TI-2025-18645 CVE-2025-24965
.krun_config.json symlink attack creates or overwrites file on the host in crun
Priority HIGH 72
crun is an open source OCI Container Runtime fully written in C.
containers
Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9
Exploited now
containers records in CISA KEVNo containers vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
12 records
TI-2026-23721 CVE-2026-30892
Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation
Priority HIGH 67
crun is an open source OCI Container Runtime fully written in C.
TI-2026-37901 CVE-2026-52791
fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)
Priority MEDIUM 44
fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers.
Priority MEDIUM 43
bubblewrap is a low-level unprivileged sandboxing tool.
TI-2024-07805 CVE-2024-8418 · GHSA-g5jh-57wm-p79m
Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of service
Priority MEDIUM 40
A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries.
TI-2024-08665 CVE-2024-9341 · GHSA-mc76-5925-c5p6
Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library
Priority LOW 38
A flaw was found in Go.
Priority LOW 36
Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root whi…
TI-2026-27542 CVE-2026-35406 · GHSA-hfpq-x728-986j
Aardvark-dns has incorrect error handling for malformed tcp packets
Priority LOW 33
Aardvark-dns is an authoritative dns server for A/AAAA container records.
TI-2026-25811 CVE-2026-33414 · GHSA-hc8w-h2mf-hp59
PowerShell Command Injection in Podman HyperV Machine
Priority LOW 28
Podman is a tool for managing OCI containers and pods.
TI-2026-32447 CVE-2026-44517 · GHSA-49p4-px3h-rq49
Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
Priority LOW 27
Buildah is a tool that facilitates building OCI images.
TI-2026-60093 CVE-2026-88264 · GHSA-ppgw-cqj8-9qrg
Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs
Priority LOW 24
A flaw was found in crun.
Priority LOW 23
crun is an open source OCI Container Runtime fully written in C.