opencontainers runc

• CVE-2026-41579 Low 3.3 runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations 0.2%
• CVE-2025-52881 High 7.3 runc: LSM labels can be bypassed with malicious config using dummy procfs files 0.8%
• CVE-2025-52565 High 8.4 container escape due to /dev/console mount and related races 0.8%
• CVE-2025-31133 High 7.3 runc container escape via "masked path" abuse due to mount race conditions 1.2%
• CVE-2024-45310 Low 3.6 runc can be confused to create empty files/directories on the host 0.3%
• CVE-2024-21626 High 8.6 runc container breakout through process.cwd trickery and leaked fds 18.9%
• CVE-2023-25809 Medium 5.0 rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc 0.3%
• CVE-2023-28642 Medium 6.1 AppArmor bypass with symlinked /proc in runc 0.3%
• CVE-2022-29162 Medium 5.9 Incorrect Default Permissions in runc 0.4%
• CVE-2021-43784 Medium 6.0 Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration 1.8%