PT-2026-56969

Name of the Vulnerable Software and Affected Versions decompress versions prior to 4.2.2 Description An improper path containment check allows directory traversal and arbitrary file write. The safeMakeDir function and the extraction path validation use String.indexOf to verify if the resolved pat...

CVE-2026-39245

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function index.js line 29 and the extraction path validation index.js line 106 use String.indexOf to verify the resolved path is within the output...

CVE-2026-39245

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function index.js line 29 and the extraction path validation index.js line 106 use String.indexOf to verify the resolved path is within the output...

Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal...

CVE-2026-58198: Time-of-check Time-of-use (TOCTOU) Race Condition

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract uses a predictable home-rooted output directory /ubuntudata/ubuntudialogs with a check-then-create pattern followed by tar.extractallpath=self.datapath, allowing a...

PT-2026-56905

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract uses a predictable home-rooted output directory /ubuntu data/ubuntu dialogs with a check-then-create pattern followed by tar.extractallpath=self.data path, allowing ...

SUSE SLES15 Security Update : kubevirt (SUSE-SU-2026:2804-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2804-1 advisory. - CVE-2026-9804: Symlink escape in the VMExport dir handler let an attacker controlling an exported PVC read sensitive files TLS...

Fedora 45 : attr (2026-c7aafa6056)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c7aafa6056 advisory. Automatic update for attr-2.6.0-1.fc45. Changelog Thu Jul 9 2026 Luk Zaoral - 2.6.0-1 - rebase to the latest upstream release rhbz2494157 - CVE-2026-54371 -...

AlmaLinux 9 : postgresql:18 (ALSA-2026:26204)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:26204 advisory. postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libpq:...

SUSE SLES15 Security Update : kubevirt-1.6 (SUSE-SU-2026:2783-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2783-1 advisory. - CVE-2026-9804: Symlink escape in the VMExport dir handler let an attacker controlling an exported PVC read sensitive files TLS...

Alibaba Cloud Linux 3 : 0185: perl-Archive-Tar (ALINUX3-SA-2026:0185)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0185 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-42496: Archive::Tar versions before 3.08 f...

Symlink Attack

Overview github.com/hashicorp/nomad/helper/escapingfs is a simple and flexible workload orchestrator to deploy and manage containers docker, podman, non-containerized applications executable, Java, and virtual machines qemu across on-prem and clouds at scale. Nomad is supported on Linux, Windows,...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the Docker task driver when a job submitter is able to bind-mount a host path into a container despite volume bind mounts being disabled. An attacker can gain unauthorized access to read and write files on the host...

Symlink Attack

Overview github.com/hashicorp/consul-template/template is a template rendering, notifier, and supervisor for @hashicorp Consul and Vault data Affected versions of this package are vulnerable to Symlink Attack via the writeToFile function. An attacker can cause template output to be written outsid...

Security Bulletin: Consul-template is vulnerable to path redirection in writeToFile through symlink attack

Summary The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability CVE-2026-14361 is fixed in...

github.com/gohugoio/hugo: Hugo: Information disclosure via symlink confinement bypass in virtual filesystem

A flaw was found in Hugo, a static site generator. A regression in its virtual filesystem allowed a symlink symbolic link planted within a theme or local mount to bypass security restrictions. This could enable an attacker to read arbitrary files on the system where Hugo is running, leading to...

CVE-2026-14361 Consul-template is vulnerable to path redirection in writeToFile through symlink attack

The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability CVE-2026-14361 is fixed in consul-templat...

CVE-2026-14361 Consul-template is vulnerable to path redirection in writeToFile through symlink attack

The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability CVE-2026-14361 is fixed in consul-templat...

CVE-2026-14361 Consul-template is vulnerable to path redirection in writeToFile through symlink attack

The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper that may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability CVE-2026-14361 is fixed in consul-templat...

SUSE-SU-2026:2804-1 Security update for kubevirt

This update for kubevirt fixes the following issues: - CVE-2026-9804: Symlink escape in the VMExport dir handler let an attacker controlling an exported PVC read sensitive files TLS keys, tokens, service-account creds from the exporter pod. bsc1266733 - CVE-2025-14525: A VM reporting many...