CVE-2025-11001

Usage: root@kitploit: python3 exploit.py -t "C:\Users\pac\Desktop" -o demo.zip --data-file calc.exe Exploiting 7-zip The vulnerability is only exploitable on windows and has one major caveat.The bug can only be exploited when 7-Zip is ran with Admin privileges for this vulnerability to be...

POC-CVE-2024-44258-Py

Conceptual PoC CVE-2024-44258: Symlink Vulnerability in iOS Requirement: Python 3.7+ • License: MIT ⚠️ Warning: This repository contains a proof-of-concept PoC developed for exclusively educational and research purposes. It is not a fully functional exploit. Its use on devices without proper...

CVE-2026-90616

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories e.g., /var/cache, /var/dat...

path-auditor

PathAuditor PathAuditor 是一个通过审计 libc 函数来发现文件访问相关漏洞的工具。 其思路大致如下： 审计二进制程序执行的每个与文件系统相关的 libc 函数调用。 检查系统调用中使用的路径是否为用户可写。如果是，非特权用户可能已用符号链接替换了目录或文件。 将所有违规记录为潜在漏洞。 我们使用 LDPRELOAD 来钩住所有与文件系统相关的库调用，并将遇到的任何违规记录到 syslog。 这不是谷歌官方支持的产品。 漏洞示例 让我们看看这个工具可以检测的一种漏洞示例。CVE-2019-3461 是 tmpreaper 中的一个 bug，tmpreaper...

CVE-2026-80663

A flaw was found in the Linux kernel's Intel Speed Select daemon. A local unprivileged user can exploit a symlink vulnerability in the daemon's pidfile handling. By pre-creating a symbolic link at the fixed pidfile path under /tmp, the attacker can cause the root-run daemon instance to write into...

Astra Linux – Vulnerability in Python 3.11

It allows the extraction filter to be ignored, enabling symlink targets to point outside the destination directory, and modifying some file metadata. This vulnerability affects users who use the TarFile module to extract untrusted tar archives using TarFile.extractall or TarFile.extract, with the...

CVE-2026-62383

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels,...

EUVD-2026-57615

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

CVE-2026-63294 Root RCE via image backup.yaml symlink

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can...

CVE-2026-70348

Improper link resolution before file access 'link following' in Windows Management Services allows an authorized attacker to deny service locally...

DEBIAN-CVE-2026-63622

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

CVE-2026-63622

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

CVE-2026-71556 go-git: Worktree operations may follow symlinks

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

CVE-2026-71556 go-git: Worktree operations may follow symlinks

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

Linux Distros Unpatched Vulnerability : CVE-2026-71556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and ad...

EUVD-2026-44532

rclone: Unvalidated symlink target in local --links — arbitrary file write from an untrusted remote...

GHSA-CF44-9PGV-M4XC rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Summary With -l/--links, rclone serializes symlinks as .rclonelink text objects whose body is the link target. When rclone writes such an object to a local destination, it recreates the symlink with os.Symlink, and performs NO validation of the target. If the source is attacker-controlled, the...

CVE-2026-16791

CVE-2026-16791 affects Lenovo XClarity Essentials OneCLI for Linux, specifically version 5.5.0 and earlier. The issue is a temporary file creation vulnerability that could allow a local, low-privileged attacker to overwrite or truncate arbitrary local files with program-generated data when OneCLI...

Important: perl-DBI

Issue Overview: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the ismatched method, = was evaluated using Perl...

Linux Distros Unpatched Vulnerability : CVE-2026-47763

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or...