Filtered by CWE-59
Filtered by vendor Subscriptions
Total 1497 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-25187 1 Microsoft 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more 2026-04-14 7.8 High
Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.
CVE-2022-46869 2 Acronis, Microsoft 2 Cyber Protect Home Office, Windows 2026-04-10 7.8 High
Local privilege escalation during installation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis True Image OEM (Windows) before build 42575.
CVE-2026-34604 2 Ssw, Tina 2 Tinacms\/graphql, Tinacms 2026-04-08 7.1 High
Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containment checks in FilesystemBridge. That blocks plain ../ traversal, but it does not resolve symlink or junction targets. If a symlink/junction already exists under the allowed content root, a path like content/posts/pivot/owned.md is still considered "inside" the base even though the real filesystem target can be outside it. As a result, FilesystemBridge.get(), put(), delete(), and glob() can operate on files outside the intended root. This issue has been patched in version 2.2.2.
CVE-2026-34603 2 Ssw, Tina 2 Tinacms\/cli, Tinacms 2026-04-08 7.1 High
Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link already exists under the media root, Tina accepts a path like pivot/written-from-media.txt as "inside" the media directory and then performs real filesystem operations through that link target. This allows out-of-root media listing and write access, and the same root cause also affects delete. This issue has been patched in version 2.2.2.
CVE-2025-43257 1 Apple 1 Macos 2026-04-07 8.7 High
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.6. An app may be able to break out of its sandbox.
CVE-2025-24104 1 Apple 2 Ipados, Iphone Os 2026-04-02 5.5 Medium
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4. Restoring a maliciously crafted backup file may lead to modification of protected system files.
CVE-2024-44273 1 Apple 6 Ipados, Iphone Os, Macos and 3 more 2026-04-02 5.5 Medium
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. A malicious app may be able to access private information.
CVE-2024-44264 1 Apple 1 Macos 2026-04-02 7.5 High
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious app may be able to create symlinks to protected regions of the disk.
CVE-2024-44258 1 Apple 4 Ipados, Iphone Os, Tvos and 1 more 2026-04-02 7.1 High
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, tvOS 18.1, visionOS 2.1. Restoring a maliciously crafted backup file may lead to modification of protected system files.
CVE-2024-44178 1 Apple 1 Macos 2026-04-02 5.5 Medium
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to modify protected parts of the file system.
CVE-2024-27885 1 Apple 1 Macos 2026-04-02 6.3 Medium
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An app may be able to modify protected parts of the file system.
CVE-2024-23285 1 Apple 1 Macos 2026-04-02 7.8 High
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma 14.4. An app may be able to create symlinks to protected regions of the disk.
CVE-2024-44132 1 Apple 1 Macos 2026-04-02 8.4 High
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox.
CVE-2024-54554 1 Apple 2 Macos, Macos Sequoia 2026-04-02 5.5 Medium
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be able to access sensitive user data.
CVE-2026-20633 1 Apple 1 Macos 2026-04-02 5.5 Medium
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access user-sensitive data.
CVE-2024-44211 1 Apple 1 Macos 2026-04-02 7.5 High
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be able to access user-sensitive data.
CVE-2024-44175 1 Apple 1 Macos 2026-04-02 7.5 High
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1. An app may be able to access sensitive user data.
CVE-2026-20694 1 Apple 4 Ios And Ipados, Ipados, Iphone Os and 1 more 2026-04-02 5.5 Medium
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Sonoma 14.8.5, macOS Tahoe 26.3, macOS Tahoe 26.4. An app may be able to access user-sensitive data.
CVE-2026-28866 1 Apple 4 Ios And Ipados, Ipados, Iphone Os and 1 more 2026-04-02 6.2 Medium
This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
CVE-2024-44131 1 Apple 3 Ipados, Iphone Os, Macos 2026-04-02 5.5 Medium
This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to access sensitive user data.