Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,251

Export CSV
CVE-2026-126302

NLTK 3.9.4 before 3.10.4 Symlink Sandbox Escape via chat80.sql_query

NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox.

CVSS 4.0 · 4.8 Medium EPSS n/a KEV · Not listed
Vendors
Nltk
Products
Nltk
CVE-2026-126304

NLTK 3.10.0 before 3.10.4 Symlink Escape in YCOECorpusReader

NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Nltk
Products
Nltk
CVE-2026-126316

Frappe HRMS 16.0.0 before 16.20.1 Subscription Key Exposure via Request URL

Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs.

CVSS 4.0 · 2.1 Low EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128241

libexpat xmlwf through 2.10.0 Symlink Following via -d Output Directory

The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files with fopen("wb"), which follows symbolic links. Local attackers with write access to the output directory can plant a symlink at the expected output name to truncate or overwrite files writable by the xmlwf user.

CVSS 4.0 · 4.1 Medium EPSS n/a KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2026-126612

Improper Link Resolution Before File Access ('Link Following') in hMailServer

Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a mount point that the user controls or that every user may change, such as a junction made at the root of a drive, which takes the root's permissions, or through a folder that every user may rename. Setup installed the programs through any such link without first checking who controls it, or whether a folder above the program folder may be renamed, and the service is registered to run the programs by that path, so the programs are installed where a link another account controls leads, or that account can later make the path lead to a folder it controls; the service, which runs as LocalSystem or as its virtual account, and the programs administrators run from Bin are then started from there. 6.3.7's fix for CVE-2026-107571 does not cover this: its hardening of the program folder, Bin and ControlPanel does not change a folder reached through a link that the administrators do not alone control, and setup does not refuse such a path: it installs through the link and at most reports afterwards that the folders could not be hardened. The default installation under Program Files is not affected.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Progressive Robot
Products
Hmailserver
CVE-2026-59080

JWT Exposure via GET Request in Edito CMS

Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perform action on behalf of the victim. The token is valid for only short period of time; after that time, it expires and can no longer be used. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.

CVSS 4.0 · 2.1 Low EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126644

Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory

A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component (os.chown with follow_symlinks=False and O_NOFOLLOW in _safe_open_write()). When an unprivileged local user replaces their ~/.ssh directory with a symlink to a directory they do not own, and an operator subsequently runs the authorized_key task as root (a common provisioning pattern), the module resolves its path operations through the symlink: atomic_move() writes the temporary file in the symlink target and renames it to <target>/authorized_keys, creating or overwriting a file in the attacker-chosen directory, and os.chmod(sshdir, 0o700) follows the symlink and changes the target directory's permissions. The written file is chowned to the unprivileged user, so this is not a privilege escalation, but it allows an attacker to create or overwrite files (for example in /etc/apt/apt.conf.d/, which APT reads regardless of file ownership) to cause integrity and availability impacts.

CVSS 3.1 · 3.9 Low EPSS n/a KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux
CVE-2026-19048

Remote Authenticated Arbitrary File Write via Improper Link Resolution in Synology DSM Thumb

An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Synology
Products
Diskstation Manager
CVE-2026-124745

Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory

A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Red Hat Redhat
Products
Busybox Enterprise Linux Enterprise Linux and 3 more
CVE-2026-124744

Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Hardened Images and 2 more
CVE-2026-124495

Apache Storm: Logviewer follows worker symlinks across topology ACLs

When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Storm
CVE-2026-123836

Workspace Collaborators Retrieve Owner's SSH Private Key via Git Backup in JetBrains Datalore

In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Datalore
CVE-2026-126859

chromium-browser: Link following in FileSystem

Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-91151

Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Eus Openshift Devspaces and 2 more
CVE-2026-88224

Windows AppX Deployment Service Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows Server 2016 and 1 more
CVE-2026-95963

Data Sharing Service Client Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Data Sharing Service Client allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 10 more