root через уязвимость состояния гонки TOCTOU. 📌 Обзор CVE-2026-41651 также...

CVE-2025-6018-6019-PoC

CVE-2025-6018 & CVE-2025-6019: ローカル特権昇格PoC 脆弱なLinuxシステム上でCVE-2025-6018 PAM/Polkitアクティブセッションバイパス と CVE-2025-6019 libblockdev SUIDマウントの欠陥 を連鎖させ、rootアクセス を達成するための堅牢なProof of Concept（PoC）です。 免責事項 このツールは教育目的および許可されたセキュリティ研究専用 です。所有していない、または明示的な許可を得ていないシステムでは使用しないでください。 脆弱性チェーン...

CVE-2025-6018-6019

CVE-2025-6018 CVE-2025-6019 PoC Эксплойт Локальное повышение привилегий LPE - openSUSE / SUSE Linux Enterprise 15 Рабочий PoC/Эксплойт для CVE-2025-6018 и CVE-2025-6019 - Повышение привилегий от непривилегированного пользователя до root на openSUSE Leap 15.x и SUSE Linux Enterprise 15.x 🎯 Краткая...

UBUNTU-CVE-2026-19816

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

PT-2026-91454

Name of the Vulnerable Software and Affected Versions PackageKit affected versions not specified Description An authorization flaw exists in PackageKit when using the dnf5 backend. The system skips the polkit authorization check for transactions that include the SIMULATE dry-run flag. However, th...

CVE-2026-78422

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

CVE-2026-78422 zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

EUVD-2026-68593

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

Linux Distros Unpatched Vulnerability : CVE-2026-78422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the...

PT-2026-82587

openssl encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

Exploit for Incorrect Authorization in Suse Pam-Config

CVE-2025-6018 & CVE-2025-6019 PoC A Proof of Concept for chai...

CVE-2025-67859 Polkit Authorization Check can be Bypassed in the TLP power daemon

A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1...

CVE-2025-67859

The CVE-2025-67859 entry relates to an improper authentication vulnerability in the TLP power daemon (Polkit-related) that allows a local user to arbitrarily change the active power profile and the daemon’s log settings. Affected software is TLP (versions 1.9 before 1.9.1). The issue is categoriz...

PT-2026-1887

Name of the Vulnerable Software and Affected Versions TLP versions prior to 1.9.1 TLP version 1.9.0 Description TLP version 1.9.0 introduces a profiles daemon that provides a D-Bus interface. A flaw exists in this daemon that allows local attackers to bypass Polkit authentication. This bypass is...

[USN-1962-1] ubuntu-system-service vulnerability

========================================================================== Ubuntu Security Notice USN-1962-1 September 18, 2013 ubuntu-system-service vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its...