Overview 911 matches · 11 in Waratek scope · 3 protected · 30 exploited · 24 CISA KEV · 53 public PoC · 4 EPSS ≥ 0.5
911matches
11in Waratek scope1.2%
3protected0.3%
30exploited3.3%
24CISA KEV2.6%
53public PoC5.8%
4EPSS ≥ 0.50.4%
Protected by Waratek
3
0.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
8
0.9%
Outside Waratek scope
4
0.4%
Not applicable
896
98.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
0.3%
partly blocked
0
0.0%
not blocked
908
99.7%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 252 / year
20001
Not applicable1
High1
not blocked1
Working exploit published1
20013
Not applicable3
High3
not blocked3
No public exploit3
20023
Not applicable3
High3
not blocked3
No public exploit3
20033
Not applicable3
High3
not blocked3
No public exploit3
20042
Not applicable2
High2
not blocked2
No public exploit2
20051
Not applicable1
High1
not blocked1
No public exploit1
20060
20070
200823
No exploit published1
Not applicable22
High23
not blocked23
Working exploit published2
No public exploit21
20091
Not applicable1
High1
not blocked1
No public exploit1
20100
20110
20120
20132
Not applicable2
High2
not blocked2
No public exploit2
20143
Not applicable3
High3
not blocked3
No public exploit3
20157
Not applicable7
High7
not blocked7
Exploited2
Working exploit published1
No public exploit4
20166
Not applicable6
High6
not blocked6
Working exploit published3
No public exploit3
201717
No exploit published1
Not applicable16
High17
not blocked17
Working exploit published3
No public exploit14
201828
Outside Waratek scope2
Not applicable26
High28
not blocked28
Working exploit published3
No public exploit25
201967
No exploit published1
Not applicable66
High67
not blocked67
Exploited8
Working exploit published4
Proof of concept only2
No public exploit53
202070
Outside Waratek scope1
Not applicable69
High70
not blocked70
Exploited3
Proof of concept only4
No public exploit63
202175
Protected by Waratek1
No exploit published2
Outside Waratek scope1
Not applicable71
High75
blocked by ARMR today1
not blocked74
Exploited2
Working exploit published1
Forecast only1
No public exploit71
202266
Not applicable66
High66
not blocked66
Exploited2
Proof of concept only1
No public exploit63
202379
Protected by Waratek1
No exploit published1
Not applicable77
High79
blocked by ARMR today1
not blocked78
Exploited2
Working exploit published1
Proof of concept only9
No public exploit67
2024111
Not applicable111
High111
not blocked111
Exploited3
Proof of concept only6
No public exploit102
202591
Not applicable91
High91
not blocked91
Exploited4
Working exploit published1
Proof of concept only16
No public exploit70
2026252
Protected by Waratek1
No exploit published2
Not applicable249
High252
blocked by ARMR today1
not blocked251
Exploited4
Proof of concept only59
No public exploit189
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-126304 | High | 2026-11-13 | Not applicable | No public exploit | NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox. |
| CVE-2026-19048 | High | 2026-11-12 | Not applicable | No public exploit | An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks. |
| CVE-2026-91151 | High | 2026-11-11 | Not applicable | Proof of concept only | A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system. |
| CVE-2026-126612 | High | 2026-11-11 | Not applicable | No public exploit | Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a mount point that the user controls or that every user may change, such as a junction made at the root of a drive, which takes the root's permissions, or through a folder that every user may rename. Setup installed the programs through any such link without first checking who controls it, or whether a folder above the program folder may be renamed, and the service is registered to run the programs by that path, so the programs are installed where a link another account controls leads, or that account can later make the path lead to a folder it controls; the service, which runs as LocalSystem or as its virtual account, and the programs administrators run from Bin are then started from there. 6.3.7's fix for CVE-2026-107571 does not cover this: its hardening of the program folder, Bin and ControlPanel does not change a folder reached through a link that the administrators do not alone control, and setup does not refuse such a path: it installs through the link and at most reports afterwards that the folders could not be hardened. The default installation under Program Files is not affected. |
| CVE-2026-95963 | High | 2026-11-10 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Data Sharing Service Client allows an authorized attacker to elevate privileges locally. |
| CVE-2026-91764 | High | 2026-11-10 | Not applicable | No public exploit | Improper Link Resolution Before File Access Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 6.1.1.-00 before 9.0.5-00. |
| CVE-2026-88224 | High | 2026-11-10 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-86578 | High | 2026-11-10 | Not applicable | No public exploit | Link Following Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: from 5.0.0-03 before 9.0.4-01. |
| CVE-2026-124224 | High | 2026-11-10 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges locally. |
| CVE-2026-122182 | High | 2026-11-10 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows Maps allows an authorized attacker to elevate privileges locally. |
| CVE-2026-122177 | High | 2026-11-10 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows iSCSI allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-122174 | High | 2026-11-10 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally. |
| CVE-2026-119913 | High | 2026-11-10 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105532 | High | 2026-11-10 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-105520 | High | 2026-11-10 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows DNS allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-123532 | High | 2026-11-08 | Not applicable | Proof of concept only | gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on Windows with symlinks enabled, gix_fs::symlink::create calls is_dir() on the UNC target, triggering SMB authentication that leaks the username, domain, and NTLMv2 hash. |
| CVE-2026-123842 | High | 2026-11-06 | Not applicable | No public exploit | In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives |
| CVE-2026-123841 | High | 2026-11-06 | Not applicable | No public exploit | In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive |
| CVE-2026-123836 | High | 2026-11-06 | Not applicable | No public exploit | In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup |
| CVE-2026-87008 | High | 2026-11-05 | Not applicable | Proof of concept only | Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies on should_skip_path in codebase_rag/utils/path_utils.py to classify them, but the containment check operates on unresolved lexical paths. A symbolic link planted inside an analyzed repository can therefore reference a file outside the configured root while still appearing in scope. The structural_search tool follows the link and discloses readable content without an approval gate, while structural_replace with dry_run=False follows it and overwrites writable content; the MCP path invokes structural replacement without the agent-loop approval control. An attacker who causes a victim to analyze a repository containing such a link can read credentials, keys, environment files, or sibling source and can modify files accessible to the code-graph-rag process. This issue is fixed in version 0.0.589. |
| CVE-2026-88968 | High | 2026-11-03 | Not applicable | No public exploit | Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sandbox can atomically replace an in-workspace parent directory with a symlink after validation, causing the unsandboxed Edit implementation to overwrite a user-writable file outside the workspace. Exploitation requires attacker-controlled code to run inside the sandbox, such as from a malicious repository or dependency script. This issue is fixed in version 2.1.251. |
| CVE-2026-63395 | High | 2026-11-03 | Not applicable | Proof of concept only | isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later replace the tree state with a child file beneath that path; the usual trigger is a clone followed by a later pull, while a single clone can trigger the issue when a symlink already exists or the consuming application accesses the tree. With Node fs on Linux or macOS, the operating system can resolve the write outside the working tree, permitting arbitrary host file writes and possible code execution. Node fs on Windows usually blocks the symlink plant without additional privilege, and browser or in-memory providers limit impact to their virtual filesystem and are affected only when they implement symlink creation and following. This issue is fixed in version 1.38.6. |
| CVE-2026-121224 | High | 2026-11-03 | Not applicable | No public exploit | Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) |
| CVE-2026-103916 | High | 2026-11-03 | Not applicable | No public exploit | Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions. |
| CVE-2026-105476 | High | 2026-11-02 | Not applicable | No public exploit | Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges. |
| CVE-2026-119336 | High | 2026-10-30 | Not applicable | No public exploit | Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5. |
| CVE-2026-116250 | High | 2026-10-30 | Not applicable | No public exploit | In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it with a plain open() or handed the path to a utility that opened it later: the servers.json export and import and the import file listing, and the files given to pg_dump, pg_dumpall, pg_restore and psql by Backup, Restore and Import/Export Data. A symbolic link swapped in at the file or at any parent directory between the check and the open redirected the operation outside the storage directory, so a file could be written, overwritten or read, or loaded into a table, as the operating-system account running pgAdmin. A hard link to an outside file, which O_NOFOLLOW does not detect, and a FIFO, which could hang a request, had the same effect. CVE-2026-86861 fixed this for the File Manager's save_file; these were the remaining paths. Exploitation requires creating such a link or FIFO inside the user's storage directory. pgAdmin offers no way to do so, and the per-user storage directories belong to the pgAdmin account, so this requires write access to the storage backend as a different operating-system user, for example a shared or network-mounted storage directory, and winning the race. The fix opens each file by walking down from the storage directory one component at a time with O_NOFOLLOW, accepting only a regular file with one link, and passes the utilities the open descriptor (/dev/fd/N) on Linux. Error messages no longer include the server path. This issue affects pgAdmin 4: before 9.19. |
