CVE-2026-14361

CVE-2026-14361 الأداة المساعدة writeToFile في Consul Template كانت تفتح الوجهة التي يوفّرها المشغِّل مباشرةً وتتتبّع مكوّنات المسار المرتبطة روابط، مما يسمح للمخرجات المُولَّدة بالخروج من الدليل المقصود واستبدال ملف موجود مسبقًا. مقدمة اكتشفت هذه المشكلة أثناء مراجعة HashiCorp Consul Template ، م...

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: ansible.posix authorizedkey स्थानीय विशेषाधिकार वृद्धि ansible.posix.authorizedkey Ansible मॉड्यूल में उपयोगकर्ता की /.ssh निर्देशिका और authorizedkeys फ़ाइल पर सिम्लिंक-अनुसरण करने वाले chown और सिम्लिंक-अनुसरण करने वाली फ़ाइल निर्माण के माध्यम से स्थानीय विशेषाधिकार वृद्धि। यह ए...

CVE-2025-27591-Meta-below-LPE

CVE-2025-27591 — Meta below सिमलिंक स्थानीय विशेषाधिकार वृद्धि अवलोकन फ़ील्ड| विवरण ---|--- CVE| CVE-2025-27591 सॉफ्टवेयर| Meta below सिस्टम संसाधन मॉनिटर प्रभावित संस्करण| 0.9.0 भेद्यता| सिमलिंक अनुसरण → रूट के रूप में मनमानी फ़ाइल अधिलेखित प्रमाणीकरण| below तक sudo पहुंच वाला स्थानीय उपयोगकर्ता...

CVE-2026-53802

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

subpath-exploit

CVE-2017-1002101 के माध्यम से कुबरनेट्स से बचाव का नमूना विवरण इस मुद्दे के बारे में सुनने और इस गाइड का पालन करने के बाद, मैं और अधिक अन्वेषण करना चाहता था। इस रिपॉजिटरी में कुछ पॉड डिप्लॉयमेंट और हेल्पर शेल स्क्रिप्ट शामिल हैं जो हमले के तंत्र को सबसे सरल तरीके से प्रदर्शित करती हैं ताकि...

CVE-2026-85092

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

Fortinet_FortiClient_Exploit_CVE-2026-24018

استغلال ثغرة Fortinet FortiClient CVE-2026-24018 استغلال يعمل بالكامل لثغرة CVE-2026-24018: ثغرة اتباع الروابط الرمزية Symlink في نظام UNIX في Fortinet FortiClientLinux 7.4.0 حتى 7.4.4، وFortiClientLinux 7.2.2 حتى 7.2.12 تؤدي إلى تمكين مستخدم محلي غير مميز من رفع صلاحياته إلى صلاحيات الجذر root...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092

LiME (Linux Memory Engine) through version 1.12.0 contains an arbitrary file overwrite vulnerability caused by a missing O_NOFOLLOW flag and insufficient validation of the operator-supplied disk acquisition output path. An unprivileged local attacker who controls the output directory can plant a ...

Dell PowerProtect Cyber Recovery < 20.3.0.0 Multiple Vulnerabilities (DSA-2026-370)

The version of Dell PowerProtect Cyber Recovery installed on the remote host is prior to 20.3.0.0. It is, therefore, affected by multiple vulnerabilities: - Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command 'SQ...

GHSA-P498-V437-472G humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

CVE-2026-D0cker

CVE-2026-Pending: هروب الحاوية عبر ثغرة maskPaths في runC درجة الخطورة: حرجة CVSS 9.8 المكوّن: opencontainers/runc libcontainer نوع الثغرة: CWE-59: التحليل غير الصحيح للروابط قبل الوصول إلى الملف 'اتباع الروابط' 🚨 الملخص التنفيذي توجد ثغرة حرجة في دالة maskPaths الخاصة بـ runc. عند إخفاء المسارات...

MiracleLinux 8 : abrt-2.10.9-26.el8_10.ML.1 (AXSA:2026-1725:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1725:01 advisory. abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories CVE-2026-54228 abrt: ChownProblemDir succeeds...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

Linux Distros Unpatched Vulnerability : CVE-2026-82252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata...

Linux Distros Unpatched Vulnerability : CVE-2026-82248

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal...

CVE-2024-50404

CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 "एक लिंक अनुवर्तन link following भेद्यता Qsync Central को प्रभावित करने की सूचना दी गई है। यदि इसका शोषण किया जाता है,...

CVE-2026-55569

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...