CVE-2026-31431-cleaned

copyFail.py — CVE Exploit Analysis Report Summary copyFail.py is a proof-of-concept PoC exploit that demonstrates a local privilege escalation vulnerability in the Linux kernel. By abusing the splice system call in combination with crafted socket options, the exploit gains the ability to corrupt...

harden-docker-seccomp

harden-docker-seccomp Idempotent script to block AFALG socket creation for all Docker containers on a host as mitigation for CVE-2026-31431 "Copy Fail". Background CVE-2026-31431 is a local privilege escalation in the Linux kernel's authencesn cryptographic template, present in kernels built...

copy-fail-blocker

copy-fail-blocker BPF-LSM mitigation for CVE-2026-31431 "Copy Fail" and the RxRPC variant of Dirty Frag, and for similar privilege-escalation vulnerabilities that depend on userspace access to a kernel-side in-place crypto path reachable via the AFALG or AFRXRPC socket families. A small DaemonSet...

modrosnlr5

🧬 modrosnlr5 – Linux Kernel LPE PoC CVE-2026-31431 Proof-of-concept tool designed to validate the exploitation of the CVE-2026-31431 vulnerability on Linux systems. The exploit leverages the kernel's AFALG socket interface to inject a payload and obtain a root shell from an unprivileged user...

MitigationToolkit-ROSN-LR5-Full

🧬 ROSN-LR5 – Kernel LPE PoC & Mitigation Toolkit CVE-2026-31431 Offensive and defensive tool for the CVE-2026-31431 vulnerability on Linux systems. It combines a local privilege escalation LPE proof of concept with utilities to review and temporarily mitigate the AFALG-based attack vector. ⚖️...

CVE-2026-21636

CVE-2026-21636 - Node.js Permission Model UDS/Network Bypass Vulnerability summary The Node.js permission model --permission is designed to sandbox a process by restricting access to the filesystem, child processes, workers, and network. CVE-2026-21636 reveals that connections made via undici/fet...

MAL-2026-17362 Malicious code in @kelvdra/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @kelvdra/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17351 Malicious code in @bottino/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

docker-socket-risk-demos

docker-socket-risk-demos Companion repo for the video: Stop Mounting docker.sock — Run Trivy Without Giving Away Root Access — inspired by CVE-2026-33634 https://www.youtube.com/watch?v=xLTYzfPY3xI This repo contains the sample web app and Claude Code prompt used in the video to demonstrate: 1. W...

tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition

A flaw was found in Apache Tomcat. A Time-of-check Time-of-use TOCTOU race condition exists when creating Unix domain sockets. This vulnerability allows an unauthorized local user to exploit the timing window to gain access to the Unix domain socket. This could lead to information disclosure or...

CVE-2025-9074-Docker-Desktop-Container-Escape

CVE-2025-9074: PoC de Escape de Contenedor de Docker Desktop Exploit de Prueba de Concepto para CVE-2025-9074 - una vulnerabilidad crítica de escape de contenedor en Docker Desktop que permite acceso no autenticado a la API del Motor Docker. Resumen de la Vulnerabilidad Propiedad| Valor ---|--- I...

CVE-2023-40296

CVE-2023-40296 async-sockets-cpp hasta la versión 0.3.1 contiene una vulnerabilidad de desbordamiento de búfer por uno off-by-one en static void ReceiveFromUDPSocket udpSocket en udpsocket.hpp, alrededor de las líneas 160-167. El desbordamiento de búfer afecta a todos los servidores UDP...

RLSA-2026:73998 Important: gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol FTP, Secure Shell File Transfer Protocol SFTP, Web Distributed Authoring and Versioning WebDAV, Common Internet File System CIFS, Server Message Block SMB, and...

gvfs security update

An update is available for gvfs. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GVFS is the GNOME Desktop Virtual File System layer that allows users to easily...

l2tp-socket-bug

CVE-2014-4943 The PPPoL2TP feature in net/l2tp/l2tpppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket. CVSS v2 Base Score: 6.9 MEDIUM...

Important: Red Hat Security Advisory: gvfs security update

An update for gvfs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

dirtycups

dirtycups.py Dirty CUPS is a free Linux/Unix CVE scanner Python3 script to validate if a target is vulnerable to CVE-2024-47176. This is a socket only CUPS scanner based off of MalwareTech's cupsscanner.py: https://github.com/MalwareTech/CVE-2024-47176-Scanner/blob/master/cupsscanner.py Original...

d8-copy-fail-mitigation

CVE-2026-31431 Mitigation for Deckhouse Kubernetes Platform Language: English | Русский About the vulnerability CVE-2026-31431 is a vulnerability in the Linux kernel's algifaead module, which exposes the kernel crypto API to userspace through the AFALG socket family. A flaw in the AEAD...

CVE-2015-1925.RCE

CVE-2015-1925 The exploit targets Tivoli Fastback Server running on Windows 10 x86, build: 16299 , affecting version 6.1.4 , where an unauthenticated attacker can perform a buffer overflow through a raw socket connection , resulting in remote code execution RCE. This exploit assumes ASLR is not...