CVE-2026-16980

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper validation of symbolic links...

CVE-2026-17171 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links...

CVE-2026-17171

CVE-2026-17171 affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 . The root cause is improper resolution of symbolic links , which allows a local attacker with low privileges to overwrite arbitrary files , resulting in high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIG...

CVE-2026-16991 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper handling of symbolic links...

CVE-2026-16991

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 are vulnerable to local privilege escalation caused by improper handling of symbolic links; a low-privilege local attacker can exploit this to gain full confidentiality, integrity, and availability impact (CVSS 7.8 HIGH). No exploit or patch details are provid...

CVE-2026-16989 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper resolution of symbolic links...

CVE-2026-16989

CVE-2026-16989 affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 , where improper resolution of symbolic links allows a local attacker with low privileges to gain elevated privileges (high impact on confidentiality and integrity, no availability impact). The CVSS 3.1 score is 7.1 (HIGH) with a lo...

CVE-2026-16980 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper validation of symbolic links...

CVE-2026-74350

A flaw was found in ocfs2, the Oracle Cluster File System version 2. A local attacker could create a specially crafted fast symbolic link symlink with an incorrect inode size or a missing null character terminator. When the kernel attempts to read this malformed symlink, it can read beyond the...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

cmd/go: golang: Go 'go bug' command: Arbitrary file overwrite via symlink attack

A flaw was found in the 'go bug' command within the Go programming language tools. This command writes to temporary files with predictable names. A local attacker with access to the system's temporary directory could exploit this by creating a symbolic link symlink with one of these predictable...

mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link symlink following vulnerability. By influencing or pre-placing a symlink in the process ID PID file path, the attacker can trick...

Important: Red Hat Security Advisory: mrtg security update

An update for mrtg is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

SUSE-SU-2026:3662-1 Security update for podman

This update for podman fixes the following issues: - CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership modification on the host filesystem bsc1268579. - CVE-2026-57231: specially crafted image can trick podman run into...

Security update for podman

This update for podman fixes the following issues: CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership modification on the host filesystem bsc1268579. CVE-2026-57231: specially crafted image can trick podman run into leakin...

Important: Red Hat Security Advisory: mrtg security update

An update for mrtg is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link symlink following vulnerability. By influencing or pre-placing a symlink in the process ID PID file path, the attacker can trick...

DEBIAN-CVE-2026-64846

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to...

CVE-2026-64846

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to...

CVE-2026-18267

Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw...