CVE-2026-35372 uutils coreutils ln Security Bypass via Improper Handling of the --no-dereference Flag

A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference or -n flag is explicitly provided. The implementation previously only honored the "no-dereference" intent if the --force overwrite mode was also enabled. Thi...

CVE-2026-35372

Affects the ln utility in uutils coreutils. A logic error causes dereferencing of the target when --no-dereference/-n is provided, previously only honoring no-dereference with --force. This can cause ln to follow a symlink pointing to a directory and create links inside that directory instead of ...

CVE-2026-35372 uutils coreutils ln Security Bypass via Improper Handling of the --no-dereference Flag

A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference or -n flag is explicitly provided. The implementation previously only honored the "no-dereference" intent if the --force overwrite mode was also enabled. Thi...

CVE-2026-35364

A Time-of-Check to Time-of-Use TOCTOU race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit thi...

CVE-2026-35364 uutils coreutils mv Arbitrary File Overwrite via Cross-Device TOCTOU Race Condition

A Time-of-Check to Time-of-Use TOCTOU race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit thi...

CVE-2026-35356

A Time-of-Check to Time-of-Use TOCTOU vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file...

CVE-2026-35356 uutils coreutils install Arbitrary File Overwrite with -D via Path Component Symlink Race

A Time-of-Check to Time-of-Use TOCTOU vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file...

CVE-2026-35349

CVE-2026-35349 affects the rm utility in uutils coreutils . The root cause is a path-string check used to identify the root directory instead of comparing device/inode numbers, allowing a symbolic link that resolves to "/" (e.g., "/tmp/rootlink -> /") to bypass --preserve-root. This can lead t...

CVE-2026-35349

A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers to identify the root directory. An attacker or accidental user can bypass this safeguard by using a...

CVE-2026-35345

A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the...

CVE-2026-31494

creationtimestamp| type| source ---|---|--- 2026-04-22 15:38:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116449102535880022 2026-05-05 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260506 2026-05-31 20:00:00+00:00|...

CVE-2026-6857

creationtimestamp| type| source ---|---|--- 2026-04-22 15:17:53+00:00| seen| Telegram/QeC7MO7ScSSiOVGXLKN0WnA843zzLxkQwsFJUKCqjpspjuY 2026-04-22 16:11:33+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mk3v6kcmme2t 2026-04-22 20:10:15+00:00| seen|...

CVE-2026-5749

creationtimestamp| type| source ---|---|--- 2026-04-22 14:24:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3p6fiyof2r 2026-04-22 15:17:58+00:00| published-proof-of-concept| Telegram/T-tSUe4gAAJ730TQ0PlGw8q14q5lnUsjAniTyA8QTkzNFGU...

CVE-2026-35328

creationtimestamp| type| source ---|---|--- 2026-04-22 14:23:06+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mk3p4izcnku2 2026-04-22 17:39:24+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mk423jwehk2e 2026-04-22 17:43:47+00:00|...

CVE-2026-6859

creationtimestamp| type| source ---|---|--- 2026-04-22 14:03:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116448728591423410 2026-04-22 14:14:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3omhcshf2e 2026-04-22 15:17:58+00:00| published-proof-of-concept|...

Mustang Panda Hits India and S. Korea with Updated LOTUSLITE Backdoor

Acronis reveals Mustang Panda is using an updated version of LOTUSLITE backdoor to target Indian banks and Korean diplomats. Learn how this DLL sideloading attack works...

CVE-2026-31530 cxl/port: Fix use after free of parent_port in cxl_detach_ep()

In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use after free of parentport in cxldetachep cxldetachep is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each port in the hierarchy it locks both the port a...

CVE-2026-31512 Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2capecreddatarcv l2capecreddatarcv reads the SDU length field from skb-data using getunalignedle16 without first verifying that skb contains at least...

CVE-2026-41651

creationtimestamp| type| source ---|---|--- 2026-04-22 13:39:50+00:00| seen| https://bsky.app/profile/intuentis0x0.bsky.social/post/3mk3mp7pv3s2c 2026-04-22 15:17:58+00:00| published-proof-of-concept| Telegram/T-tSUe4gAAJ730TQ0PlGw8q14q5lnUsjAniTyA8QTkzNFGU 2026-04-22 16:10:32+00:00| seen|...

GHSA-F55J-VVR9-69XV

creationtimestamp| type| source ---|---|--- 2026-04-22 13:28:12+00:00| seen| https://bsky.app/profile/thecascading.bsky.social/post/3mk3m2g4qor22 2026-04-22 15:17:58+00:00| published-proof-of-concept| Telegram/T-tSUe4gAAJ730TQ0PlGw8q14q5lnUsjAniTyA8QTkzNFGU 2026-04-22 16:30:57+00:00| seen|...