Important: Red Hat Security Advisory: virt:rhel security update

An update for the virt:rhel module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

Se7enSlip

🔒 Se7enSlip - 7-Zip 漏洞扫描器 一个令人惊叹的交互式 Web 应用程序，用于演示和帮助检测 7-Zip 压缩包中的关键 CVE-2023-52169 符号链接遍历漏洞。 ⚡ 功能特性 🎯 核心功能 ZIP 上传与分析 - 拖放或点击上传 ZIP 文件，进行全面的安全分析 实时扫描 - 针对路径遍历、符号链接和恶意条目的高级模式检测 详细报告 - 包含风险评估和建议的高管级报告 交互式演示 - 展示攻击流程的动画漏洞说明 🎨 高级 UI/UX 矩阵雨效果 - 带有下落数字字符的动画背景 浮动粒子 - 增强视觉吸引力的动态粒子系统 流畅动画 -...

Fortinet_FortiClient_Exploit_CVE-2026-24018

Fortinet FortiClient 漏洞利用 CVE-2026-24018 针对 CVE-2026-24018 的完整可用漏洞利用：Fortinet FortiClientLinux 7.4.0 至 7.4.4、FortiClientLinux 7.2.2 至 7.2.12 中存在 UNIX 符号链接（Symlink）跟随漏洞，可导致本地非特权用户将其权限提升至 root。 https://github.com/user-attachments/assets/ba55bae6-acea-4391-a568-f5e44089a284...

gortex-PoC

Seguimiento de enlaces simbólicos en el recorrido de archivos del indexador → Divulgación de contenido fuera del repositorio mediante searchtext Estado del CVE: solicitado, asignación pendiente. Este hallazgo se publica como GHSA-6vhf-4wcm-2r83. Tras la asignación del CVE, este repositorio se...

CVE-2026-31802

CVE-2026-31802: Desvío de ruta de enlace simbólico en tar / Sobrescritura arbitraria de archivos Investigación: Joshua van Rijswijk Descripción Este repositorio contiene mi prueba de concepto y el informe técnico de CVE-2026-31802 , una vulnerabilidad de alta gravedad en el paquete tar de npm...

RegPwnBRc4BOF

RegPwn BOF（适用于 Brute Ratel C4） 这是我对 RegPwn 漏洞利用的 Brute Ratel C4 BOF 重实现，原漏洞由 Filip Dragovic （@Wh04m1001）/ MDSec ActiveBreach 开发。 这是对 Flangvik 的 CS BOF 重实现（基于原始 C 漏洞利用）的一个较为粗糙的 BRc4 BOF 重实现。漏洞研究与利用的全部功劳仍归于 Filip Dragovic 和 MDSec。 Flangvik 的 CS BOF 重实现 ：https://github.com/Flangvik/RegPwnBOF 博客文章...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in python_dotenv

Summary IBM Watson Discovery Cartridge affected by vulnerability in pythondotenv Vulnerability Details CVEID:CVE-2026-28684 DESCRIPTION: python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv...

CVE-2026-59944

A flaw was found in Composer, a dependency manager for PHP. A malicious or compromised dependency can bypass existing security measures designed to prevent unauthorized binary path execution. This can occur when Composer processes untrusted cached data or older build artifacts, allowing it to...

CVE-2026-D0cker

CVE-2026-Pending: Container Escape via runC maskPaths Vunlerability Severity: Critical CVSS 9.8 Component: opencontainers/runc libcontainer Vulnerability Type: CWE-59: Improper Link Resolution Before File Access 'Link Following' 🚨 Executive Summary A critical vulnerability exists in runc's...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

CVE-2026-85731

A flaw was found in oras-go, a Go library for managing OCI Open Container Initiative artifacts. A remote attacker can exploit a symlink-chain bypass vulnerability during tar extraction of OCI layers. This allows a malicious archive to create or overwrite any file writable by the process outside t...

CVE-2026-54420-LiteSpeed-Symlink-Exploit

CVE-2026-54420 - LiteSpeed cPanel Plugin Symlink Privilege Escalation ⚠️ WARNING This code is ONLY for educational purposes and authorized security testing. Unauthorized use against systems without explicit permission is ILLEGAL. 📋 Description CVE-2026-54420 is a symlink privilege escalation...

CVE-2025-27591

CVE-2025-27591 - Escalada de Privilegios mediante Manejo Inseguro de Registros Resumen CVE-2025-27591 es una vulnerabilidad de escalada de privilegios local en la utilidad below versiones anteriores a la versión parcheada causada por un manejo inseguro de enlaces simbólicos dentro de su mecanismo...

NodeJS-Tar-Symlink-Exploit-CVE-2026-29786

📦 CVE-2026-29786：Node.js Tar 符号链接漏洞 -yellow 📌 执行摘要 本仓库记录了针对 CVE-2026-29786 的研究，这是流行的 Node.js tar 包中发现的一个高危漏洞。该漏洞允许攻击者创建一个恶意 tar 归档文件，在解压时利用符号链接 覆盖预期解压目录之外的文件（路径遍历）。 🔍 技术分析 该漏洞存在于 tar 解压引擎验证文件路径的方式中。通过构造一个带有 type: 'symlink' 的头部，攻击者可以将链接指向敏感位置（例如 /etc/shadow 或应用程序配置文件），并在解压过程中随后覆盖该文件。 攻击机制： 1. 归档创建...

GO-2026-6459 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

rclone: Directory metadata chmod/chown/chtimes applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone...

GO-2026-6461 rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

rclone local: crafted Range request against a translated symlink panics DoS in github.com/rclone/rclone...

CVE-2026-85731

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2 , the content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true is vulnerable to an arbitrary file-write outside the store's working directory. The root cause lies in the pushDir path: extractTarDire...

CVE-2026-85731 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets...