https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:50:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292613 EUVD-2026-292613 https://cve.radiocsirt.org/vuln/euvd-2026-292613 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35359 <p>A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.</p> <p>A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-35359 https://cve.radiocsirt.org/vuln/ghsa-hpfw-mqm3-33jh <p><strong>Affected:</strong> crates.io: coreutils</p> <p>A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.</p> <p><strong>Affected:</strong> crates.io: coreutils</p> <p>A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.</p> https://cve.radiocsirt.org/vuln/ghsa-hpfw-mqm3-33jh https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-35359 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-coreutils, Ubuntu:25.10: rust-coreutils, Ubuntu:26.04:LTS: rust-coreutils</p> <p>A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-coreutils, Ubuntu:25.10: rust-coreutils, Ubuntu:26.04:LTS: rust-coreutils</p> <p>A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-35359