Oracle Linux 9 : ELSA-2026-60226-0: / attr (ELSA-2026-602260)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-602260 advisory. 2.6.0-1 - rebase to 2.6.0 to fix the following CVEs: - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr RHEL-186121 Tenable has extracted...

CVE-2026-81690: Improper Link Resolution Before File Access

openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...

TencentOS Server 3: php:8.2 (TSSA-2026:0930)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0930 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

PHP Composer -- Multiple vulnerabilities

Composer project reports: Validate package bin paths against path traversal using symlinks GHSA-96h3-5x6v-m776, CVE-2026-59944 Fixed command injection via malicious Perforce url GHSA-rvx4-ffvw-m9q3...

PT-2026-85191

openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while O NOFOLLOW on th...

PT-2026-82539

Name of the Vulnerable Software and Affected Versions Dool versions prior to 1.3.9 Description The application is susceptible to symlink following when the --devel flag is active. This occurs because the software opens a log file without the O NOFOLLOW flag, which is a system-level instruction th...

PT-2026-82591

Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description A symlink-following flaw exists in the verify-usb v2 added-file allowlist scan. The scan uses the rglob function, which in CPython does not descend into symlinked directories and treats the...

PT-2026-82716

Name of the Vulnerable Software and Affected Versions Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration version 7.1.0 Description A local unprivileged user on the same host can...

...[ More ]

Chronicle Wire's FileMarshallableOut follows symbolic links when writing files in append mode. When ?append=true is enabled, the implementation opens the supplied output path directly using FileOutputStreampath, true without preventing symbolic-link resolution. If an attacker can create or replac...

AlmaLinux 9 : attr (ALSA-2026:60226)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:60226 advisory. attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-54371 Tenable has extracted the preceding description block directly from the...

RockyLinux 9 : attr (RLSA-2026:60226)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:60226 advisory. attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-54371 Tenable has extracted the preceding description block directly from the...

MiracleLinux 9 : mrtg-2.17.7-12.el9_8.1 (AXSA:2026-1680:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1680:02 advisory. mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation CVE-2026-72694 Tenable has extracted the preceding...

TencentOS Server 3: osbuild-composer (TSSA-2026:0911)

"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0911 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilitie...

TencentOS Server 3: attr (TSSA-2026:0908)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0908 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 3: python3 (TSSA-2026:0914)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0914 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2026-65647

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...

CVE-2026-65647

CVE-2026-65647 is an improper symlink resolution vulnerability in the Plesk Site Import and Migrator extensions. A remote authenticated (low-privilege) user can leverage this flaw to execute arbitrary code as root , resulting in full compromise of the vulnerable system. The CVSS 4.0 score is 8.7 ...

CVE-2026-65647

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...

CVE-2026-65647

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...

CVE-2026-79939

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link Symlink Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection...