PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-90894] ParaShells: Parallels Desktop Turns Appliance Install Into a Root Shell

jfrog.com | vulnerability | CVE-2026-90894 | #privilege-escalation | #lpe | #macos | #vulnerability | #argument-injection | #parallels-desktop | #cve-2026-90894
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

JFrog details CVE-2026-90894 in Parallels Desktop: a world-writable prl_disp_service socket, weak peercred auth, and tar argument injection let unprivileged local users execute code as root.
CVE
CVE-2026-90894
Published
Collected

Related coverage

research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
vulnerability · blog.quarkslab.com
MyReport Updater: From gRPC to SYSTEM
MyReport is a report generation software often used as a component of web-based applications. We describe a privilege escalation and remote code execution vulnerabilities in MyReport Updater 2.1.1 through its update configuration and gRPC service.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
vulnerability · volexity.com
[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
# A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days October 13, 2026 Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team **_Volexity...
High · vulnerability · github.com
GOG Galaxy Local Privilege Escalation (LPE) PoC via DLL Search-Order Hijacking
Demonstrates persistent DLL hijacking vulnerabilities in popular gaming clients, showing how insecure service configurations and missing safe DLL search controls allow standard users to breach SYSTEM privilege boundaries.
research · mccaulay.co.uk
go2shell: Rooting Home Assistant through SSDP
# go2shell: Rooting Home Assistant through SSDP 7 October 20267 October 2026 McCaulayVulnerability Research ## Introduction Home Assistant is one of the most widely deployed open-source home...
Back