EUVD-2026-87975

pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...

CVE-2026-101044 pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias

pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...

CVE-2026-101044

The pacquet Rust package-manager component, included in pnpm versions >=12.0.0-alpha.0 and

PT-2026-99562

Name of the Vulnerable Software and Affected Versions pnpm versions 12.0.0-alpha.0 through 12.0.0-alpha.4 Description The pacquet Rust package-manager component fails to validate dependency alias or name paths from a lockfile before using them in filesystem joins during installation. If a user...

CVE-2026-96284: Improper Link Resolution Before File Access

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100419

A flaw was found in gix-fs. An attacker can achieve arbitrary code execution by tricking a user into checking out a maliciously crafted repository. During forced checkout operations with file overwriting enabled, crafted symbolic links symlinks can bypass path validation and replace target...

SUSE CVE-2026-82331

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

UBUNTU-CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-82331

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

DEBIAN-CVE-2026-82331

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

CVE-2026-82331

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

CVE-2026-82331

The Apache BuildStream tar source plugin contains an improper link resolution (link following) vulnerability when running on Python = 3.12 with BuildStream >= 2.3.0 due to the use of the Python tarfile filter functionality. Users are recommended to upgrade to version 2.8.1 to resolve the issue...

EUVD-2026-85113

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

PT-2026-97204

Name of the Vulnerable Software and Affected Versions Apache BuildStream versions prior to 2.8.1 Description An improper link resolution issue exists in the tar source plugin when running on Python versions prior to 3.12. This allows malicious source tarballs to write files on the host system wit...

Important: Red Hat Security Advisory: abrt security update

An update for abrt is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

EulerOS Virtualization 2.11.0 : sed (EulerOS-SA-2026-3559)

According to the versions of the sed packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic...

USN-8779-1: Bubblewrap vulnerabilities

It was discovered that Bubblewrap incorrectly handled certain temporary directories. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. CVE-2019-12439 It was discovered that Bubblewrap incorrectly handl...