File and Path Handling

Every one of the 40 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary…CVE-2014-4877Gnu · 40% likely

   CWE-22

2. Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write…CVE-2016-6321Gnu · CVSS 7.5 · 16% likely

   CWE-22

3. Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of t…CVE-2015-1395Gnu · 11% likely

   CWE-22

4. elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LD_AUDIT environmen…CVE-2010-3847Gnu · 10% likely

   CWE-59

5. Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.CVE-2015-2775Gnu · 7.9% likely

   CWE-22

6. GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file.CVE-2015-1196Gnu · 6.1% likely

   CWE-59

7. Directory traversal vulnerability in util.c in GNU patch 2.6.1 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a filename that is spec…CVE-2010-4651Gnu · 4.9% likely

   CWE-22

8. In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.CVE-2019-13636Gnu · 3.9% likely

   CWE-59

9. A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exi…CVE-2015-1396Gnu · 3.3% likely

   CWE-22

10. cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symlink within an RPM package archive.CVE-2010-4226Gnu · CVSS 7.2 · 2.9% likely

    CWE-59

11. elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which all…CVE-2017-16997Gnu · 2.9% likely

    CWE-426

12. Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly h…CVE-2014-0475Gnu · 2.8% likely

    CWE-22

13. GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the priva…CVE-2025-43919GNU · CVSS 5.8 · 1.4% likely

    CWE-24

14. Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1)…CVE-2014-8737Gnu · 1.0% likely

    CWE-22

15. Wget2: arbitrary file write via metalink path traversal in gnu wget2CVE-2025-69194Gnu · CVSS 8.8 · 0.8% likely

    CWE-22

16. GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contain…CVE-2025-45582GNU · CVSS 4.1 · 0.5% likely

    CWE-24

17. The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] fil…CVE-2014-2524Gnu · 0.4% likely

    CWE-59

18. vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.CVE-2008-1694Gnu · 0.4% likely

    CWE-59

19. The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain privileges via a symlink attack on a file in a directory tree under /tmp.CVE-2009-4135Gnu · 0.4% likely

    CWE-59

20. GNU Parallel before 20150422, when using (1) --pipe, (2) --tmux, (3) --cat, (4) --fifo, or (5) --compress, allows local users to write to arbitrary files via a symlink attack on a…CVE-2015-4155Gnu · 0.4% likely

    CWE-59

21. contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf#####.tmp temporary file.CVE-2009-5044Gnu · 0.4% likely

    CWE-59

22. GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files via a symlink attack on a temporary file.CVE-2015-4156Gnu · 0.4% likely

    CWE-59

23. GNU nano before 2.2.4 does not verify whether a file has been changed before it is overwritten in a file-save operation, which allows local user-assisted attackers to overwrite ar…CVE-2010-1160Gnu · 0.4% likely

    CWE-59

24. lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp.##### temporary file.CVE-2014-3424Gnu · 0.4% likely

    CWE-59

25. The (1) contrib/eqn2graph/eqn2graph.sh, (2) contrib/grap2graph/grap2graph.sh, and (3) contrib/pic2graph/pic2graph.sh scripts in GNU troff (aka groff) 1.21 and earlier do not prope…CVE-2009-5080Gnu · 0.4% likely

    CWE-59

26. lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic.##### temporary file.CVE-2014-3423Gnu · 0.4% likely

    CWE-59

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.