Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to perform tampering locally.

CVE-2026-69425

Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to perform

历史摘要 · 未重新核验 · NVD

Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to elevate privileges locally.

CVE-2026-69379

Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to elevate

历史摘要 · 未重新核验 · NVD

Improper link resolution before file access ('link following') in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.

CVE-2026-69289

Improper link resolution before file access ('link following') in Windows Setup Files Cleanup allows an authorized attac

历史摘要 · 未重新核验 · NVD

Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.

CVE-2026-68830

Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host all

历史摘要 · 未重新核验 · NVD

Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-67368

Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate pr

历史摘要 · 未重新核验 · NVD

A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION...

CVE-2026-86469

A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutpu

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks ...

CVE-2026-86469

A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutpu

历史摘要 · 未重新核验 · NVD

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write rest...

CVE-2026-86424

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decod

来源摘录 · NVD

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions b...

CVE-2026-86422

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows tha

来源摘录 · NVD

ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlink Race

CVE-2026-86424

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decod

历史摘要 · 未重新核验 · OSV.dev

ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race

CVE-2026-86422

ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows tha

历史摘要 · 未重新核验 · OSV.dev

CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

CVE-2026-75914

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attac...

CVE-2026-85583

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that fo

历史摘要 · 未重新核验 · NVD

SiYuan before v3.8.2 Path Traversal via symlink in file API

CVE-2026-85583

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that fo

历史摘要 · 未重新核验 · OSV.dev

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local...

CVE-2026-85092

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the oper

历史摘要 · 未重新核验 · NVD

LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

CVE-2026-85092

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the oper

历史摘要 · 未重新核验 · OSV.dev

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does n...

CVE-2026-78409

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory

历史摘要 · 未重新核验 · NVD

pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

## Summary A crafted lockfile alias could reach several install-time filesystem joins. With `--trust-lockfile` or a fro

历史摘要 · 未重新核验 · GitHub Advisory

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existin...

CVE-2024-14047

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by u

历史摘要 · 未重新核验 · NVD

A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Backblaze's folder to Windows OS system files during a backup...

CVE-2026-19820

A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Back

历史摘要 · 未重新核验 · NVD