CVE-2021-21300

CVE-2021-21300: Arbitrary Code Execution via Malicious Git Hooks 📌 Summary CVE-2021-21300 is a critical vulnerability in Git versions 2.14.2 to 2.30.1 that allows attackers to execute arbitrary code on victim machines by exploiting symbolic links and case-insensitive file systems. 🧠 Problem...

CVE-2026-124495

The Apache Storm Logviewer is vulnerable to Improper Link Resolution Before File Access (CWE-59) when workers run as the topology owner. The Logviewer improperly follows links to files placed in a worker's log directory. This allows a user authorized to submit topologies to read the worker logs o...

CVE-2026-124495 Apache Storm: Logviewer follows worker symlinks across topology ACLs

When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are...

OESA-2026-4772 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

python: python: Arbitrary file write via tarfile extraction filter bypass

A flaw was found in Python's tarfile.tarfilter. Crafted link entries in a tar archive, including symlinks with empty or directory-like names, can redirect later archive members outside the intended extraction directory. An application that extracts an untrusted archive with the tar filter could...

CVE-2026-23745

CVE-2026-23745: node-tar Arbitrary File Overwrite Research: Joshua van Rijswijk Description PoC for CVE-2026-23745 , a high-severity path traversal vulnerability in node-tar 7.5.2. The library fails to sanitize absolute paths in the linkpath field for Hardlinks and Symlinks. This allows malicious...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2026:1794423871)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1794423871 advisory. - tarfile.datafilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later...

CVE-2024-32002

CVE-2024-32002 Versions 1.0.0 This version work only on remote target with authenticated user and git version 2.45.0 affected. This vulnerability affect Git with version: 2.45.0 Proof Of Concept The POC can trigger an RCE Remote Command Execution using the git clone command via specific vulnerabl...

CVE-2026-123841

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive...

CVE-2026-123842

In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives...

CVE-2026-123842

JetBrains IntelliJ IDEA versions prior to 2026.3 are vulnerable to an arbitrary file write vulnerability. The root cause is improper link resolution during the extraction of plugin archives , where symlinks can be leveraged to overwrite files. The security impact is categorized as HIGH for integr...

CVE-2026-123841

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive...

CVE-2026-123842

In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives...

EUVD-2026-118345

In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives...

EUVD-2026-118344

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive...

CVE-2026-123841

In JetBrains IntelliJ IDEA versions prior to 2026.3 , a vulnerability exists where code execution is possible via symlinks located within an imported settings archive. The root cause is identified as Improper Link Resolution Before File Access (CWE-59). The vulnerability is rated as HIGH severity...

CVE-2026-123841: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive...

CVE-2026-123842: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives

In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives...

CVE-2026-87008 Code Graph RAG structural tools follow out-of-root symlinks

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebaserag/tools/astgrepservice.py enumerates files beneath projectroot and relies on shouldskippath in...

CVE-2026-87008 Code Graph RAG structural tools follow out-of-root symlinks

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebaserag/tools/astgrepservice.py enumerates files beneath projectroot and relies on shouldskippath in...