abrt security update

An update is available for abrt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Automatic Bug Reporting Tool ABRT recognizes defects in applications and...

K000162902: Node.js vulnerability CVE-2026-21715

Security Advisory Description A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under --permission with restricted...

CVE-2026-0291

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS,...

CVE-2026-0291

CVE-2026-0291 affects Palo Alto Networks Prisma Access Agent on Linux. It is an improper link resolution before file access vulnerability that enables a local, low-privilege user to delete system files in a limited scope and disable the Prisma Access Agent. Affected: Linux; not affected on macOS,...

CVE-2026-0291

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS,...

CVE-2026-0291 Prisma Access Agent: Authenticated Limited File Deletion on Linux

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS,...

CVE-2026-0291 Prisma Access Agent: Authenticated Limited File Deletion on Linux

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS,...

CVE-2026-73585: Insecure Temporary File

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during scri...

CVE-2026-53802

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

CVE-2026-53784: Improper Link Resolution Before File Access

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...

CVE-2026-53797: Improper Link Resolution Before File Access

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with ...

CVE-2026-53799: Improper Link Resolution Before File Access

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent aclsetfile or...

CVE-2026-53800: Improper Link Resolution Before File Access

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink...

CVE-2026-53802: UNIX Symbolic Link (Symlink) Following

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

CVE-2026-53803: Improper Link Resolution Before File Access

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject...

CVE-2026-70460: Improper Limitation of a Pathname to a Restricted Directory

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or w...

PT-2026-71639

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A symlink race condition exists in the sender's directory scanning logic. This occurs when an attacker manipulates symlinks in a path component of the scanned tree, replacing a symlink with a directory...

PT-2026-71641

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A symlink following issue exists where local attackers can overwrite arbitrary files by placing a symbolic link at a predictable output path. This occurs because the software fails to reject symlinks...

CVE-2026-53801: Improper Link Resolution Before File Access

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...

PT-2026-71635

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A symlink race condition exists in the sender's source tree traversal. An attacker capable of manipulating a parent directory of the source tree can redirect file reads to unintended paths. This is...