FreeBSD -- Jail escape by a privileged user via nullfs

Problem Description: By default, jailed processes cannot mount filesystems, including nullfs4. However, the allow.mount.nullfs option enables mounting nullfs filesystems, subject to privilege checks. If a privileged user within a jail is able to nullfs-mount directories, a limitation of the...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003827)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003827 advisory. An issue was discovered in fs/iouring.c in the Linux kernel before 5.6. It unsafely handles the root directory during path lookups, and thus a process inside a mount...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004447)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004447 advisory. An issue was discovered in fs/iouring.c in the Linux kernel before 5.6. It unsafely handles the root directory during path lookups, and thus a process inside a mount...

Windows Exploitation Techniques: Winning Race Conditions with Path Lookups

Posted by James Forshaw This post was originally written in 2016 for the Project Zero blog. However, in the end it was published separately in the journal PoC||GTFOissue 13 as well as in the second volume of the printed version. In honor of our new blog we’re republishing it on this blog and...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2025-2481)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.CVE-2025-4673 If...

RLSA-2025:22668 Moderate: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: os/exec: Unexpected paths returned from LookPath in os/exec CVE-2025-47906 golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 For more detail...

TencentOS Server 4: runc (TSSA-2025:0766)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0766 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

EUVD-2020-21746

Malware in sbrugna...

EUVD-2023-59824

Malicious code in bioql PyPI...

EUVD-2024-2199

Malicious code in bioql PyPI...

AZL-66131 CVE-2025-47906 affecting package golang for versions less than 1.24.6-1

If the PATH environment variable contains paths which are executables rather than just directories, passing certain strings to LookPath "", ".", and "..", can result in the binaries listed in the PATH being unexpectedly returned...

Use of Incorrectly-Resolved Name or Reference

Overview std/os/exec is a Go standard library package std/os/exec Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference. Go Vulnerability Report: If the PATH environment variable contains paths which are executables rather than just directories, passing...

SUSE CVE-2023-53260

In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovlpermission Following process: P1 P2 pathlookupat linkpathwalk inodepermission ovlpermission ovlipathrealinode, &realpath path-dentry = ovlidentryupperinode dropcache dentrykillovldentry...

CVE-2023-53246 cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL

In the Linux kernel, the following vulnerability has been resolved: cifs: fix DFS traversal oops without CONFIGCIFSDFSUPCALL When compiled with CONFIGCIFSDFSUPCALL disabled, cifsdfsdautomount is NULL. cifs.ko logic for mapping CIFSFATTRDFSREFERRAL attributes to SAUTOMOUNT and corresponding dentry...

MGASA-2025-0221 Updated golang packages fix vulnerabilities

LookPath may return unexpected paths, CVE-2025-47906. incorrect results returned from Rows.Scan, CVE-2025-47907. These packages fix the issues for the compiler only; applications using the functions still need to be rebuilt...

Linux Distros Unpatched Vulnerability : CVE-2020-29373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in fs/iouring.c in the Linux kernel before 5.6. It unsafely handles the root directory during path lookups, and thus a process inside a...

SUSE CVE-2022-49438

In the Linux kernel, the following vulnerability has been resolved: Input: sparcspkr - fix refcount leak in bbcbeepprobe offindnodebypath calls offindnodeoptsbypath, which returns a node pointer with refcount incremented, we should use ofnodeput on it when done. Add missing ofnodeput to avoid...

In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX QProcess could execute a binary from the current working directory when not found in the PATH.

...

GHSA-X234-R5FG-X52M Arbitrary system path lookup in h20

In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead...

CVE-2024-5550 Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3

In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead...