CVE-2026-79781

A flaw was found in rclone. This path traversal vulnerability allows a remote attacker to read and overwrite sensitive files outside of their intended directory by manipulating S3 object keys with 'dot-dot' segments e.g., ../. This could lead to unauthorized access and modification of critical...

cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack

A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link symlink with one of these predictable...

Important: Red Hat Security Advisory: golang security update

An update for golang is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

PT-2026-84040

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.5 pnpm versions prior to 11.11.0 Description pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because the pickPackage.ts function rejects slash characters only for unscoped...

ALSA-2026:61623 Moderate: gzip security update

The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...

ALSA-2026:61625 Moderate: gzip security update

The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...

RHEL 9 : gzip (RHSA-2026:61623)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61623 advisory. The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files...

Linux Distros Unpatched Vulnerability : CVE-2026-59682

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3. CVE-2026-59682 Note that Nessus relies on the presence o...

Linux Distros Unpatched Vulnerability : CVE-2026-82248

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal...

RHEL 10 : gzip (RHSA-2026:61625)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61625 advisory. The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files...

ALSA-2026:61581 Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18477 tar: tar:...

Moderate: gzip security update

The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...

EUVD-2026-68199

Pake before 3.13.1 joins the JavaScript-supplied filename for the downloadfile Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences for example ../Library/LaunchAgents/com.evil.plist or an absolute path resolves outside /Downloads...

Path Traversal

Apache Camel is vulnerable to Path Traversal. The vulnerability is due to the Azure Storage Blob component constructing local file paths directly from attacker-influenced blob names without path normalization or containment checks, which allows an attacker to create or overwrite files outside the...

SUSE CVE-2026-54230

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the ONOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and...

SUSE CVE-2026-56651

Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "ONOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to...

CVE-2026-82248

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

CVE-2026-82248

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

UBUNTU-CVE-2026-82248

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

EUVD-2026-67700

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...