agentprime: CWE-61

CVE-2026-100395: LXC: lxc-copy host-context hostname update follows symlink

Thu, 05 Nov 2026 21:45:58 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-121747: nvm prints the contents of any readable file through a symlinked .nvmrc

Wed, 04 Nov 2026 21:30:32 GMT

CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-121520: Malicious client could set xattr value outside of BuildKit state directory

Tue, 03 Nov 2026 22:11:57 GMT

CVSS 4.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-65109: NVIDIA Slurm: NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that…

Tue, 03 Nov 2026 15:33:52 GMT

CVSS 4.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-119336: Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink

Fri, 30 Oct 2026 20:05:40 GMT

CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

Thu, 29 Oct 2026 16:40:12 GMT

zip >=7.2.0, <9.0.0, fixed in 9.0.0. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-115424: Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination

Thu, 22 Oct 2026 21:12:27 GMT

CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102740: AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink

Thu, 15 Oct 2026 17:25:30 GMT

CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-50612: Import Symlink Following Remote Code Execution Vulnerability in QuMagie

Thu, 15 Oct 2026 09:31:41 GMT

CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-41541: Symlink creation in qsyncsrv.cgi

Thu, 15 Oct 2026 09:30:51 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Filesystem sandbox escape when renaming symlinks with trailing slashes

Wed, 14 Oct 2026 12:00:00 GMT

wasmtime-wasi >=0.0.0-0, <36.0.18 || >=37.0.0, <48.0.6 || >=49.0.0, <49.0.3, fixed in 36.0.18, 48.0.6, 49.0.3. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-108981: denji ngx_cache_purge: ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain…

Mon, 12 Oct 2026 02:27:15 GMT

CVSS 3.6 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

Fri, 09 Oct 2026 17:07:05 GMT

github.com/0xJacky/Nginx-UI >=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074146-a467ed652591, fixed in 1.9.10-0.20260728074146-a467ed652591. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-106566: ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check

Wed, 07 Oct 2026 15:21:39 GMT

CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-107174: Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction

Wed, 07 Oct 2026 14:34:51 GMT

CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-103435: Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

Wed, 07 Oct 2026 12:50:02 GMT

CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-106507: Backstage: TechDocs arbitrary file read via mkdocs snippets

Tue, 06 Oct 2026 21:46:08 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-105712: gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive.

Mon, 05 Oct 2026 18:53:09 GMT

CVSS 3.6 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

Fri, 02 Oct 2026 18:53:35 GMT

dulwich >=0.24.0, <1.2.8, fixed in 1.2.8. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-97024: Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc

Tue, 29 Sep 2026 03:23:00 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-97023: Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin

Mon, 28 Sep 2026 18:53:28 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

Language Servers for AWS vulnerable to arbitrary file write

Thu, 24 Sep 2026 19:15:39 GMT

@aws/lsp-codewhisperer <0.0.117, fixed in 0.0.117. CVSS 8.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-96808: Flatpak: In Flatpak before 1.18.1, the revokefs writer…

Wed, 23 Sep 2026 16:58:37 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-96807: Flatpak: In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so…

Wed, 23 Sep 2026 16:54:16 GMT

CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-91202: Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste

Fri, 18 Sep 2026 19:21:11 GMT

CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-91099: HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

Wed, 16 Sep 2026 18:45:51 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-90616: Flatpak: In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write…

Sat, 12 Sep 2026 20:00:58 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-77159: Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

Fri, 11 Sep 2026 10:32:29 GMT

CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-57825: OCaml opam: In the opam package before 2.5.2 for OCaml…

Wed, 09 Sep 2026 00:00:00 GMT

CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

NLTK: Downloader.download follows hardlinks and overwrites outside-root files

Wed, 02 Sep 2026 14:35:41 GMT

nltk <3.10.3, fixed in 3.10.3. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-79939: Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability.

Wed, 26 Aug 2026 19:32:57 GMT

CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-75038: Predictable temporary file in /tmp allows symlink attack in LACT

Tue, 25 Aug 2026 10:00:47 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-55168: Runtipi: Authenticated arbitrary file write via backup restore symlink planting

Fri, 21 Aug 2026 20:31:38 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-63125: Incus vulnerable to root RCE via image backup.yaml symlink

Fri, 21 Aug 2026 14:49:16 GMT

CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-64846: Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature

Thu, 20 Aug 2026 16:18:06 GMT

CVSS 2.8 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Filesystem sandbox escape when paths or symlinks contain trailing slashes

Thu, 20 Aug 2026 12:00:00 GMT

wasmtime >=0.0.0-0, <24.0.13 || >=25.0.0, <36.0.14 || >=37.0.0, <46.0.3 || >=47.0.0, <47.0.4, fixed in 24.0.13, 36.0.14, 46.0.3, 47.0.4. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-32657: Dell AppSync: Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1…

Tue, 18 Aug 2026 17:50:21 GMT

CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-47766: crun follows rootfs /dev symlink while creating default devices

Fri, 14 Aug 2026 16:16:37 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-53802: rsync < 3.5.0 Arbitrary File Read via Symlink Following

Thu, 13 Aug 2026 14:32:26 GMT

CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

Smarty: Symlink path traversal out of trusted directories

Fri, 07 Aug 2026 15:02:39 GMT

smarty/smarty <4.5.7 || >=5.0.0, <5.8.2, fixed in 4.5.7, 5.8.2. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

Wed, 29 Jul 2026 16:32:34 GMT

proot-distro <5.1.5, fixed in 5.1.5. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

Tue, 28 Jul 2026 22:23:48 GMT

skilo >=0.5.0, <0.11.1, fixed in 0.11.1. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-56748: Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import

Mon, 27 Jul 2026 19:27:31 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-17459: perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink

Sun, 26 Jul 2026 10:15:09 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-65010: Datasets Symlink-following Arbitrary File Write via Extractor.extract()

Thu, 23 Jul 2026 17:55:52 GMT

CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-12080: Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

Mon, 20 Jul 2026 12:40:45 GMT

CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-59674: LPE from suricata user to root due to chown in %post in suricata packaging

Tue, 14 Jul 2026 07:32:35 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

Root escape via symlink plus trailing slash in os

Tue, 07 Jul 2026 21:34:47 GMT

stdlib <1.25.12 || >=1.26.0-0, <1.26.5 || >=1.27.0-0, <1.27.0-rc.2, fixed in 1.25.12, 1.26.5, 1.27.0-rc.2. CVSS 7.8 (High). Published by OSV. Not analysed by agentprime yet.

CVE-2026-14699: zcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlink

Sun, 05 Jul 2026 03:15:08 GMT

CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-13748: Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction

Mon, 29 Jun 2026 15:58:00 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.