EUVD-2026-53766

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component applypatch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit i...

CVE-2026-19008 mf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link following

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component applypatch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit i...

CVE-2026-19008 mf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link following

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component applypatch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit i...

EulerOS 2.0 SP15 : rsync (EulerOS-SA-2026-2948)

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement wh...

EulerOS 2.0 SP15 : sed (EulerOS-SA-2026-2909)

According to the versions of the sed packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic filesystem operatio...

EulerOS 2.0 SP15 : rsync (EulerOS-SA-2026-2907)

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement wh...

TencentOS Server 3: acl (TSSA-2026:0804)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0804 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Exploit for Path Traversal in Gogs

CVE-2025-8110 – Gogs ≤ 0.13.3 RCE PoC Proof-of-Concept for...

GHSA-CF44-9PGV-M4XC rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Summary With -l/--links, rclone serializes symlinks as .rclonelink text objects whose body is the link target. When rclone writes such an object to a local destination, it recreates the symlink with os.Symlink, and performs NO validation of the target. If the source is attacker-controlled, the...

rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Summary With -l/--links, rclone serializes symlinks as .rclonelink text objects whose body is the link target. When rclone writes such an object to a local destination, it recreates the symlink with os.Symlink, and performs NO validation of the target. If the source is attacker-controlled, the...

EUVD-2026-44532

rclone: Unvalidated symlink target in local --links — arbitrary file write from an untrusted remote...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-12410

Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's dat...

CVE-2026-12410 CCleaner local privilege escalation via link following on uninstall

Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's dat...

EUVD-2026-53387

Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's dat...

CVE-2026-12410 CCleaner local privilege escalation via link following on uninstall

Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's dat...

CVE-2026-12410

CVE-2026-12410 affects CCleaner on Windows, specifically the Uninstaller component prior to version 7.10.1464. The issue is a local privilege escalation where a symlink/junction created during uninstallation can be followed by CCleaner when deleting the application data folder, allowing an attack...

SUSE-SU-2026:23121-1 Security update for php8

This update for php8 fixes the following issues - Update to version 8.4.24 - CVE-2026-7260: Stack overflow in phar with circular symlinks bsc1273077. - CVE-2026-9672: Upgrade libgd bsc1273078. - CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout bsc1273075. - CVE-2026-17544:...

CVE-2026-12410: Improper Link Resolution Before File Access

Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's dat...

PT-2026-68174

Name of the Vulnerable Software and Affected Versions CCleaner versions prior to 7.10.1464 Description A link following issue exists in the Uninstaller component on Windows. A local, low-privileged attacker can escalate privileges to SYSTEM by creating a symlink or junction during the application...