| CVE-2026-119168 | High | 2026-10-29 | Not applicable | No public exploit | HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18. |
| CVE-2026-115713 | High | 2026-10-29 | Not applicable | No public exploit | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132). |
| CVE-2026-115709 | High | 2026-10-29 | Not applicable | No public exploit | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132). |
| CVE-2026-115708 | High | 2026-10-29 | Not applicable | No public exploit | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132). |
| CVE-2026-107347 | High | 2026-10-29 | Not applicable | No public exploit | HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18. |
| CVE-2026-6064 | High | 2026-10-28 | Not applicable | No public exploit | Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\SYSTEM privelages. |
| CVE-2026-117617 | High | 2026-10-28 | No exploit published | No public exploit | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system. |
| CVE-2026-116271 | High | 2026-10-28 | Not applicable | No public exploit | MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes. Each message is written to a directory named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link. When the output base is writable by other users, as with output_under("/tmp"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process. |
| CVE-2026-103401 | High | 2026-10-28 | Not applicable | No public exploit | An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected. |
| CVE-2026-93864 | High | 2026-10-27 | Not applicable | No public exploit | A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and triggering a list update. Written content is partially constrained. |
| CVE-2026-90464 | High | 2026-10-27 | Not applicable | No public exploit | An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values. |
| CVE-2026-116682 | High | 2026-10-27 | Not applicable | Proof of concept only | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta. |
| CVE-2026-108306 | High | 2026-10-27 | Not applicable | No public exploit | Tanium addressed a local privilege escalation vulnerability in End-User Notifications. |
| CVE-2026-108305 | High | 2026-10-27 | Not applicable | No public exploit | Tanium addressed a local privilege escalation vulnerability in End-User Notifications. |
| CVE-2026-108304 | High | 2026-10-27 | Not applicable | No public exploit | Tanium addressed a local privilege escalation vulnerability in End-User Notifications. |
| CVE-2026-115908 | High | 2026-10-26 | Not applicable | No public exploit | zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0. |
| CVE-2026-112513 | High | 2026-10-26 | Not applicable | No public exploit | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Golden Gate 27.2. An app may be able to break out of its sandbox. |
| CVE-2026-112344 | High | 2026-10-26 | Not applicable | No public exploit | Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link placed inside a user's home folder to access files outside the virtual filesystem root because confinement is enforced only against the requested path and not the on-disk destination of the link. Attackers can leverage a symlink or, on Windows, a directory junction that points outside the jail to read or access restricted files beyond the intended home-folder boundary. |
| CVE-2026-114665 | High | 2026-10-22 | Not applicable | No public exploit | Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys. |
| CVE-2026-104068 | High | 2026-10-22 | Not applicable | No public exploit | JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration. |
| CVE-2026-76496 | High | 2026-10-21 | Not applicable | No public exploit | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76496 are related to issues concerning improper link resolutions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-59. |
| CVE-2026-114096 | High | 2026-10-21 | Not applicable | Proof of concept only | Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution. |
| CVE-2026-112940 | High | 2026-10-20 | Not applicable | Proof of concept only | filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a writable adjacent hot journal is additionally required for attacker-chosen content overwrites. This issue is fixed in version 4.2.1. |
| CVE-2026-111045 | High | 2026-10-19 | Not applicable | No public exploit | CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path as safe, so write_file follows the link and can write arbitrary files outside the workspace root. This issue is fixed in version 0.0.2. |
| CVE-2026-53882 | High | 2026-10-15 | Not applicable | No public exploit | An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Virtualization Station 4.1.1.130 and later |
