https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T01:11:29.526892+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-02731 bdu:2026-02731 2026-10-04T01:11:30.042266+00:00 bdu:2026-02731 https://cve.radiocsirt.org/vuln/bell-cve-2024-25621 BELL-CVE-2024-25621 2026-10-04T01:11:30.042332+00:00

Affected: Alpaquita:23: containerd, Alpaquita:25: containerd, Alpaquita:stream: containerd

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1036 certfr-2025-avi-1036 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-04T01:11:30.042367+00:00 certfr-2025-avi-1036 https://cve.radiocsirt.org/vuln/cleanstart-2026-cd03295 Withdrawn: CLEANSTART-2026-CD03295 — Security fixes in rancher-agent 2.11.15-r1 2026-10-04T01:11:30.042384+00:00

Withdrawn by the publisher.

Affected: CleanStart: rancher-agent

Package rancher-agent version 2.11.15-r1 fixes 28 vulnerabilities: CVE-2026-53492, CVE-2026-50195, CVE-2026-53489, CVE-2024-40635, CVE-2024-25621...

 https://cve.radiocsirt.org/vuln/euvd-2026-260238 EUVD-2026-260238 2026-10-04T01:11:30.042408+00:00 EUVD-2026-260238 https://cve.radiocsirt.org/vuln/fkie_cve-2024-25621 fkie_cve-2024-25621 2026-10-04T01:11:30.042420+00:00

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.

 https://cve.radiocsirt.org/vuln/ghsa-pwhc-rpq9-4c8w GHSA-pwhc-rpq9-4c8w — containerd affected by a local privilege escalation via wide permissions on CRI directory 2026-10-04T01:11:30.042444+00:00

Affected: Go: github.com/containerd/containerd, Go: github.com/containerd/containerd/v2

### Impact

An overly broad default permission vulnerability was found in containerd.

- `/var/lib/containerd` was created with the permission bits 0o711, while it should be created with 0o700 - Allowed local users on the host to potentially access the metadata store and the content store - `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755, while it should be created with 0o700 - Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host. - `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created with 0o711, while it should be created with 0o700

The directory paths may differ depending on the daemon configuration. When the `temp` directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.

### Patches

This bug has been fixed in the following containerd versions:

* 2.2.0 * 2.1.5 * 2.0.7 * 1.7.29

Users should update to these versions to resolve the issue. These updates automatically change the permissions of the existing directories.

> [!NOTE] > > `/run/containerd` and `/run/containerd/io.containerd.runtime.v2.task` are still created with 0o711. > This is an expected behavior for supporting userns-remapped containers.

### Workarounds

The system administrator on the host can manually chmod th…

 https://cve.radiocsirt.org/vuln/gsd-2024-25621 gsd-2024-25621 2026-10-04T01:11:30.042499+00:00 gsd-2024-25621 https://cve.radiocsirt.org/vuln/msrc_cve-2024-25621 msrc_CVE-2024-25621 — containerd affected by a local privilege escalation via wide permissions on CRI directory 2026-10-04T01:11:30.042513+00:00 msrc_CVE-2024-25621 https://cve.radiocsirt.org/vuln/oesa-2025-2752 OESA-2025-2752 — containerd security update 2026-10-04T01:11:30.042530+00:00

Affected: openEuler:22.03-LTS-SP4: containerd

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc. Security Fix(es):

An overly broad default permission vulnerability was found in containerd.

- `/var/lib/containerd` was created with the permission bits 0o711, while it should be created with 0o700 - Allowed local users on the host to potentially access the metadata store and the content store - `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755, while it should be created with 0o700 - Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host. - `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created with 0o711, while it should be created with 0o700

The directory paths may differ depending on the daemon configuration. When the `temp` directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.(CVE-2024-25621)

A bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. Repetitive…

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15726-1 openSUSE-SU-2025:15726-1 — containerd-1.7.29-1.1 on GA media 2026-10-04T01:11:30.042563+00:00

containerd-1.7.29-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2025:22955 RHSA-2025:22955 — Red Hat Security Advisory: Red Hat OpenStack Platform 17.1.12 director Operator container images 2026-10-04T01:11:30.042580+00:00

github.com/containerd/containerd: containerd local privilege escalation golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS

 https://cve.radiocsirt.org/vuln/suse-su-2025:21042-1 SUSE-SU-2025:21042-1 — Security update for containerd 2026-10-04T01:11:30.042597+00:00

Security update for containerd

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-25621 UBUNTU-CVE-2024-25621 2026-10-04T01:11:30.042611+00:00

Affected: Ubuntu:Pro:16.04:LTS: containerd, Ubuntu:Pro:18.04:LTS: containerd, Ubuntu:Pro:20.04:LTS: containerd, Ubuntu:Pro:20.04:LTS: containerd-app, Ubuntu:22.04:LTS: containerd, Ubuntu:Pro:22.04:LTS: containerd-app, Ubuntu:24.04:LTS: containerd-app, Ubuntu:Pro:24.04:LTS: containerd, Ubuntu:25.10: containerd, Ubuntu:25.10: containerd-app

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2563 WID-SEC-W-2025-2563 — Microsoft Azure Linux: Mehrere Schwachstellen 2026-10-04T01:11:30.042646+00:00

Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure Linux und Microsoft Windows ausnutzen um erhöhte Privilegien zu erlangen, beliebigen Code auszuführen, die Authentifizierung zu umgehen, Spoofing-Angriffe durchzuführen, einen Denial-of-Service-Zustand zu verursachen oder andere, nicht näher spezifizierte Angriffe durchzuführen.