Skip to content
CVE Tracker

CWE-61

194 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

All 194 in the listAtom feed of new CVEsWhat CWE-61 is, at MITRE (opens in a new tab)
Published CVEs
194
Last 12 months
108
Critical
11
Known exploited
1

Critical 11High 87Medium 86Low 10Not scored 0

CVEs per yearBy the year they were published

  1. 20181
  2. 20194
  3. 202120
  4. 20214
  5. 20223
  6. 202425
  7. 20246
  8. 202537
  9. 202694

Known exploitedNewest addition to KEV first

  • CVE-2026-54420

    LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell…

    LiteSpeed Technologies · cPanel Plugin

    ExploitedHigh8.5

Newest CVEs

  • CVE-2026-121520

    Malicious client could set xattr value outside of BuildKit state directory

    Moby · BuildKit

    Medium4.5
  • CVE-2026-65109

    NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on…

    NVIDIA · Slurm

    Medium4.7
  • CVE-2026-119336

    Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink

    pi-hole · pi-hole

    High7.8
  • CVE-2026-118688

    Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename

    bytecodealliance · wasmtime

    High8.8
  • CVE-2026-115908

    zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)

    zip-rs · zip2

    High7.4
  • CVE-2026-115424

    Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination

    Red Hat · Red Hat OpenShift Container Platform 4

    Medium5.5
  • CVE-2026-115392

    Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes

    bytecodealliance · wasmtime

    High8.8
  • CVE-2026-102740

    AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink

    AsyncHttpClient · async-http-client

    Medium5.8
  • CVE-2026-50612

    Import Symlink Following Remote Code Execution Vulnerability in QuMagie

    QNAP Systems Inc. · QuMagie

    Critical9.4
  • CVE-2026-41541

    Symlink creation in qsyncsrv.cgi

    QNAP Systems Inc. · Qsync Central

    Medium5.3

Vendors it comes up for most

  1. Dell14
  2. Canonical10
  3. Red Hat9
  4. openSUSE6
  5. Apple5
  6. Cisco5
  7. Flatpak5
  8. SUSE5
  9. opencontainers5
  10. AWS3