CVE-2026-73584: Insecure Temporary File

A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the /tmp directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. Th...

ROS-20260813-73-0031

The vulnerability in Gitea is related to the use of a name with an incorrect link. Exploiting this vulnerability can allow an attacker to cause service failures...

ROS-20260813-73-0036

The vulnerability in Gitea is related to the use of a name with an incorrect link. Exploiting this vulnerability can allow an attacker to cause service failures...

ROS-20260813-73-0008

The vulnerability in Gitea is related to the use of a name with an incorrect link. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2026-73420: Incorrect Behavior Order: Validate Before Canonicalize

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...

ROS-20260813-73-0034

The vulnerability in Gitea is related to the use of a name with an incorrect link. Exploiting this vulnerability can allow an attacker to cause service failures...

GHSA-W62W-66V9-VVGV

creationtimestamp| type| source ---|---|--- 2026-08-12 22:31:56+00:00| seen| https://gist.github.com/alon710/57586b5d8bd6ec2753b002d5acf877e5 2026-08-13 00:01:14+00:00| seen| https://gist.github.com/alon710/57586b5d8bd6ec2753b002d5acf877e5...

DRUPAL-CONTRIB-2026-095

This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...

SUSE CVE-2026-68197

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper mwifiextdlsaddhtoper gates its follow-the-AP-bandwidth path on bssdesc-bcnhtcap being present, but then dereferences a different pointer, bssdesc-bcnhtoper...

CVE-2026-70427

A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction...

Prisma Access Agent: Authenticated Limited File Deletion on Linux

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS,...

Exploit for Link Following in Microsoft

CVE-2026-50656 Donate Support the maintenance of this pro...

CVE-2026-15249

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

CVE-2026-15249

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

PT-2026-71008

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

PT-2026-71017

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...

CVE-2026-63293: Improper Link Resolution Before File Access

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...

CVE-2026-15249: Improper Neutralization of Input During Web Page Generation

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

PT-2026-75904

This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...