SUSE CVE-2026-17106

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

SUSE CVE-2026-53783

rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer...

SUSE CVE-2026-53784

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...

SUSE CVE-2026-53785

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The makepath function follows symlinks pointing outside the destination...

SUSE CVE-2026-53796

rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can...

SUSE CVE-2026-53797

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with ...

SUSE CVE-2026-53799

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent aclsetfile or...

SUSE CVE-2026-53800

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink...

SUSE CVE-2026-53801

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...

SUSE CVE-2026-53802

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

SUSE CVE-2026-53803

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject...

SUSE CVE-2026-70460

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or w...

PT-2026-77137

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 Description The Git node clone operation allows an authenticated workflow user to replace a validated directory with a symlink before the cloning process...

Linux Distros Unpatched Vulnerability : CVE-2026-19693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive...

Linux Distros Unpatched Vulnerability : CVE-2026-72377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - afs: Remove setting of ASRELEASEALWAYS for symlinks and mountpoints Regular AFS files correctly use afsfileaops which have releasefolio set as netfsreleasefolio...

MiracleLinux 8 : osbuild-composer-101.5-1.el8_10.ML.1 (AXSA:2026-1558:08)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1558:08 advisory. google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33186...

Moderate: attr security update

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fixes: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-54371 For more details about...

PT-2026-77259

Name of the Vulnerable Software and Affected Versions Dell AppSync version 4.6.0.0 Dell Metro Node version 8.0.0 Dell UCC Edge version 3.0.1 Dell VxRail version 8.0.322 Dell PowerMax version 10.3.0 Dell Unity version 5.4 Dell PowerFlex Manager versions prior to 4.5.4 Dell PowerFlex Intelligent...

TencentOS Server 4: mrtg (TSSA-2026:0844)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0844 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

RHEL 8 : attr (RHSA-2026:56133)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:56133 advisory. The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, ...