#cwe-59

共收录 498 条相关情报。

漏洞预警2026-10-13 发布HIGH

Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.

CVE-2026-83659

Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized atta

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-13 发布MEDIUM

Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally.

CVE-2026-83507

Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authoriz

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-13 发布INFO

Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.

CVE-2026-102204

Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized a

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-13 发布INFO

Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

CVE-2026-102202

Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to e

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-13 发布INFO

Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.

CVE-2026-53562

Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects Uni

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-13 发布INFO

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path...

CVE-2026-77361

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-co

历史摘要 · 未重新核验 · NVD

#cve #cwe-59 #cwe-863

漏洞预警2026-10-13 发布INFO

Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository....

CVE-2026-109965

Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

安全公告2026-10-13 发布INFO

obsidian-tc symlink path mismatch bypasses read ACL restrictions

CVE-2026-77361

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-co

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-59 #cwe-863

漏洞预警2026-10-12 发布INFO

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ance...

CVE-2026-109596

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modu

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-12 发布INFO

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by plantin...

CVE-2026-109375

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows san

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-12 发布INFO

ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick scri...

CVE-2026-109274

ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to byp

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

安全公告2026-10-12 发布INFO

ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script

CVE-2026-109274

ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to byp

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-59

漏洞预警2026-10-12 发布LOW

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured poli...

CVE-2026-105081

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthori

来源摘录 · NVD

#cve #cwe-59

安全公告2026-10-11 发布INFO

thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the...

CVE-2026-108839

thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-59 #severity:low

漏洞预警2026-10-11 发布INFO

thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by fol...

CVE-2026-108839

thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

安全公告2026-10-11 发布INFO

thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs

CVE-2026-108839

thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-59

漏洞预警2026-10-11 发布INFO

mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the sandbox vi...

CVE-2026-108759

mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shel

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-11 发布INFO

MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the pr...

CVE-2026-108751

MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-10-11 发布INFO

answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving syml...

CVE-2026-108723

answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

安全公告2026-10-11 发布INFO

mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec

CVE-2026-108759

mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shel

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-59