CVE-2026-123876Medium· 4.4▾ SunlitA flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 24.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.
containers-common (all versions)container-tools:rhel8/containers-common (all versions)containers-common (all versions)containers-commonpodman (all versions)skopeocontainers-common (all versions)openshift/ose-rhel-coreos-8 (all versions)openshift/ose-rhel-coreos-9 (all versions)openshift/ose-rhel-coreos-9 (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Enforcing SELinux may still deny vsock; do not rely on the unfixed seccomp denies; ship SCMP_CMP_MASKED_EQ profile updates.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-66010Medium· 6.1dompurify: DOMPurify: Cross-Site Scripting (XSS) via custom element attribute bypass (CVE-2026-66010)
CVE-2026-67325High· 8.8GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature
CVE-2026-54513High· 8.1jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)
CVE-2026-49825High· 8.2lxml is a library for processing XML and HTML in the Python language
CVE-2026-54512High· 8.1jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
CVE-2026-120749Medium· 6.2Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus