EUVD-2026-65210

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictabl...

CVE-2026-72696 Grav CMS before 2.0.16 Symlink Following via createLockFile

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictabl...

CVE-2026-72696

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictabl...

CVE-2026-72696 Grav CMS before 2.0.16 Symlink Following via createLockFile

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictabl...

CVE-2026-72696 Grav CMS before 2.0.16 Symlink Following via createLockFile

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictabl...

SUSE CVE-2026-63125

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user a non-admin TLS/RBAC identity with cancreateimages and cancreateinstances can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to...

SUSE CVE-2026-63343

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a metadata.yaml symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The...

SUSE CVE-2026-75038

UNIX symbolic link symlink following vulnerability in ilya-zlobintsev/LACT allows for local denial-of-service. This issue affects LACT: through 0.10.0...

attr security update

2.6.0-1 - rebase to 2.6.0 to fix the following CVEs: - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr RHEL-186128...

RHEL 10 : attr (RHSA-2026:59380)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59380 advisory. The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists,...

abrt security update

2.10.9-26.0.2 - Remove RHT patches - Drop libreport-rhel and libreport-plugin-rhtsupport requires 2.10.9-26.0.1 - Replaces sosreport to sos report in sosreport-event.conf Orabug: 38590929 - abrt-dump-oops-Fix-vmcore-call-trace-parsing-arm Orabug: 34184473 - Disable autoreporting on Oracle Linux...

CVE-2026-79676: Improper Limitation of a Pathname to a Restricted Directory

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open instead of nltk.pathsec.open, allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose...

PT-2026-81329

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description PraisonAI contains path traversal flaws in its praisonai.code tool wrappers, which are intended to treat the workspace setting as a security boundary. The boundary is enforced inconsistently and...

PT-2026-81357

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description Corpus readers reopen root-derived paths using the built-in open function instead of nltk.pathsec.open, which allows symbolic links to escape trusted roots. This path traversal issue enables attackers...

PT-2026-81315

Name of the Vulnerable Software and Affected Versions sos affected versions not specified Description A flaw in the sos clean utility within the sos package allows a local attacker to create or overwrite arbitrary files. The issue stems from a path traversal flaw during the extraction of tar...

PT-2026-81258

Name of the Vulnerable Software and Affected Versions LACT versions prior to 0.10.1 Description A UNIX symbolic link symlink following issue allows for a local denial-of-service. A symbolic link is a file that points to another file or directory on the system. Recommendations Update to a version...

ALSA-2026:59380 Moderate: attr security update

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fixes: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-54371 For more details about...

RHCOS 4 : OpenShift Container Platform 4.22.11 (RHSA-2026:57361)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57361 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 - golang: Go os.Root:...

The vulnerabilities of the functions symlink_data() and smb2ParseSymlinkResponse() in the fs/smb/client/smb2file.c file from the Smb file system of the Linux operating system allow a attacker to gain access to protected information or cause service failures.

The vulnerability of the functions symlinkdata and smb2ParseSymlinkResponse in the fs/smb/client/smb2file.c module of the Smb file system in the Linux operating system is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a...

Linux Distros Unpatched Vulnerability : CVE-2026-79655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By...