foxcage

foxcage 在无根 Podman 容器中运行 Firefox 以实现安全隔离。你的浏览器在几乎没有任何 Linux 能力的情况下运行，处于自己的用户和网络命名空间中，与主机隔离——同时仍具备完整的 GPU 加速、音频和 DRM 支持。 为什么选择 foxcage？ Firefox 已经拥有一个多进程沙箱，使用 Linux 命名空间和 seccomp-bpf 来隔离网页内容渲染器。对于大多数威胁而言，这是有效的。foxcage 增加了第二道墙：如果攻击者利用漏洞逃逸出 Firefox 的沙箱（这种情况确实会发生——存在相关 CVE），他们会落入一个被锁定的容器中，而不是你的完整用户会话...

ssl-kill-switch3

SSL Kill Switch 3 下一代 iOS 插件 SSLKillSwitch https://github.com/nabla-c0d3/ssl-kill-switch2，功能更多！ 新功能？ 已修复 Fishhook 支持（iOS 15+，ARM64/ARM64e），让你可以在非越狱时代进行 hook 已修复 Rootless 支持（iOS 15+，ARM64/ARM64e），rootless 快乐 : 新增 Hook SecIsInternalRelease，以便可以设置 AppleServerAuthenticationNoPinning 参见...

kern

kern: runtime de contenedores sin root y sandbox sin daemon. Ejecuta llamadas a herramientas de agentes y código generado por LLM en contenedores aplicados por el kernel. Un contenedor real, aplicado por el kernel, en unos pocos milisegundos, desde un único binario estático y sin daemon. Soporte...

Rocky Linux 8 [CIQ] Security Update: aardvark-dns / buildah / buildah-debuginfo / buildah-debugsource / etc Multiple Vulnerabilities (crlsa-2023_6938)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20236938 advisory. go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents CVE-2022-3064 golang: html/template: improper handling...

Rocky Linux 8 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2021_1796)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20211796 advisory. golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference CVE-2020-29652 podman: Remote traffic to rootless containers is seen...

[SECURITY] Fedora 44 Update: rootlesskit-3.2.0-1.fc44

Linux-native "fake root" for implementing rootless containers...

[SECURITY] Fedora 45 Update: rootlesskit-3.2.0-1.fc45

Linux-native "fake root" for implementing rootless containers...

foxcage — Updated!

foxcage Run Firefox in a rootless Podman container for security isolation. Your browser runs with almost no Linux capabilities, in its own user and network namespace, isolated from the host — while still having full GPU acceleration, audio, and DRM support. Why foxcage? Firefox already has a...

GO-2024-3042 vulnerabilities

Vulnerabilities for packages: podman...

GO-2025-3595 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, kube-logging-operator, whereabouts, step-ca, crossplane-provider-aws-lambda, dagdotdev, kubernetes-dashboard-metrics-scraper, trivy, cloudflared, rancher-telemetry, spqr, sqlexporter, bank-vaults, argo-rollouts, fulcio, gitness, restic,...

fuse-overlayfs: fuse-overlayfs: Privilege Escalation Vulnerability via SUID/SGID Bit Preservation

A flaw was found in fuse-overlayfs, a component used for rootless containers. This vulnerability allows a low-privileged process to retain SUID Set User ID and SGID Set Group ID permissions on files after they are truncated or opened with the OTRUNC flag. This can enable a local attacker to...

foxcage — Updated!

foxcage Run Firefox in a rootless Podman container for security isolation. Your browser runs with almost no Linux capabilities, in its own user and network namespace, isolated from the host — while still having full GPU acceleration, audio, and DRM support. Why foxcage? Firefox already has a...

MiracleLinux 9 : podman-5.8.2-4.el9_8 (AXSA:2026-1491:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1491:07 advisory. golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-39835 golang.org/x/crypto/ssh:...

foxcage — Updated!

foxcage Run Firefox in a rootless Podman container for security isolation. Your browser runs with almost no Linux capabilities, in its own user and network namespace, isolated from the host — while still having full GPU acceleration, audio, and DRM support. Why foxcage? Firefox already has a...

[SECURITY] Fedora 44 Update: fuse-overlayfs-1.17-1.fc44

FUSE overlay+shiftfs implementation for rootless containers...

Fedora 44 : fuse-overlayfs (2026-4e0490640f)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4e0490640f advisory. Update to fuse-overlayfs 1.17 to fix CVE-2026-52791: privilege escalation via SUID/SGID bit preservation on file truncation. When a file with SUID/SGID bits ...

CVE-2026-52791

A flaw was found in fuse-overlayfs, a component used for rootless containers. This vulnerability allows a low-privileged process to retain SUID Set User ID and SGID Set Group ID permissions on files after they are truncated or opened with the OTRUNC flag. This can enable a local attacker to...

AZL-94145 CVE-2026-52791 affecting package fuse-overlayfs 1.14-1

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-52791

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

UBUNTU-CVE-2026-52791

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...