CVE-2026-13268 G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability

G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target...

CVE-2026-56748

Cribl Stream (before 4.18.2) is affected by an improper validation of symbolic links in the Pack Git import feature. A remote authenticated attacker with Pack import and pipeline preview permissions can trigger arbitrary code execution as the Cribl server process by delivering a crafted Git repos...

CVE-2026-64317

CVE-2026-64317 affects the Linux kernel isofs Rock Ridge SL handling. A crafted Rock Ridge SL record can declare a component length that runs past the SL record, causing an out-of-bounds read of up to 255 bytes during parsing in get_symlink_chunk() and parse_rock_ridge_inode_internal(). This can ...

The vulnerability of the Microsoft .NET software platform and the Visual Studio Code editor, related to errors in handling symbolic links, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Microsoft .NET software platform and the code editor Visual Studio Code is related to errors in handling symbolic links. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2026-58414

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, EnvironmentManager.backup recursively collects files using collectBackupFiles. collectBackupFiles uses statSyncfull, which follows symlinks. If data/ contains a symlink to a directory outside the environment roo...

CVE-2026-12080

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

CVE-2026-64057

A flaw was found in the Linux kernel's AFS Andrew File System component. This vulnerability involves incorrect locking when processing symbolic links, which can lead to race conditions and memory leaks. These issues could result in resource exhaustion and impact system stability...

PT-2026-61670

Name of the Vulnerable Software and Affected Versions ExtremeXOS EXOS affected versions not specified Description The mv, cp, and rm file utilities within the shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. This allows an...

CVE-2026-64057

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the locking used by afsgetlink The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems: 1 It doesn't do any locking around afsreadsingle to prevent races between...

CVE-2026-64057

The CVE-2026-64057 entry concerns the Linux kernel AFS (Andrew File System) subsystem and a locking flaw around symbolic links processed by afs_get_link(). The root causes described across sources are: (1) no locking around afs_read_single() to prevent races between concurrent ->get_link() cal...

PT-2026-61374

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The afs filesystem in the kernel implements incorrect locking for symbolic links. This leads to several issues, including a lack of locking around the afs read single function, which can...

PT-2026-60558

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

CVE-2026-6851

An Improper link resolution before file access 'link following' vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue...

EUVD-2026-43632

An Improper link resolution before file access 'link following' vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue...

CVE-2026-6851 Improper link resolution before file access in Bitdefender Total Security via Link Following (VA-13681)

An Improper link resolution before file access 'link following' vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue...

CVE-2026-6851

The CVE-2026-6851 entry concerns Bitdefender products on Windows: Bitdefender Total Security and Bitdefender Internet Security, specifically the File Shredder module. The vulnerability is described as an improper link resolution before file access (link following) that enables a less-privileged l...

CVE-2026-6851

An Improper link resolution before file access 'link following' vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue...

PT-2026-57980

Name of the Vulnerable Software and Affected Versions Bitdefender Total Security versions prior to 27.0.58.315 Bitdefender Internet Security versions prior to 27.0.58.315 Description An improper link resolution before file access, also known as link following, exists in the File Shredder module...

PYSEC-2026-2974 py7zr: Arbitrary File Write Vulnerability

Summary There exists an arbitrary file write vulnerability in py7zr 1.1.0, latest, which allows symbolic links to be recreated outside the destination directory via crafted malicious symbolic link chains. When using extractall to extract an archive, the library restores these symbolic links,...

PYSEC-2026-2377 Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree

Summary Two primitive integrators in apm-cli enumerate package files with bare Path.glob / Path.rglob calls and read each match with Path.readtext, transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/.prompt.md or .apm/agents/.agent.md is...