| CVE-2026-90954 | High | 2026-10-14 | Not applicable | No public exploit | A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package. |
| CVE-2026-110767 | High | 2026-10-14 | Not applicable | Proof of concept only | Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the server to return any file the service user can read, up to 10 MB. |
| CVE-2026-104103 | High | 2026-10-14 | Not applicable | No public exploit | Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could create a link that escaped the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process's privileges. The same containment check used os.path.commonprefix, so a sibling path sharing the destination's character prefix could also pass. The dataset-loading path can download and extract configured archive URLs, but exploitation requires a user to process an archive from a source controlled or compromised by the attacker on supported Python 3.12 and 3.13 runtimes. Python 3.14 is not affected because its default tar data filter rejects escaping links. This issue is fixed in version 0.17.8. |
| CVE-2026-96911 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96243 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96231 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96225 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| CVE-2026-88191 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-88133 | High | 2026-10-13 | Not applicable | No public exploit | Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-88072 | High | 2026-10-13 | Not applicable | No public exploit | Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85849 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-85343 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83927 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83793 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83704 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| CVE-2026-83659 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70190 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69673 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally. |
| CVE-2026-53562 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2. |
| CVE-2026-109965 | High | 2026-10-13 | Not applicable | Proof of concept only | Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials. |
| CVE-2026-108135 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally. |
| CVE-2026-102204 | High | 2026-10-13 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
| CVE-2026-102202 | High | 2026-10-13 | Not applicable | No public exploit | Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-108759 | High | 2026-10-11 | Not applicable | No public exploit | mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the sandbox via symlinks. Attackers or prompt-injected agents can name symlinks as outputs or reuse sessions with symlinked input paths to access files with the server process's permissions. |
| CVE-2026-107810 | High | 2026-10-09 | Not applicable | Proof of concept only | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create and restore backups can craft a valid backup that places a symlink in the staging tree and then writes a regular file through that link, even when both restore flags are false. This can persistently inject configuration or cause denial of service when the modified files are later consumed. This issue is fixed in version 2.5.0. |
| CVE-2026-89091 | High | 2026-10-08 | Not applicable | No public exploit | A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory. This allows an attacker who can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running ansible-galaxy, leading to code execution on the control node. This is a bypass of the fix for CVE-2020-10691. |
| CVE-2026-107716 | High | 2026-10-08 | Not applicable | No public exploit | Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. The issue requires attacker influence over the registry directory or its extracted contents. This issue is fixed in version 2.5.1. |
| CVE-2026-107707 | High | 2026-10-08 | Not applicable | Proof of concept only | Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM. |
| CVE-2026-106500 | High | 2026-10-06 | Not applicable | No public exploit | Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0. |
| CVE-2026-103263 | High | 2026-10-01 | Not applicable | Proof of concept only | Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user. |
| CVE-2026-10739 | High | 2026-09-30 | Not applicable | No public exploit | Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe. |
| CVE-2026-102118 | High | 2026-09-30 | Not applicable | No public exploit | A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance. |
| CVE-2026-102113 | High | 2026-09-30 | Not applicable | No public exploit | A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root. A privileged routine did not safely handle a filesystem path that the lower-privileged account could influence, allowing the attacker to cause a root-owned operation to run arbitrary commands with the highest privileges. Exploitation requires existing local access to that service account. |
| CVE-2026-92371 | High | 2026-09-29 | Not applicable | No public exploit | TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system. |
