Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

Red Hat Automatic Bug Reporting Tool ABRT contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users...

CVE-2026-75038

CVE-2026-75038 is a local denial-of-service vulnerability in LACT (ilya-zlobintsev/LACT), affecting versions through 0.10.0 . The root cause is a predictable temporary file created in /tmp , which an attacker can exploit via a UNIX symbolic link (symlink) following attack. The CVSS 3.1 score is 6...

CVE-2026-75038 Predictable temporary file in /tmp allows symlink attack in LACT

UNIX symbolic link symlink following vulnerability in ilya-zlobintsev/LACT allows for local denial-of-service. This issue affects LACT: through 0.10.0...

Symlink Attack

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Symlink Attack through the extractAllTo, extractAllToAsync, and extractEntryTo code paths in util/utils.js. An attacker can write attacker-controlled contents...

Astra Linux – Vulnerability in oddjob

A race condition was identified in the mkhomedir tool included with the oddjob package in versions prior to 0.34.5 and 0.34.6. During the home creation process, mkhomedir copies the /etc/skel directory into the newly created home directory and changes its ownership to the home’s user, without...

Astra Linux – Vulnerability in sudo

The “sudoedit” personality of Sudo before version 1.9.5 might allow a local unprivileged user to perform arbitrary directory existence tests by exploiting a race condition in the “sudoedit.c” code, which allows a user-controlled directory to be replaced with a symlink pointing to an arbitrary pat...

Astra Linux – Vulnerability in open-vm-tools

A issue was discovered in open-vm-tools 2009.03.18-154848. Local users can bypass the intended access restrictions on mounting shares through a symlink attack that exploits a realpath race condition in mount.vmhgfs also known as hgfsmounter...

Astra Linux – Vulnerability in unbound

Unbound from NLnet Labs, including versions up to and including 1.12.0, and NSD from NLnet Labs, including versions up to and including 4.3.3, contain a local vulnerability that allows for a local symlink attack. When creating the PID file, Unbound and NSD either create the file if it does not...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allowed execution with unnecessary privileges. Since Exim operates as root in the log directory which is owned by a non-root user, a symlink or hard link attack could allow overwriting of critical root-owned files anywhere in the filesystem...

Astra Linux – Vulnerability in Ansible

There exists an absolute path traversal attack within the Ansible automation platform. This flaw allows an attacker to create a malicious Ansible role and have the victim execute that role. A symbolic link can be used to overwrite a file that is outside of the extraction path...

CVE-2026-62384

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

Linux Distros Unpatched Vulnerability : CVE-2026-62383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely...

Duplicate Advisory: ONNX: TOCTOU arbitrary file read/write in save_external_dat

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q56x-g2fj-4rj6. This link is maintained to preserve external references. Original Description In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externalda...

EUVD-2026-63989

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a metadata.yaml symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The...

CVE-2026-63343 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a metadata.yaml symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The...

CVE-2026-63343 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a metadata.yaml symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The...

CVE-2026-63125

Incus (a system container and virtual machine manager) prior to 7.3.0 is vulnerable to root-level arbitrary code execution on the host. An unprivileged, project-confined user holding can_create_images and can_create_instances RBAC permissions can supply a crafted image where backup.yaml is a syml...

CVE-2026-63125 Incus vulnerable to root RCE via image backup.yaml symlink

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user a non-admin TLS/RBAC identity with cancreateimages and cancreateinstances can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to...

CVE-2026-63125 Incus vulnerable to root RCE via image backup.yaml symlink

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user a non-admin TLS/RBAC identity with cancreateimages and cancreateinstances can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to...

CVE-2026-63125

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user a non-admin TLS/RBAC identity with cancreateimages and cancreateinstances can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to...