cve-2025-9074-poc

CVE-2025-9074 PoC éducatif / Preuve de concept Ce dépôt contient un PoC à des fins éducatives démontrant le risque de pouvoir créer un conteneur privilégié avec accès en lecture/écriture au système de fichiers hôte en exploitant les API distantes non authentifiées de Docker Engine. Le fichier...

CVE-2025-9074

CVE-2025-9074: Docker Engine API 未授权远程代码执行 严重性 ：严重 | CVSS评分 ：9.8（估计） | 受影响版本 ：Docker Desktop options 选项 模式：命令执行 在目标上执行单个命令： root@kitploit: 简单命令 php poc.php -u http://192.168.65.7:2375 -m cmd -c "id" 从主机读...

vulnerable-container-hub

Das OWASP Vulnerable Container Hub Projekt Hintergrund Es gibt viele Repositories, die gefährdete Umgebungen wie Webanwendungen, Container oder virtuelle Maschinen für diejenigen bereitstellen, die Sicherheit lernen möchten. Das hilft nicht nur Studierenden oder Personen, die neu im Bereich sind,...

CVE-2025-9074-docker-escape

CVE-2025-9074-Docker Escape HTB MonitorsFour Questo codice è solo a scopo educativo e per ambienti controllati come laboratori Hack The Box. Non usare su sistemi senza autorizzazione. Questo repository contiene uno script di sfruttamento per la vulnerabilità Docker Remote API esposta senza...

CVE-2026-62941 Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...

CVE-2026-73218 Cursor: Sandbox escape via launching privileged containers

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...

CVE-2026-73218 Cursor: Sandbox escape via launching privileged containers

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...

CVE-2026-73218

Cursor for macOS prior to 3.0.0 is vulnerable to a sandbox escape: an agent in Auto-Run Sandbox mode, with Docker Desktop and the Dev Containers CLI installed, can launch a privileged container and mount Docker’s virtiofs0. This grants read/write access to the user’s home directory and enables ho...

PT-2026-70833

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

Summary A follow-up bypass of the round-4 PodSpec hardening GHSA-gx55-f84r-v3r7, GHSA-wmgg-3p4h-48x7, GHSA-v455-mv2v-5g92. Those advisories validate and sanitize the PodSpec spec.runtime.podSpec / spec.builder.podSpec / function.spec.podSpec, but the Environment CRD also exposes...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Mobyproject Moby

CVE-2026-34040 Full Lab PoC Docker/Moby AuthZ Plugin Bypass...

PT-2026-39897

Name of the Vulnerable Software and Affected Versions local-path-provisioner versions prior to 0.0.36 Description A malicious user with permissions to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template. This template is used to crea...

k8s-container-escape-lkm

🛠️ Kernel Module Reverse Shell – Privileged Container Escape P...

EUVD-2018-2912

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2021-20188

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abuse...

Exploit for OS Command Injection in Docker

CDK - Zero Dependency Container Penetration Toolkit English | 简体中文 Legal Disclaimer Usage of CDK for attacking targets without prior mutual consent is illegal. CDK is for security testing purposes only. Overview CDK is an open-sourced container penetration toolkit, designed for offering stable...

Exploit for OS Command Injection in Docker

This repository is an offensive tool for container exploitation. The primary capability of this tool is to perform a container breakout via exposed Docker daemons docker.sock, CVE-2019-5736, and privileged container breakout via enabled CAPS and SYSCALLS. It also extracts data from Linux Kernel...

GHSA-QQV8-PH7F-H3F7 OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer

A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the "Docker" strategy, executable files inside the privileged build containe...

Red Hat OpenShift Container Platform 安全漏洞

Red Hat OpenShift Container Platform is a suite of application platforms from Red Hat, Inc. that help organizations develop, deploy and manage existing container-based applications across physical, virtual and public cloud infrastructures. A security vulnerability exists in Red Hat OpenShift...

CVE-2024-7387

A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build containe...