140 matches found
CVE-2026-65109
NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node...
CVE-2026-65109
NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node...
EUVD-2026-116010
NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node...
CVE-2026-65109
NVIDIA Slurm is subject to a symlink resolution issue within the container cleanup code. This flaw allows an attacker to remove files outside of their control on the compute node, specifically by manipulating how the system handles OCI container spool directories during cleanup. The vulnerability...
CVE-2026-65109: NVIDIA Slurm: NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to…
NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node...
CVE-2025-4517-Python-tarfile-filter-data-Bypass-PoC
CVE-2025-4517 — Python tarfile filter="data" Bypass PoC Path traversal vulnerability in Python's tarfile module affecting versions 3.8.0 through 3.13.1. The filter="data" sandbox — intended to prevent unsafe extractions — can be bypassed by crafting paths that exceed PATHMAX 4096 bytes, causing...
CLEANSTART-2024-MX13970 When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer
Security vulnerability affects the firefox-esr package. When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer...
Red Hat: CVE-2026-106073: nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
CVE-2026-113716
A flaw was found in virtualenv. When creating an isolated environment, directory validation resolves existing symbolic links symlinks rather than verifying the intended target destination. A local attacker could exploit this vulnerability by pre-creating a directory tree containing symlinks...
Astra Linux – Vulnerability in Firefox and Thunderbird
When resolving a symbolic link such as file:///proc/self/fd/1, an error message may be generated if the symbolic link resolves to a string containing uninitialized memory in the buffer. This bug only affects Thunderbird on Unix-based operating systems Android, Linux, MacOS. Windows is unaffected...
Amazon Linux 2 : amazon-ssm-agent (ALAS-2026-3963)
The version of amazon-ssm-agent installed on the remote host is prior to 3.3.5226.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3963 advisory. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a...
Amazon Linux 2 : amazon-ssm-agent (ALAS-2026-3933)
The version of amazon-ssm-agent installed on the remote host is prior to 3.3.5226.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3933 advisory. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a...
SUSE SLES15 Security Update : amazon-ssm-agent (SUSE-SU-2026:4082-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4082-1 advisory. - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution bsc1276981. - CVE-2026-71557:...
USN-8779-2: Bubblewrap regression
USN-8779-1 fixed vulnerabilities in Bubblewrap. Unfortunately, the fix for CVE-2026-87766 introduced a regression in symlink resolution, preventing certain Flatpak applications from launching. This update reverts that fix until a complete fix is available. We apologize for the inconvenience...
USN-8779-2 bubblewrap regression
USN-8779-1 fixed vulnerabilities in Bubblewrap. Unfortunately, the fix for CVE-2026-87766 introduced a regression in symlink resolution, preventing certain Flatpak applications from launching. This update reverts that fix until a complete fix is available. We apologize for the inconvenience...
github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution
A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...
github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution
A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...
rsync: rsync: Unauthorized File Access via Symlink Module Root
A flaw was found in rsync. This path traversal vulnerability allows remote clients to access files outside the intended module root. This occurs when the use chroot option is disabled and the module root path, or a component of it, is a symbolic link. The rsync daemon fails to resolve symlinks...
CVE-2026-87051
A flaw was found in operator-foundry. The path-containment check, designed to restrict file access within a build context, only performs string-based validation. It fails to resolve symbolic links symlinks, allowing an attacker to create a symlink within the build context that points to files or...
erlang: Erlang OTP ssh: Information disclosure via symlink resolution in SFTP
A flaw was found in Erlang OTP ssh, specifically within the sshsftpd module. An authenticated SFTP client can exploit this vulnerability by creating a symbolic link symlink inside a restricted directory chroot that points to the root directory. When the client reads this symlink, the sshsftpd...