CVE Database

CVE-2026-88072 High · 7.8 CWE-59 Oct 13, 2026

Windows Host Guardian Service Elevation of Privilege Vulnerability

Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.

CVE-2026-85849 High · 7.8 CWE-59 Oct 13, 2026

Windows AppX Deployment Service Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

CVE-2026-85343 High · 7.8 CWE-59 Oct 13, 2026

Windows Hyper-V Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

CVE-2026-83933 Medium · 5.5 CWE-59 Oct 13, 2026

Windows Update Orchestrator Service Information Disclosure Vulnerability

Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally.

CVE-2026-83927 High · 7.8 CWE-59 Oct 13, 2026

Windows Registry Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally.

CVE-2026-83793 High · 7.0 CWE-59 Oct 13, 2026

Windows Update Orchestrator Service Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.

CVE-2026-83704 High · 7.8 CWE-59 Oct 13, 2026

Microsoft Windows Search Component Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

CVE-2026-83659 High · 7.8 CWE-59 Oct 13, 2026

Windows User Profile Service Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.

CVE-2026-83507 Medium · 5.5 CWE-59 Oct 13, 2026

Windows Update Orchestrator Service Information Disclosure Vulnerability

Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally.

CVE-2026-70264 Medium · 5.5 CWE-59 Oct 13, 2026

Microsoft Defender Information Disclosure Vulnerability

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to disclose information locally.

CVE-2026-70190 High · 7.3 CWE-59 Oct 13, 2026

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVE-2026-70165 Medium · 6.7 CWE-59 Oct 13, 2026

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVE-2026-69969 Medium · 4.7 CWE-59 Oct 13, 2026

Windows AppX Deployment Service Information Disclosure Vulnerability

Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.

CVE-2026-69673 High · 7.8 CWE-59 Oct 13, 2026

Windows Update Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.

CVE-2026-62687 Medium · 5.5 CWE-59 Oct 13, 2026

Windows Backup Engine Information Disclosure Vulnerability

Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose information locally.

CVE-2026-108135 High · 7.0 CWE-59 Oct 13, 2026

Windows Backup Engine Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

CVE-2026-102204 High · 7.8 CWE-59 Oct 13, 2026

Microsoft Microsoft Defender for Endpoint Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

CVE-2026-102202 High · 7.8 CWE-59 Oct 13, 2026

Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability

Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

CVE-2026-53562 High · 8.5 CWE-59 Oct 13, 2026

Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. ...

Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.

CVE-2026-77361 Medium · 4.7 CWE-59 Oct 13, 2026

obsidian-tc symlink path mismatch bypasses read ACL restrictions

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied folder can therefore bypass the read ACL and expose files in the denied folder. Exploitation requires an out-of-band-planted symlink and does not permit an escape from the vault root. Version 1.3.1 fixes the vulnerability by applying ACL checks to the resolved vault-relative path.

CVE-2026-109965 High · 7.1 CWE-59 Oct 13, 2026

Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root

Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.

CVE-2026-109596 Medium · 5.5 CWE-59 Oct 12, 2026

Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor

Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a symlink or NTFS junction at a virtual ancestor directory, causing resources.Match to list and publish local files during builds.

CVE-2026-109375 Medium · 6.1 CWE-59 Oct 12, 2026

Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Attackers controlling sandbox code, such as a prompt-injected coding agent, can plant symbolic or hard links in the host data directory to write arbitrary files on the orchestrator host.

CVE-2026-109274 Low · 2.5 CWE-59 Oct 12, 2026

ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script

ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files that the security policy is meant to block.

CVE-2026-105081 Low · 3.6 CWE-59 Oct 12, 2026

ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.