CVE-2024-21626

CVE-2024-21626 Para una explicación detallada de esta vulnerabilidad, consulte mi artículo. Explotación Explotación mediante la ejecución de un contenedor No es necesario construir una imagen personalizada, solo ejecute un contenedor con el parámetro -w: docker run -w /proc/self/fd/8 --name...

AlmaLinux 9.2 [TuxCare] Security Update: gtk-update-icon-cache / gtk3 / gtk3-devel / gtk3-devel-docs / etc (ALMALINUX9.2:CLSA-2025:1745946091)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745946091 advisory. - A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the...

CVE-2024-21626

CVE-2024-21626 Exploit Directorio de trabajo docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm Es importante poner -w /proc/self/fd/8\ Accede al sistema de archivos del host usando cat ../../../../../../../../../etc/passwd dentro del contenedor Exploit Enlace simbólico ...

CVE-2025-56383

Vulnerabilidad Tipo de ataque: DLL Hijacking secuestro de DLL Aplicación objetivo: Notepad++ Método: El archivo NppExport.dll es cargado por Notepad++ desde el directorio de trabajo Implementación La DLL maliciosa contiene: Funciones exportadas de la biblioteca original para garantizar la...

CVE-2024-21262

REGISTROS Solo para reproducción de CVEs. Recursos relacionados: LINK GITHUB1 GITHUB2 ISSUE Verificar Entornos Descargar docker-24.0.6.tgz desde https://download.docker.com/linux/static/stable/x8664/. sudo mkdir -p /usr/local/docker-24.0.6 sudo tar -xzf docker-24.0.6.tgz -C /usr/local/docker-24.0...

CVE-2026-100530

OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materiall...

PT-2026-99167

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description Reusable execution approvals fail to bind the working directory context, which allows approved commands to be executed in directories other than the one originally intended. An attacker possessin...

CVE-2024-21626

about Steps to reproduce ensure kernal = 5.4,4.19,.. and there is openat2 in /proc/kallsyms. v1.0.0-rc93= runc =1.1.11 $ grep openat2 /proc/kallsyms ffffffffa64290d0 T pfxauditopenat2how ffffffffa64290e0 T auditopenat2how ffffffffa666de90 t pfxdosysopenat2 ffffffffa666dea0 t dosysopenat2...

EulerOS Virtualization 2.11.0 : perl (EulerOS-SA-2026-3537)

According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including...

Astra Linux – Vulnerability in jupyter-core

Jupyter Core is a package for the core common functionalities of Jupyter projects. Prior to version 4.11.2, Jupyter Core contained an arbitrary code execution vulnerability in “jupytercore,” which stemmed from “jupytercore” executing untrusted files in the CWD environment. This vulnerability...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allows out-of-bounds write-ups, because the main function, while having setuid root, copies the current working directory pathname into a buffer that is too small on some common platforms...

EUVD-2026-74295

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

GHSA-C7R6-VX3H-W5G2 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Summary Excel::store resolved the destination path against the process working directory rather than the configured filesystem disk. When that path resolved to an existing file, the export was written straight to it with fopen, bypassing the disk entirely. An application that passes a...

NewStart CGSL MAIN 7.02 : perl Vulnerability (NS-SA-2026-0098)

The remote NewStart CGSL host, running version MAIN 7.02, has perl packages installed that are affected by a vulnerability: - Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide...

CVE-2026-53457 Blueprint Studio terminal command working directory not bounded to config directory

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...

CVE-2026-53457

In Blueprint Studio before 2.5.2, the legacy terminal path in terminal_manager.py accepted a cwd parameter and only checked directory existence, allowing an admin to run commands in directories outside the Home Assistant config boundary, weakening filesystem restrictions. Fixed in version 2.5.2. ...

CVE-2026-72814 actix-web before 0.6.10 Information Disclosure via Files

The actix-files crate actixfiles before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the servefrom argument to Files::new, the mount path defaults to an empty path; the service then joins the request path with this empty path and...

Malicious code in wos-library-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3124274f6fcb74cf0805b5545f6952214b90329427f55c616c868f760d592e63 [email protected] declares scripts.preinstall = 'node poc.js', which auto-runs on npm install. poc.js reads os.hostname, os.userInfo.username, an...

CVE-2026-18953

Improper limitation of a pathname to a restricted directory in the getresource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this...

CVE-2026-18953

CVE-2026-18953 affects the Amazon awslabs.aws-transform-mcp-server package (versions 0.1.0–0.1.4). The issue is an improper limitation of a pathname to a restricted directory in the get_resource tool, which could allow a context-dependent actor to write arbitrary files outside the intended workin...