| CVE-2026-102242 | High | 2026-09-29 | Not applicable | No public exploit | Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path validation checks directories lexically without resolving symbolic links first, an attacker can access or overwrite arbitrary local files located outside the permitted root directories. |
| CVE-2026-100838 | High | 2026-09-27 | Not applicable | No public exploit | Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to connect to the Kata agent VSOCK could issue a series of CopyFile requests to overwrite security-critical files in the guest or trick the workload into disclosing sensitive data, effectively amounting to a full guest takeover. Users unable to upgrade can apply an equivalent rego policy fix passed to 'contrast generate --policy'. |
| CVE-2026-100715 | High | 2026-09-26 | Not applicable | Proof of concept only | Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixed_homedir argument, so the symlink component walk is skipped, and then executes 'rm -rf' as root on the resulting path with string-level guards only. Because makeCorrectDir() appends a trailing slash, GNU rm dereferences a symlink used either as an intermediate path component or as the final component. An authenticated customer who can write to the FTP home directory can plant a symlink between task insertion and cron execution, causing the root cron job to recursively delete arbitrary directory trees, resulting in cross-tenant data destruction and host denial of service. This issue is fixed in Froxlor 2.3.12. |
| CVE-2026-100692 | High | 2026-09-26 | Not applicable | No public exploit | Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ (or a vendored module) could contain a symlink at a mount root (for example themes/mytheme/assets -> /some/dir/outside). Files behind such a symlink were readable during a site build through resources.Get, resources.Match and similar functions, and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Modules fetched via Go modules are not affected because Go module zips cannot contain symlinks, and this is not an escalation for the main project, which may already mount absolute paths by configuration. Fixed in v0.166.0, where symlinked mount roots and symlinked directories between the mount root and the module directory are treated as non-existent for all modules. As a workaround, inspect themes/ and vendored modules for symlinks at mount roots before building, or replace symlinks with explicit mounts. |
| CVE-2026-100690 | High | 2026-09-26 | Not applicable | No public exploit | Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows symbolic links that point outside the allowed set, Hugo did not detect symlinks escaping the sandbox. An attacker who can contribute content to a Hugo project (for example via a pull request) can commit a symlink such as assets/css/x.css -> /etc/passwd together with a PostCSS plugin that reads it, allowing any file readable by the Hugo build process to be disclosed and potentially embedded in the published site. This affects builds using the default security configuration; projects that do not invoke Node.js tools are unaffected. Fixed in v0.166.0, which scans allowed paths and fails the build when a symbolic link resolves outside them. |
| CVE-2026-100419 | High | 2026-09-25 | Not applicable | Proof of concept only | gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation. |
| CVE-2026-55074 | High | 2026-09-21 | Not applicable | No public exploit | Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv. A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink in a directory an Ansible task later writes to) can therefore cause an arbitrary root-owned write on the host, outside the jail — a full jail escape. Arbitrary root-owned host writes are readily escalated to host compromise (e.g. cron, rc.d, authorized_keys). Preconditions for this vulnerability are that the operator runs a copy/template/fetch-style task (anything using put_file) against the jail, and the attacker can place a symlink inside the jail at or above the task's destination before the transfer runs. This issue has been fixed in version 2.0.0. |
| CVE-2026-15815 | High | 2026-09-17 | Not applicable | No public exploit | Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution. Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration. Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS. |
| CVE-2026-85731 | High | 2026-09-16 | Not applicable | Proof of concept only | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2. |
| CVE-2026-90930 | High | 2026-09-14 | Not applicable | Proof of concept only | File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths. |
| CVE-2026-84584 | High | 2026-09-14 | Not applicable | No public exploit | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox. |
| CVE-2026-82049 | High | 2026-09-14 | Not applicable | No public exploit | In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree. |
| CVE-2026-88016 | High | 2026-09-10 | Not applicable | Proof of concept only | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1. |
| CVE-2026-87766 | High | 2026-09-09 | Not applicable | No public exploit | A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0. |