CVE-2026-39822 Root escape via symlink plus trailing slash in os

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...

Malicious code in @vite-ln/build-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8972bbfdd55ad200dd49b08501d7391beca99841f0c36479806f2b1e329950a2 Package @vite-ln/build-ts copies the legitimate vite package's manifest verbatim description 'Native-ESM powered web dev build tool', author 'Evan...

Malicious code in nam-os-a-man (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a483a2ae78f1f6f7d3d4da1ab74cc189f29564e002299f09c19e0d3eb41e40aa The package declares a postinstall hook that runs index.js on npm install. index.js collects the installer's OS username os.userInfo.username, hostna...

GHSA-QCXP-RJ5J-4RR9 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-qemu-melange, linux-vmware...

GHSA-VG6G-9H68-878W vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-qemu-melange, linux-vmware...

GHSA-VCCQ-H5J4-92QR vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-qemu-melange, linux-vmware...

CVE-2026-53181 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-qemu-melange, linux-vmware...

GHSA-8CG3-6H68-W2CJ vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-aws, linux-gcp, linux-qemu-melange, linux-vmware...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

The vulnerability of the dsa_switch_parse() function in the net/dsa/dsa.c module allows a hacker to cause a service failure in systems with a distributed kernel architecture of the Linux operating system.

The vulnerability of the dsaswitchparse function in the net/dsa/dsa.c module relates to the improper release of resources in support for Linux’s distributed kernel architecture. Exploiting this vulnerability could allow an attacker to cause service failures...

ROS-20260708-73-0082

The vulnerability of the PostgreSQL database management system is related to integer overflow. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-41252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in...

Linux Distros Unpatched Vulnerability : CVE-2026-54538

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field...

Symlink Attack

Overview std/os is a Go standard library package std/os Affected versions of this package are vulnerable to Symlink Attack. Go Vulnerability Report:On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a pat...

PYSEC-2026-1477 Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Impact On Windows, the shared %PROGRAMDATA% directory is searched for configuration files SYSTEMCONFIGPATH and SYSTEMJUPYTERPATH, which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected %PROGRAMDATA% are affected...

Malicious code in nuxt-fonts-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ede5024b6ee71356eedb3dfb3bb648682901bf6b966bbe353daff6082ecc85 Package ships only a package.json and a readme; there is no main entry, no bin, no scripts, no dependencies, and no executable code. The readme...

SUSE CVE-2026-58386

unknown...

CVE-2026-55204 vulnerabilities

Vulnerabilities for packages: haproxy...

PYSEC-2026-976 TensorFlow vulnerable to `CHECK` fail in `QuantizeAndDequantizeV3`

Impact If QuantizeAndDequantizeV3 is given a nonscalar numbits input tensor, it results in a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf signedinput = True rangegiven = False narrowrange = False axis = -1 input = tf.constant-3.5, shape=1,...

SUSE CVE-2026-59674

A UNIX Symbolic Link Symlink Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root. This issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1...