GO-2026-5664 netfoil's optional seccomp sandboxing was not applied in github.com/tinfoil-factory/netfoil

netfoil's optional seccomp sandboxing was not applied in github.com/tinfoil-factory/netfoil...

nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`

Summary The nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Threat scenario: Running Aider, Claude Code, OpenCode or similar tools with "allow bash" policy so that it...

PT-2026-44549

Name of the Vulnerable Software and Affected Versions nono versions prior to 0.55.0 Description Landlock and seccomp policies in the software allow access to local Unix domain sockets, including both concrete and abstract types. This flaw enables a sandbox escape by allowing a process to...

GHSA-2GV2-CFFP-J227 Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Summary In the runtime-rs standalone virtio-fs path, verified here with QEMU and verified with Cloud Hypervisor too, Kata Containers runs host virtiofsd as root with: --sandbox none --seccomp none If an attacker has root-equivalent execution inside the Kata guest VM, they can send raw FUSE reques...

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Summary In the runtime-rs standalone virtio-fs path, verified here with QEMU and verified with Cloud Hypervisor too, Kata Containers runs host virtiofsd as root with: --sandbox none --seccomp none If an attacker has root-equivalent execution inside the Kata guest VM, they can send raw FUSE reques...

Copy.Fail Linux Vulnerability

This is the worst Linux vulnerability in years. TL;DR copy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC. It abuses the kernel crypto API AFALG sockets plus splice to write four bytes at a time straigh...

RHSA-2026:15940 Red Hat Security Advisory: oci-seccomp-bpf-hook security update

Bulletin has no description...

Moderate: Red Hat Security Advisory: oci-seccomp-bpf-hook security update

An update for oci-seccomp-bpf-hook is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

RHEL 9 : oci-seccomp-bpf-hook (RHSA-2026:15940)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:15940 advisory. OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

CopyFail Guard text...

RHSA-2026:11804 Red Hat Security Advisory: oci-seccomp-bpf-hook security update

Bulletin has no description...

Exploit for CVE-2026-31431

Wazuh SCA policy: Copy Fail CVE-2026-31431 This policy file...

Exploit for CVE-2026-31431

CVE-2026-31431 Seccomp Mitigation A lightweight, reversible s...

RHEL 9 : oci-seccomp-bpf-hook (RHSA-2026:11804)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:11804 advisory. OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to...

GHSA-VJGJ-42F6-7997 netfoil's optional seccomp sandboxing was not applied

Summary The optional flag --filter-system-calls was not applied even if specified. Details This is a defense in depth feature to apply additional seccomp filters after the binary has started. The example config also sandboxes the binary with systemd. Impact Reduced sandboxing of the netfoil binar...

netfoil's optional seccomp sandboxing was not applied

Summary The optional flag --filter-system-calls was not applied even if specified. Details This is a defense in depth feature to apply additional seccomp filters after the binary has started. The example config also sandboxes the binary with systemd. Impact Reduced sandboxing of the netfoil binar...

Moderate: Red Hat Security Advisory: oci-seccomp-bpf-hook security update

An update for oci-seccomp-bpf-hook is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013710)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013710 advisory. In the Linux kernel, the following vulnerability has been resolved: seccomp: Move copyseccomp to no failure path. Our syzbot instance reported memory leaks in...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-010782)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010782 advisory. In the Linux kernel, the following vulnerability has been resolved: seccomp: Move copyseccomp to no failure path. Our syzbot instance reported memory leaks in...

CVE-2026-32128

FastGPT’s Python Sandbox (fastgpt-sandbox) in versions 4.14.7 and earlier contains guardrails intended to block file writes (static detection + seccomp). The vulnerability arises because stdout (fd 1) can be remapped to an arbitrary writable file descriptor via fcntl. After remapping, writes thro...