Tag archive
CVE-2026-65162: NVIDIA AIStore's legacy ETL PodSpec API let a remote caller supply host namespace and container security settings, putting the cluster rather than the pod in scope.
CVE-2026-80521 is a use-after-free in the Linux AF_UNIX subsystem that lets an unprivileged container process reach the host, and the default seccomp profile permits the syscall it needs.
Two weaknesses combine in docker cp so that a container can influence what the CLI writes on the host. Impact differs between macOS and Linux, and the fix is a version upgrade.
Container escape techniques exploit a fundamental misconception: that containers are "isolated." This...