Important: libvirt

Issue Overview: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection CVE-2026-61477 libvirt: Check for empty string condition and skip inclusion of the XML document context in the error message. CVE-2026-61478 A flaw was found in libvirt. A local...

Amazon Linux 2 : libvirt, --advisory ALAS2-2026-3873 (ALAS-2026-3873)

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3873 advisory. libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection CVE-2026-61477...

Important: mrtg

Issue Overview: A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link symlink following vulnerability. By influencing or pre-placing a symlink in the process ID PID file path, the...

OESA-2026-3526 docker security update

Docker is a product for you to build, ship and run any application as a lightweight container. Security Fixes: The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory...

Linux Distros Unpatched Vulnerability : CVE-2026-82455

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination...

CVE-2026-82455

Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe...

AZL-98403 CVE-2026-82455 affecting package ruby 3.3.5-9

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

UBUNTU-CVE-2026-82455

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

CVE-2026-82455

Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe...

CVE-2026-82455 RubyGems before 4.0.13 Path Traversal via Symlink Resolution

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

CVE-2026-82455

...

CVE-2026-82455

...

CVE-2026-82455

RubyGems before 4.0.13 fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files can be written outside the intended directory, breaking the extr...

EUVD-2026-68102

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

Unity Linux 20.1070e Security Update: runc (UTSA-2026-104944)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104944 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and...

PT-2026-88158

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

PT-2026-83434

Name of the Vulnerable Software and Affected Versions RubyGems versions prior to 4.0.13 Description RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. If a pre-existing symlink within the destination directory points outside the extraction...

Unity Linux 20.1070e Security Update: python-Keras (UTSA-2026-104956)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104956 advisory. A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the filtersafetarinfos validation in...

Linux Distros Unpatched Vulnerability : CVE-2026-59944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the...

CVE-2026-55569

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...