CVE-2026-34990

CVE-2026-34990 — CUPS 本地权限提升（cups2root，去框架化） CVSS 3.x : 8.4 HIGH （约值 — 请核实） CWE : CWE-287（认证不当）+ CWE-269（权限管理不当） 修复 : CUPS 2.4.17+ 影响 : CUPS ≤ 2.4.16，且 cupsd 以 root 运行、631 端口可在本地访问 针对以 root 运行的 cupsd 的本地权限提升。当 cupsd 被诱骗充当 IPP 客户端 、向一个恶意的本地服务器发起请求时，cupsd 会响应 401 WWW-Authenticate: Local...

CVE-2026-34990-poc

CVE-2026-34990：CUPS 2.4.16 本地权限提升 PoC 这是对原始 CUPS 漏洞披露及 PoC 的 Python3 改编版本，以普通本地用户身份针对现有 CUPS 服务运行。它演示了泄露的 Authorization: Local 令牌以及一个允许 CUPS 以 root 身份写入文件的竞态条件。 用法 python3 cve-2026-34990.py --check 测试是否存在 root 拥有的文件写入 python3 cve-2026-34990.py 打开 root shell python3 cve-2026-34990.py -c 'id' 以 roo...

CVE-2026-34990-poc

CVE-2026-34990 CUPS 2.4.16 本地权限提升，通过 CUPSCREATELOCALPRINTER 实现任意文件写入。 漏洞 CUPS 允许创建本地打印机，并将 device-uri 设置为 file:// 路径。提交打印任务时使用 document-format: application/vnd.cups-raw 和 compression: gzip，会导致 cupsd 解压任务数据并将其直接写入该路径——以 cupsd 运行的用户身份（通常是 root 或高权限服务账户）。 管理员操作所需的本地认证令牌可以通过将 ipptool 的...

CVE-2026-34990

CVE-2026-34990 - CUPS 本地提权 针对以 root 身份运行的 CUPS = 2.4.16 的本地权限提升。 泄露 cupsd 的 Local 认证令牌，然后通过 file:// 打印队列以 root 身份写入一个 NOPASSWD sudoers 片段。 用法 python3 poc.py 成功时： CVE-2026-34990 | user=ctfplayer | cupsd=127.0.0.1:631 coercing cupsd - rogue server ... + captured token: f4a8...c31b writing sudoers...

cups-2.4.16-lpe

CUPS 2.4.16 — 本地权限提升 CVE-2026-34990 📋 概述 CUPS 2.4.16 包含一个本地权限提升 漏洞 （同时被追踪为 GHSA-c54j-2vqw-wpwp ）。 漏洞详情 1. 全局可写套接字 — /run/cups/cups.sock 全局可写， 允许任何本地用户向 CUPS 守护进程（以 root 身份运行） 发送 IPP 请求。 2. 本地令牌泄露 — 通过将 device-uri 指向攻击者控制的 IPP 服务器，可以滥用 CUPS-Create-Local-Printer 来 泄露 Local 授权令牌。 3. 任意文件写入 —...

CVE-2026-43503

CVE-2026-43503 DirtyClone - PoC - SecurewithUmer DirtyCloneのPoC — Linuxカーネルのローカル特権昇格脆弱性。 このリポジトリには、クローンされたソケットバッファを介したページキャッシュの破損を悪用して、権限のないローカルユーザーがroot権限を取得できる動作する概念実証 が含まれています。 DirtyCloneについて DirtyClone CVE-2026-43503 は Dirty ファミリー DirtyPipe → DirtyFrag → DirtyClone の4番目のメンバーです。...

Important: Red Hat Security Advisory: rsync security, bug fix, and enhancement update

An update for rsync is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

CVE-2026-102146

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could ...

CVE-2026-102129

A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges...

CVE-2026-102132

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system...

CVE-2026-102122

Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding the Manager role on a folder could grant the Owner role to themselves or to other members of that folder...

CVE-2026-102126

A stored cross-site scripting XSS weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System Administrator who views the affected pag...

CVE-2026-102120

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in ...

CVE-2026-102118

A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance...

CVE-2026-102112

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest privileges. Exploitation requires existing local access to...

CVE-2026-102113

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root. A privileged routine did not safely handle a filesystem path that the lower-privileged account could...

CVE-2026-102108

An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account...

CVE-2026-102093

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full...

CVE-2026-12793

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-12793 CVE-2026-12793 JetFormBuilder — Dynamic Blocks Form Builder 3.6.2 — jetmonsters The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,...