EUVD-2026-58800

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2026-19909

Technical details beyond the initial description are not publicly available in the provided connected documents. No concrete information on affected products/versions, root cause specifics, impact scope, or remediation is present. Monitor for updates.

CVE-2026-47766

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

Insecure Temporary File

Spring Boot is vulnerable to Insecure Temporary File. The vulnerability is due to the use of a predictable static directory for the embedded Artemis broker's data, which allows a local attacker to pre-create or replace the directory with a symlink and potentially redirect broker file operations t...

GO-2023-1793 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver...

CVE-2026-54399 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, apache-nifi, logstash, elasticsearch, jbang, kayenta, wazuh-indexer, nacos-docker, airbyte-server-fips, dependency-track-apiserver, airbyte-platform, airbyte-server, opensearch-fips, pinot, apache-hop-fips, geoserver, flyway, nuxeo, traccar, floci,...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the rrsync process. An attacker can access or modify files outside the intended directory by substituting a symlink for a path component after validation but before transfer processing. Attackers may also leverage...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in the chdir process when use chroot is disabled and the module root path or one of its components is a symlink. An attacker can gain unauthorized access to files outside the intended directory by exploiting symlink...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the traversal of the sender's source tree. An attacker can access files outside the intended transfer root by atomically replacing a parent directory component with a symlink pointing outside the source root betwe...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the --temp-dir or --link-dest options. An attacker can overwrite arbitrary files on the system by specifying absolute paths that resolve outside the intended destination directory, allowing files to be written to...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the handling of the destination directory in the non-daemon receiver. An attacker can redirect file writes to unintended filesystem locations by manipulating parent components of the destination path and...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack in the handling of the /./ boundary marker in chroot mode. An attacker can gain unauthorized read or write access to files outside the intended directory by constructing specially crafted paths or forging delta-basis...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the handling of ancillary file writes such as --log-file, --write-batch, or daemon-mode log and statistics paths. An attacker can overwrite arbitrary files by placing a symlink at a predictable output path and...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the --remove-source-files process. An attacker can cause arbitrary file deletion by atomically replacing a source file with a symlink between the completion of a file transfer and the subsequent unlink operation...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via a race condition in the sender's directory scanning process. An attacker can access files outside the intended directory by manipulating symlinks between the lstat and opendir calls. Remediation A fix was pushed into...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the makepath function when handling relative paths with symlink components in --relative mode. An attacker can write files outside the intended destination directory by crafting malicious relative paths containing...

SUSE CVE-2026-13622

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

SUSE CVE-2026-63293

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...

SUSE CVE-2026-73584

A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the /tmp directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. Th...

SUSE CVE-2026-73585

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during scri...