CVE-2026-55168: Improper Link Resolution Before File Access

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

RockyLinux 9 : mrtg (RLSA-2026:57600)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57600 advisory. mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation CVE-2026-72694 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-64846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can...

openSUSE 16: kubevirt1.8-container-disk / kubevirt1.8-libguestfs-tools / etc (openSUSE-SU-2026:21590-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21590-1 advisory. Update to version 1.8.4. Security issues fixed: - CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via...

SUSE SLES15 Security Update : podman (SUSE-SU-2026:3652-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3652-1 advisory. - CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership...

Unity Linux 20.1070a Security Update: attr (UTSA-2026-102708)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102708 advisory. attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by...

CVE-2026-17171

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links...

CVE-2026-16989

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper resolution of symbolic links...

CVE-2026-16991

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper handling of symbolic links...

CVE-2026-16980

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper validation of symbolic links...

CVE-2026-17171 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links...

CVE-2026-17171

CVE-2026-17171 affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 . The root cause is improper resolution of symbolic links , which allows a local attacker with low privileges to overwrite arbitrary files , resulting in high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIG...

CVE-2026-16991 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper handling of symbolic links...

CVE-2026-16991

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 are vulnerable to local privilege escalation caused by improper handling of symbolic links; a low-privilege local attacker can exploit this to gain full confidentiality, integrity, and availability impact (CVSS 7.8 HIGH). No exploit or patch details are provid...

CVE-2026-16989 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper resolution of symbolic links...

CVE-2026-16989

CVE-2026-16989 affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 , where improper resolution of symbolic links allows a local attacker with low privileges to gain elevated privileges (high impact on confidentiality and integrity, no availability impact). The CVSS 3.1 score is 7.1 (HIGH) with a lo...

CVE-2026-16980 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper validation of symbolic links...

CVE-2026-74350

A flaw was found in ocfs2, the Oracle Cluster File System version 2. A local attacker could create a specially crafted fast symbolic link symlink with an incorrect inode size or a missing null character terminator. When the kernel attempts to read this malformed symlink, it can read beyond the...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack

A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link symlink with one of these predictable...