CVE-2025-43448

CVE-2025-43448 is an Apple OS vulnerability where an app could break out of its sandbox due to insufficient validation of symlinks. It is addressed in macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, tvOS 26.1, watchOS 26.1, and ...

JLSEC-2025-197 GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a...

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file,...

CLSA-2025-1762180294 podman: Fix of CVE-2024-9676

CVE-2024-9676: fix symlink traversal vulnerability in containers/storage library to prevent hanging and denial of service when running malicious images via automatically assigned user namespace...

PT-2025-44841

Name of the Vulnerable Software and Affected Versions macOS versions prior to Sonoma 14.8.2 macOS versions prior to Sequoia 15.7.2 Description An application may be capable of accessing user data that should be protected. The issue involves improper handling of symlinks. Recommendations Update to...

PT-2025-44880

Name of the Vulnerable Software and Affected Versions macOS versions prior to Sonoma 14.8.2 macOS versions prior to Sequoia 15.7.2 Description An application may be able to modify protected parts of the file system due to insufficient validation of symlinks. The issue was addressed with improved...

About the security content of tvOS 26.1

About the security content of tvOS 26.1 This document describes the security content of tvOS 26.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

About the security content of macOS Sequoia 15.7.2

About the security content of macOS Sequoia 15.7.2 This document describes the security content of macOS Sequoia 15.7.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

About the security content of watchOS 26.1

About the security content of watchOS 26.1 This document describes the security content of watchOS 26.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are availabl...

PT-2025-44840

Name of the Vulnerable Software and Affected Versions macOS versions prior to Sonoma 14.8.2 macOS versions prior to Sequoia 15.7.2 Description An application may be able to access protected user data due to improved handling of symlinks. Recommendations Update to macOS Sonoma version 14.8.2 or...

PT-2025-50984

Name of the Vulnerable Software and Affected Versions macOS versions prior to Tahoe 26.1 Description The software addresses an issue with improper handling of symlinks, which could allow a malicious application to delete protected user data. Recommendations Update to macOS Tahoe 26.1...

PT-2025-50993

Name of the Vulnerable Software and Affected Versions macOS versions prior to 26.1 Description An application may be able to access protected user data due to insufficient validation of symlinks. Recommendations Update to macOS version 26.1 or later...

About the security content of visionOS 26.1

About the security content of visionOS 26.1 This document describes the security content of visionOS 26.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

About the security content of macOS Sequoia 15.7.2

About the security content of macOS Sequoia 15.7.2 This document describes the security content of macOS Sequoia 15.7.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

Exploit for CVE-2024-7387

overview cve-2024-7387https://nvd.nist.gov/vuln/detail/C...

Exploit for CVE-2024-7387

overview cve-2024-7387https://nvd.nist.gov/vuln/detail/C...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ext4: Only dirty folio entries are marked when regular files are journaled. The fstest generic/388 test occasionally causes a crash that appears as follows: BUG: The kernel dereferes a NULL pointer; address: 0000000000000000… …...

CVE-2025-12060 Keras keras.utils.get_file Utility Path Traversal Vulnerability

The keras.utils.getfile API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special...

CVE-2025-9871

CVE-2025-9871 describes a local privilege escalation in Razer Synapse 3 via the Razer Chroma SDK installer. The root cause is a symbolic link abuse in the installer that can be leveraged to delete arbitrary files, enabling an attacker who already has low-privilege code execution to escalate to SY...

tar-fs: tar-fs symlink validation bypass

A symlink validation bypass flaw has been discovered in the npm tar-fs library. Affected versions are vulnerable to a symlink validation bypass if the destination directory is predictable with a specific tarball...

EUVD-2025-36479

In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix uninit-value in squashfsgetparent Syzkaller reports a "KMSAN: uninit-value in squashfsgetparent" bug. This is caused by openbyhandleat being called with a file handle containing an invalid parent inode number. In...