SUSE CVE-2026-80663

In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...

CVE-2026-80663

CVE-2026-80663 affects the Linux kernel's tools/power/x86/intel-speed-select daemon. The vulnerability is a symlink-based pidfile clobbering flaw: the daemon uses a fixed pidfile path under /tmp and opens it without O_NOFOLLOW, allowing a local unprivileged user to pre-create a symlink at that pa...

CVE-2026-80663 tools/power/x86/intel-speed-select: Harden daemon pidfile open

In the Linux kernel, the following vulnerability has been resolved: tools/power/x86/intel-speed-select: Harden daemon pidfile open Avoid symlink-based pidfile clobbering by opening the pidfile with ONOFOLLOW and validating it with fstat before locking/writing. The daemon currently uses a fixed...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cpio (UTSA-2026-092966)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-092966 advisory. cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. Tenable has...

PT-2026-82963

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A local unprivileged user can exploit a symlink-based pidfile clobbering issue in the intel-speed-select daemon. Because the daemon uses a fixed pidfile path under /tmp, an attacker can...

CVE-2026-59311

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

EUVD-2026-67195

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

PT-2026-82716

Name of the Vulnerable Software and Affected Versions Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration version 7.1.0 Description A local unprivileged user on the same host can...

Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

Red Hat Automatic Bug Reporting Tool ABRT contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: trousers (UTSA-2026-093153)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093153 advisory. An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink...

CVE-2026-75038

CVE-2026-75038 is a local denial-of-service vulnerability in LACT (ilya-zlobintsev/LACT), affecting versions through 0.10.0 . The root cause is a predictable temporary file created in /tmp , which an attacker can exploit via a UNIX symbolic link (symlink) following attack. The CVSS 3.1 score is 6...

CVE-2026-75038 Predictable temporary file in /tmp allows symlink attack in LACT

UNIX symbolic link symlink following vulnerability in ilya-zlobintsev/LACT allows for local denial-of-service. This issue affects LACT: through 0.10.0...

Symlink Attack

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Symlink Attack via the createLockFile function. An attacker can overwrite arbitrary files by pre-creating symbolic links at predictable lock...

SUSE CVE-2026-63125

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user a non-admin TLS/RBAC identity with cancreateimages and cancreateinstances can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to...

SUSE CVE-2026-63343

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a metadata.yaml symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The...

Symlink Attack

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Symlink Attack through the extractAllTo, extractAllToAsync, and extractEntryTo code paths in util/utils.js. An attacker can write attacker-controlled contents...

Symlink Attack

Overview org.webjars.npm:adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Symlink Attack through the extractAllTo, extractAllToAsync, and extractEntryTo code paths in util/utils.js. An attacker can write...

Symlink Attack

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Symlink Attack via symlink handling in CorpusReader.open. A local attacker can read arbitrary files outside the configured corpus root by placi...

Duplicate Advisory: NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3hhw-38pf-pxj6. This link is maintained to preserve external references. Original Description nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods...

PYSEC-2026-3789

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...