Monthly
Improper link resolution (CWE-59) in QNAP Virtualization Station before 4.1.1.130 allows an authenticated remote attacker with a low-privilege user account to manipulate a symbolic link that is later followed by a privileged file operation, achieving high confidentiality, integrity, and availability impact (CVSS 8.7). This is a credible, elevated-priority issue for environments running the Virtualization Station (QKVM) add-on, though not a drop-everything emergency; exploitation requires the app to be installed and the attacker to hold a valid low-privilege account, and no public exploit code or active exploitation (KEV) has been identified at time of analysis. Upgrade to 4.1.1.130 or later to remediate.
Unauthenticated arbitrary file read in Gitingest 0.3.1 and earlier allows remote attackers to retrieve any file readable by the service account, in chunks capped at 10 MB per request, by committing a symbolic link into a public repository and submitting that symlink's blob URL to the single-file ingestion path in ingest_query. The server resolves the link and returns the target file's contents instead of confining reads to in-repo content, so a network-reachable instance that accepts untrusted repository or blob URLs - the default mode for both the hosted service and self-hosted deployments - is directly exposed with no credentials or user interaction required. There is no CISA KEV listing and no public exploit identified at time of analysis, though a public technical writeup describing the symlink technique accompanies the VulnCheck advisory; impact is bounded by the service account's file permissions and the 10 MB per-request cap.
Arbitrary file write outside the intended extraction directory is possible in BusyBox's dpkg-deb applet because its ar archive handler flushes deferred symlinks after every archive member rather than once after the final member. A crafted .deb containing two data.tar members - the first declaring a symlink to an absolute path such as '/', the second declaring a regular file whose path traverses that now-live link - causes a file to be written at an attacker-chosen location when the package is unpacked (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-59). Affected systems are BusyBox builds compiled with dpkg-deb support, including BusyBox shipped inside Red Hat Hardened Images; the CVSS vector indicates no privileges are required by the attacker (PR:N) but the victim must interact by extracting the untrusted package, and the vector's local attack value plus the non-trivial two-member structure keep this a context-dependent integrity issue rather than a mass-exploitation emergency. No public exploit identified at time of analysis.
Local privilege escalation in the Microsoft Windows Search component lets an attacker who already holds low-privilege authenticated access to a Windows host escalate to SYSTEM-level privileges by abusing improper symbolic-link/junction resolution (CWE-59) during a file-access operation. Affected builds span the Windows 10, Windows 11, and Windows Server families (including Server Core installations), as catalogued by ENISA EUVD-2026-100240; the flaw is rated CVSS 7.8 with high confidentiality, integrity, and availability impact, and exploitation requires no user interaction. No public exploit has been identified at time of analysis, CISA SSVC reports exploitation as none and automatable as no, and Microsoft has released vendor patches, so risk is best characterized as a genuine but second-tier priority that is fully addressed by applying the fixed builds.
Local privilege escalation in Microsoft's Windows WalletService allows an authenticated local attacker (CVSS PR:L, AV:L) to redirect a privileged file operation through an attacker-planted symbolic link, junction, or hard link, yielding high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The root cause is CWE-59 improper link resolution: the service does not re-validate the final target after resolving a path, so a low-privilege process that can write to a directory the service touches can point it at a protected file. All unpatched Windows 10, Windows 11 21H2 through 26H2, and Windows Server 2016, 2019, 2022, and 2025 builds listed in EUVD-2026-100211 are affected; Microsoft has published fixes, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC rates the flaw non-automatable because successful exploitation requires a local foothold plus a manual link-resolution race.
Local privilege escalation in the .NET runtime (8.0, 9.0, 10.0, and 11.0 preview) and in Visual Studio 2022 17.14 and Visual Studio 2026 18.10, which ship affected runtime builds, allows an authenticated local attacker to gain higher-privileged file access or code execution by crafting a symbolic or hard link that a more privileged .NET or IDE process later resolves. Exploitation requires prior low-privileged local access to the host and typically depends on winning a timing/race condition against a privileged process (CISA SSVC Automatable: no), which confines realistic risk to developer workstations, build servers, and CI agents rather than general end-user endpoints. The issue scores 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with total technical impact, no public exploit has been identified at time of analysis, and vendor-released patches are available. This is a credible but not emergency-grade issue, best treated as routine-high patching priority rather than a drop-everything event.
Local privilege escalation in Microsoft .NET (CWE-59 link following) lets an authenticated attacker with existing low-privileged code execution escalate to higher privileges by creating symbolic links or junctions and winning a link-resolution race against a privileged .NET file operation. Affected builds include .NET 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, 11.0 before 11.0.0-rc.2, Microsoft Visual Studio 2022 17.14 before 17.14.42, and Microsoft Visual Studio 2026 18.10 before 18.10.4. No public exploit code was identified at time of analysis, and CISA SSVC rates exploitation as none, so this is a post-compromise escalation primitive rather than an initial-access vector; vendor patches are available.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker who already holds a low-privileged foothold on a Windows host win a link-following race and have the indexer perform a privileged file operation on attacker-controlled data, yielding full SYSTEM-level confidentiality, integrity, and availability impact. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 R2 through Server 2025 builds below the fixed levels documented by EUVD; exploitation requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no victim interaction. All exploitation signals are currently quiet - no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and a vendor patch is available, so this is a credible but not emergency-level priority.
Local privilege escalation in the Windows Portable Device Enumerator Service (WPDBusEnum) allows an authenticated, low-privileged user on an affected Windows host to redirect a privileged file-system operation and elevate to a higher-integrity context, with high confidentiality, integrity and availability impact (CVSS 7.8, CWE-59 link following). Exploitation is strictly local (AV:L, PR:L, UI:N) and hinges on planting a symbolic link or junction so that a privileged file operation follows it - typically requiring a race to be won, which is why CISA's SSVC rates the issue non-automatable with exploitation observed as none. Microsoft has published a remediating update, and no public exploit identified at time of analysis; no confirmed actively exploited (CISA KEV) status is associated with this issue.
Local privilege escalation in the Windows Host Guardian Service component allows an authenticated low-privileged user on an affected Windows build to redirect a privileged file operation and obtain elevated, SYSTEM-level rights, with full impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). The root cause is a link-following weakness (CWE-59): the attacker must already hold a local, authenticated session and be able to create or control symbolic links or junctions that a higher-privileged process then follows. No user interaction is required, CISA's SSVC assessment rates the issue non-automatable (targeted, manual exploitation rather than scalable mass abuse), and no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft has released patches for the affected Windows 10, Windows 11 and Windows Server 2019/2022/2025 builds.
Improper link resolution (CWE-59) in QNAP Virtualization Station before 4.1.1.130 allows an authenticated remote attacker with a low-privilege user account to manipulate a symbolic link that is later followed by a privileged file operation, achieving high confidentiality, integrity, and availability impact (CVSS 8.7). This is a credible, elevated-priority issue for environments running the Virtualization Station (QKVM) add-on, though not a drop-everything emergency; exploitation requires the app to be installed and the attacker to hold a valid low-privilege account, and no public exploit code or active exploitation (KEV) has been identified at time of analysis. Upgrade to 4.1.1.130 or later to remediate.
Unauthenticated arbitrary file read in Gitingest 0.3.1 and earlier allows remote attackers to retrieve any file readable by the service account, in chunks capped at 10 MB per request, by committing a symbolic link into a public repository and submitting that symlink's blob URL to the single-file ingestion path in ingest_query. The server resolves the link and returns the target file's contents instead of confining reads to in-repo content, so a network-reachable instance that accepts untrusted repository or blob URLs - the default mode for both the hosted service and self-hosted deployments - is directly exposed with no credentials or user interaction required. There is no CISA KEV listing and no public exploit identified at time of analysis, though a public technical writeup describing the symlink technique accompanies the VulnCheck advisory; impact is bounded by the service account's file permissions and the 10 MB per-request cap.
Arbitrary file write outside the intended extraction directory is possible in BusyBox's dpkg-deb applet because its ar archive handler flushes deferred symlinks after every archive member rather than once after the final member. A crafted .deb containing two data.tar members - the first declaring a symlink to an absolute path such as '/', the second declaring a regular file whose path traverses that now-live link - causes a file to be written at an attacker-chosen location when the package is unpacked (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-59). Affected systems are BusyBox builds compiled with dpkg-deb support, including BusyBox shipped inside Red Hat Hardened Images; the CVSS vector indicates no privileges are required by the attacker (PR:N) but the victim must interact by extracting the untrusted package, and the vector's local attack value plus the non-trivial two-member structure keep this a context-dependent integrity issue rather than a mass-exploitation emergency. No public exploit identified at time of analysis.
Local privilege escalation in the Microsoft Windows Search component lets an attacker who already holds low-privilege authenticated access to a Windows host escalate to SYSTEM-level privileges by abusing improper symbolic-link/junction resolution (CWE-59) during a file-access operation. Affected builds span the Windows 10, Windows 11, and Windows Server families (including Server Core installations), as catalogued by ENISA EUVD-2026-100240; the flaw is rated CVSS 7.8 with high confidentiality, integrity, and availability impact, and exploitation requires no user interaction. No public exploit has been identified at time of analysis, CISA SSVC reports exploitation as none and automatable as no, and Microsoft has released vendor patches, so risk is best characterized as a genuine but second-tier priority that is fully addressed by applying the fixed builds.
Local privilege escalation in Microsoft's Windows WalletService allows an authenticated local attacker (CVSS PR:L, AV:L) to redirect a privileged file operation through an attacker-planted symbolic link, junction, or hard link, yielding high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The root cause is CWE-59 improper link resolution: the service does not re-validate the final target after resolving a path, so a low-privilege process that can write to a directory the service touches can point it at a protected file. All unpatched Windows 10, Windows 11 21H2 through 26H2, and Windows Server 2016, 2019, 2022, and 2025 builds listed in EUVD-2026-100211 are affected; Microsoft has published fixes, no public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC rates the flaw non-automatable because successful exploitation requires a local foothold plus a manual link-resolution race.
Local privilege escalation in the .NET runtime (8.0, 9.0, 10.0, and 11.0 preview) and in Visual Studio 2022 17.14 and Visual Studio 2026 18.10, which ship affected runtime builds, allows an authenticated local attacker to gain higher-privileged file access or code execution by crafting a symbolic or hard link that a more privileged .NET or IDE process later resolves. Exploitation requires prior low-privileged local access to the host and typically depends on winning a timing/race condition against a privileged process (CISA SSVC Automatable: no), which confines realistic risk to developer workstations, build servers, and CI agents rather than general end-user endpoints. The issue scores 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with total technical impact, no public exploit has been identified at time of analysis, and vendor-released patches are available. This is a credible but not emergency-grade issue, best treated as routine-high patching priority rather than a drop-everything event.
Local privilege escalation in Microsoft .NET (CWE-59 link following) lets an authenticated attacker with existing low-privileged code execution escalate to higher privileges by creating symbolic links or junctions and winning a link-resolution race against a privileged .NET file operation. Affected builds include .NET 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, 11.0 before 11.0.0-rc.2, Microsoft Visual Studio 2022 17.14 before 17.14.42, and Microsoft Visual Studio 2026 18.10 before 18.10.4. No public exploit code was identified at time of analysis, and CISA SSVC rates exploitation as none, so this is a post-compromise escalation primitive rather than an initial-access vector; vendor patches are available.
Local privilege escalation in the Microsoft Windows Search component lets an authenticated attacker who already holds a low-privileged foothold on a Windows host win a link-following race and have the indexer perform a privileged file operation on attacker-controlled data, yielding full SYSTEM-level confidentiality, integrity, and availability impact. Affected platforms span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2012 R2 through Server 2025 builds below the fixed levels documented by EUVD; exploitation requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and no victim interaction. All exploitation signals are currently quiet - no public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and a vendor patch is available, so this is a credible but not emergency-level priority.
Local privilege escalation in the Windows Portable Device Enumerator Service (WPDBusEnum) allows an authenticated, low-privileged user on an affected Windows host to redirect a privileged file-system operation and elevate to a higher-integrity context, with high confidentiality, integrity and availability impact (CVSS 7.8, CWE-59 link following). Exploitation is strictly local (AV:L, PR:L, UI:N) and hinges on planting a symbolic link or junction so that a privileged file operation follows it - typically requiring a race to be won, which is why CISA's SSVC rates the issue non-automatable with exploitation observed as none. Microsoft has published a remediating update, and no public exploit identified at time of analysis; no confirmed actively exploited (CISA KEV) status is associated with this issue.
Local privilege escalation in the Windows Host Guardian Service component allows an authenticated low-privileged user on an affected Windows build to redirect a privileged file operation and obtain elevated, SYSTEM-level rights, with full impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). The root cause is a link-following weakness (CWE-59): the attacker must already hold a local, authenticated session and be able to create or control symbolic links or junctions that a higher-privileged process then follows. No user interaction is required, CISA's SSVC assessment rates the issue non-automatable (targeted, manual exploitation rather than scalable mass abuse), and no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft has released patches for the affected Windows 10, Windows 11 and Windows Server 2019/2022/2025 builds.