EUVD-2026-58800

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2026-19909

Technical details beyond the initial description are not publicly available in the provided connected documents. No concrete information on affected products/versions, root cause specifics, impact scope, or remediation is present. Monitor for updates.

AZL-95985 CVE-2026-47766 affecting package crun 1.24-6

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

CVE-2026-47766

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

CVE-2026-47766 crun follows rootfs /dev symlink while creating default devices

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

CVE-2026-47766

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

CVE-2026-47766

CVE-2026-47766 affects crun prior to version 1.28. When an OCI bundle uses a symlink for rootfs/dev and the bundle omits mounting /dev, crun may follow the symlink and create default device nodes and stdio symlinks at the symlink target outside the container rootfs. In a local rootful crun replay...

CVE-2026-47766 crun follows rootfs /dev symlink while creating default devices

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

Insecure Temporary File

Spring Boot is vulnerable to Insecure Temporary File. The vulnerability is due to the use of a predictable static directory for the embedded Artemis broker's data, which allows a local attacker to pre-create or replace the directory with a symlink and potentially redirect broker file operations t...

CVE-2026-63308 vulnerabilities

Vulnerabilities for packages: helm...

GO-2024-2860 vulnerabilities

Vulnerabilities for packages: goreleaser...

GO-2024-2877 vulnerabilities

Vulnerabilities for packages: argo-cd...

GO-2023-1793 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver...

GO-2024-3134 vulnerabilities

Vulnerabilities for packages: juicefs...

GO-2026-5008 vulnerabilities

Vulnerabilities for packages: goreleaser...

GO-2022-0322 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner...

golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...

CVE-2026-54399 vulnerabilities

Vulnerabilities for packages: airbyte-server, apache-hop-fips, floci, kayenta, conductor-fips, elasticsearch, apache-nifi, apicurio-registry-fips, hadoop-fips, dependency-track-apiserver, conductor, kayenta-fips, thingsboard, wavefront-proxy, druid, pinot, apache-hop, traccar-fips,...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the rrsync process. An attacker can access or modify files outside the intended directory by substituting a symlink for a path component after validation but before transfer processing. Attackers may also leverage...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in the chdir process when use chroot is disabled and the module root path or one of its components is a symlink. An attacker can gain unauthorized access to files outside the intended directory by exploiting symlink...