Rocky Linux 8 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc (crlsa-2020_1932)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20201932 advisory. buildah: Crafted input tar file may lead to local file overwrite during image build process CVE-2020-10696 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: container-selinux / crit / criu / criu-debuginfo / criu-debugsource / etc (crlsa-2020_1926)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20201926 advisory. buildah: Crafted input tar file may lead to local file overwrite during image build process CVE-2020-10696 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: cockpit-podman / container-selinux / containernetworking-plugins / etc (crlsa-2020_1931)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20201931 advisory. buildah: Crafted input tar file may lead to local file overwrite during image build process CVE-2020-10696 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: libcmis / libcmis-debuginfo / libcmis-debugsource Multiple Vulnerabilities (crlsa-2020_4628)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20204628 advisory. libreoffice: 'stealth mode' remote resource restrictions bypass CVE-2020-12802 libreoffice: forms allowed to be submitted to any URI could result in local...

Ubuntu 16.04 LTS : Gzip vulnerabilities (USN-8733-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8733-1 advisory. Micha Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable....

CVE-2026-85092

LiME (Linux Memory Engine) through version 1.12.0 contains an arbitrary file overwrite vulnerability caused by a missing O_NOFOLLOW flag and insufficient validation of the operator-supplied disk acquisition output path. An unprivileged local attacker who controls the output directory can plant a ...

PT-2026-84906

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-56651

Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "ONOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to...

CVE-2026-76845

A flaw was found in adm-zip, a Node.js library used for handling zip archives. This vulnerability allows a local attacker to overwrite arbitrary files on the system. When extracting an archive, adm-zip follows symbolic links, which are special files that point to other files or directories. An...

PT-2026-82539

Name of the Vulnerable Software and Affected Versions Dool versions prior to 1.3.9 Description The application is susceptible to symlink following when the --devel flag is active. This occurs because the software opens a log file without the O NOFOLLOW flag, which is a system-level instruction th...

CVE-2026-72696

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictabl...

CVE-2026-72696 Grav CMS before 2.0.16 Symlink Following via createLockFile

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictabl...

CVE-2026-55086 Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random and place them in os.tmpdir. On a host with a shared world-writable temporary directory, a local unprivileged attacker...

CVE-2026-16838 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use TOCTOU race condition...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a security bypass in python-dotenv [CVE-2026-28684]

Summary IBM Watson Speech Services Cartridge is vulnerable to a security bypass in python-dotenv, due to a flaw allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. CVE-2026-28684. Python-dotenv is used in our speech...

JLSEC-2026-779

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue...

Linux Distros Unpatched Vulnerability : CVE-2026-62294

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flameshot is powerful yet simple to use screenshot software. Prior to 14.0.0, the Open With feature wrote screenshots to a predictable temporary path and follow...

Ubuntu 24.04 LTS / 26.04 LTS : socat vulnerabilities (USN-8511-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8511-1 advisory. It was discovered that socat incorrectly handled the SOCKS5 proxy server reply parser. A remote attacker could possibly use this issue to...

USN-8511-1 socat vulnerabilities

It was discovered that socat incorrectly handled the SOCKS5 proxy server reply parser. A remote attacker could possibly use this issue to execute arbitrary code. CVE-2026-56123 It was discovered that socat incorrectly handled a sample script. A local attacker could possibly use this issue to...

CVE-2026-25707 Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation...