Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-56857
Critical · 9.8
CWE-1386 Oct 8, 2026
Root.Mkdir(All) can follow junctions out of the root on Windows in os
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).
CVE-2025-64391
Medium · 4.1
CWE-1386 Oct 7, 2026
This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local…
This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it.
CVE-2026-41116
Medium · 6.3
CWE-1386 Jun 9, 2026
Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link…
Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary File Write.
CVE-2025-58074
High · 8.8
CWE-1386 May 4, 2026
Privilege escalation during the installation of Norton Secure VPN via the Microsoft Store
A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A low-privilege user can replace files during the installation process, which may result in deletion of arbitrary files that can lead to elevation of privileges.