EUVD-2026-64143

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-49114

In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a victim...

CVE-2026-49114 ONNX symlink-following and path-traversal arbitrary file write

In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a victim...

EUVD-2026-63995

In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a victim...

CVE-2026-49114 ONNX symlink-following and path-traversal arbitrary file write

In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a victim...

CVE-2026-49114

ONNX before 1.21.0 is vulnerable to a symlink-following arbitrary file write in the save_external_data function. The function constructs the output path from the model's external_data location field and opens it for writing without O_NOFOLLOW/O_EXCL, relying on a non-atomic os.path.isfile() check...

CVE-2026-49114 ONNX symlink-following and path-traversal arbitrary file write

In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a victim...

CVE-2026-63343

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a metadata.yaml symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The...

EUVD-2026-63952

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user a non-admin TLS/RBAC identity with cancreateimages and cancreateinstances can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to...

CVE-2026-48752

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue...

EUVD-2026-63977

Incus is a system container and virtual machine manager. Prior to version 7.2.0, the record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and...

mrtg security update

An update is available for mrtg. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Multi Router Traffic Grapher MRTG monitors the traffic load on network...

RLSA-2026:57600 Important: mrtg security update

The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provide a live visual representation of this traffic. Security Fixes: mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID...

PT-2026-79395

In ONNX before 1.21.0, the 'save external data' function builds the external-data file path from the model's external data location field and opens it for writing without 'O NOFOLLOW/O EXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a...

RockyLinux 9 : mrtg (RLSA-2026:57600)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57600 advisory. mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation CVE-2026-72694 Tenable has extracted the preceding...

mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link symlink following vulnerability. By influencing or pre-placing a symlink in the process ID PID file path, the attacker can trick...

CVE-2026-53803

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation. Mitigati...

SUSE SLES15 Security Update : kubevirt-1.6, virt-api-container-1.6, virt-controller-container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6, virt-handler-container-1.6, virt-launcher-container-1.6, virt-libguestfs-tools-container-1.6, virt-operator-container-1.6, virt-pr-helper-container-1.6, virt-synchronization-controller-container-1.6 (SUSE-SU-2026:3630-1)

"The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3630-1 advisory. - CVE-2025-47911: golang.org/x/net/html: algorithms that have quadratic complexity when parsing HTML documents allow for denial of...

GHSA-HFG8-HC9C-6C3H moby/go-archive: Crafted tar archive can write outside the extraction directory

Summary The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. Details The extracto...

CVE-2026-76037

Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...