flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...

flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

Important: Red Hat Security Advisory: flatpak security update

An update for flatpak is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

ROOT-APP-NPM-CVE-2026-39363 CVE-2026-39363 in vite - Patched by Root

Root has patched CVE-2026-39363 in the vite package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2024-10065 AIKIDO-2024-10065 in undici - Patched by Root

Root has patched AIKIDO-2024-10065 in the undici package for Root:npm. Multiple fixed versions available...

Exploit for Use After Free in Arm Bifrost_Gpu_Kernel_Driver

yandex-station-2-s905x2-root Root shell on Amlogic S905X2 And...

ROOT-APP-NPM-CVE-2026-2327 CVE-2026-2327 in markdown-it - Patched by Root

Root has patched CVE-2026-2327 in the markdown-it package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-48988 CVE-2026-48988 in markdown-it - Patched by Root

Root has patched CVE-2026-48988 in the markdown-it package for Root:npm. Multiple fixed versions available...

Exploit for Deserialization of Untrusted Data in Cisco Secure_Firewall_Management_Center

CVE-2026-20131 -- unauthenticated Java deserialization, root o...

Exploit for CVE-2026-98260

CVE-2026-98260 · Android 17 / pudding Local Privilege Escalati...

cowroot

cowroot Universal Android root tool based on CVE-2016-5195. Watch this space. Current Status: Only works on 32-bit devices Only able to get root on Cyanogenmod devices, when both getuid and geteuid are patched i.e. bypasses su checks. I've ported...

flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer

A flaw was found in Flatpak. A malicious local user in an active local session could exploit a symlink traversal vulnerability in the revokefs writer. This flaw allows an attacker to modify files belonging to a different revokefs session after they have been validated. Consequently, an attacker...

flatpak: flatpak: Arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

D-Link DIR820LA1_FW105B03 'ping_addr' - OS Command Injection

OS Command injection vulnerability in D-Link DIR820LA1FW105B03 allows attackers to escalate privileges to root via a crafted payload with the pingaddr parameter to ping.ccp. id: CVE-2023-25280 info: name: D-Link DIR820LA1FW105B03 'pingaddr' - OS Command Injection author: pussycat0x severity:...

PT-2026-125144

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges...

PT-2026-125187

A downgrade issue was addressed with additional version checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges...

PT-2026-125227

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges...

PT-2026-125231

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges...

PT-2026-125426

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to gain root privileges...

PT-2026-125435

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An attacker with root privileges may be able to access protected user data...