...[ More ]

A proof of concept exploit for a local privilege escalation vulnerability in QEMU Guest Agent version 11.0.3. The vulnerability exists in the guest-ssh-add-authorized-keys handler, where improper handling of symbolic links allows an unprivileged guest user to redirect root-privileged file...

CVE-2026-12080

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

AZL-93006 CVE-2026-12080 affecting package qemu 10.1.0-1

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

DEBIAN-CVE-2026-12080

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

CVE-2026-12080

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

CVE-2026-12080 Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

Linux Distros Unpatched Vulnerability : CVE-2026-12080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by...

PT-2026-61584

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

CVE-2026-12080: UNIX Symbolic Link (Symlink) Following

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

SUSE CVE-2026-13318

A server-side request forgery SSRF flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance VMI, virt-api reads the target IP from vmi.Status.Interfaces0.IP and passes it directly to net.Dial without validation. For VMIs using...

PT-2026-52632

A server-side request forgery SSRF flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance VMI, virt-api reads the target IP from vmi.Status.Interfaces0.IP and passes it directly to net.Dial without validation. For VMIs using...

MiracleLinux 4 : libvirt-0.10.2-64.0.1.AXS4 (AXSA:2018-3226:03)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3226:03 advisory. libvirt: Resource exhaustion via qemuMonitorIORead method CVE-2018-5748 libvirt: Incomplete fix for CVE-2018-5748 triggered by QEMU guest agent...

EUVD-2020-3132

Malware in sbrugna...

EUVD-2018-11717

Malware in sbrugna...

EUVD-2013-1998

Malware in sbrugna...

EUVD-2013-2183

Malware in sbrugna...

EUVD-2023-12697

Malicious code in bioql PyPI...

A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.

...

Linux Distros Unpatched Vulnerability : CVE-2023-0664

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via...

Linux Distros Unpatched Vulnerability : CVE-2013-2007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which allows local users t...