Rocky Linux 9 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2025_23744)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523744 advisory. git-lfs: Git LFS may write to arbitrary files via crafted symlinks CVE-2025-26625 Tenable has extracted the preceding description block directly from the CIQ...

CentOS Linux 6 [TuxCare] Security Update: glusterfs / glusterfs-api / glusterfs-api-devel / glusterfs-cli / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777475261)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777475261 advisory. - It was found that the mknod call derived from mknod2 can create files pointing to devices on a glusterfs server node. An authenticated...

Rocky Linux 9 [CIQ] Security Update: perl-Archive-Tar (crlsa-2026_30856)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202630856 advisory. perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-42496 Tenable has extracted the preceding description...

GHSA-C2M8-H5V5-343R Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

Summary StaticFileHandler allows an unauthenticated attacker to read arbitrary files from the server's filesystem by requesting a path that resolves to a symbolic link placed inside the static root directory. Any application that serves user-uploadable content, or whose static directory is...

Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

Summary StaticFileHandler allows an unauthenticated attacker to read arbitrary files from the server's filesystem by requesting a path that resolves to a symbolic link placed inside the static root directory. Any application that serves user-uploadable content, or whose static directory is...

Rocky Linux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1781603962)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781603962 advisory. - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the...

AlmaLinux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1781603962)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781603962 advisory. - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expo...

SUSE CVE-2026-101044

pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...

EUVD-2026-88046

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

CVE-2026-96284

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

CVE-2026-101044

The pacquet Rust package-manager component, included in pnpm versions >=12.0.0-alpha.0 and

EUVD-2026-87975

pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...

CVE-2026-101044 pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias

pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...

CVE-2026-101044 pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias

pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...

PT-2026-99562

Name of the Vulnerable Software and Affected Versions pnpm versions 12.0.0-alpha.0 through 12.0.0-alpha.4 Description The pacquet Rust package-manager component fails to validate dependency alias or name paths from a lockfile before using them in filesystem joins during installation. If a user...

CVE-2026-96284: Improper Link Resolution Before File Access

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100690 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...

CVE-2026-100419

A flaw was found in gix-fs. An attacker can achieve arbitrary code execution by tricking a user into checking out a maliciously crafted repository. During forced checkout operations with file overwriting enabled, crafted symbolic links symlinks can bypass path validation and replace target...