ROOT-APP-NPM-CVE-2026-23950 CVE-2026-23950 in tar - Patched by Root

Root has patched CVE-2026-23950 in the tar package for Root:npm. Multiple fixed versions available...

linux-sgx security update

An update is available for linux-sgx. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Intel SGX SDK is a collection of APIs, libraries, documentations and...

Important: Red Hat Security Advisory: linux-sgx security update

An update for linux-sgx is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tar-6.2.1.tgz

Summary IBM Watson Discovery Cartridge affected by vulnerability in tar-6.2.1.tgz Vulnerability Details CVEID:CVE-2026-23950 DESCRIPTION: node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses tar-7.5.2.tgz which is vulnerable to CVE-2026-23950

Summary IBM Maximo Application Suite - Visual Inspection component uses tar-7.5.2.tgz which is vulnerable to CVE-2026-23950. This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-23950 DESCRIPTION: node-tar,a Tar for Node.js, has ...

Fedora 43 : linux-sgx (2026-a84e0ad039)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a84e0ad039 advisory. Update nodejs modules used by pccs daemon for CVE-2026-23745, CVE-2026-23950, CVE-2026-24842, CVE-2025-13465, CVE-2025-15284. Remove Fedora override...

CVE-2026-23950 vulnerabilities

Vulnerabilities for packages: lerna, kubeflow-katib, node-gyp, renovate, pulumi, opensearch-dashboards, pnpm-stage0, py3-jupyterlab, prism, kubeflow-centraldashboard, sqlpad, saf, tileserver-gl, kubeflow-pipelines, vitess, code-server...

CVE-2026-23950 vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, pnpm-stage0, kibana, vitess, graalvm, opensearch-dashboards-fips, wazuh-dashboard-fips, tileserver-gl, code-server, actions-runner, tensorflow-cpu-jupyter, sqlpad, drupal, redisinsight, gitlab-rails-ce, pulumi, kubeflow-pipelines, lerna,...

@adenta/cms (>=0.0.6, <=1.1.1-0), @adobe/helix-deploy (>=11.0.19, <=11.1.15) +321 more potentially affected by CVE-2026-23950 via tar (>=7.0.0, <=7.5.3)

tar NPM version =7.0.0, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =0.1.1, =0.1.1, =2.17.11, =1.9.5, =8.8.3, =0.0.2, =0.0.22 and more Source cves: CVE-2026-23950 Source advisory: OSV:GHSA-R6Q2-HW4H-H46W...

@adenta/cms (>=0.0.6, <=1.1.1-0), @adobe/helix-deploy (>=11.0.19, <=11.1.15) +321 more potentially affected by CVE-2026-23950 via tar (>=7.0.0, <=7.5.3)

tar NPM version =7.0.0, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =0.1.1, =0.1.1, =2.17.11, =1.9.5, =8.8.3, =0.0.2, =0.0.22 and more Source cves: CVE-2026-23950 Source advisory: SNYK:JS-TAR-15038581...

org.webjars.npm:canvas (>=2.5.0, <=2.6.0), org.webjars.npm:color-thief (2.2.5) +12 more potentially affected by CVE-2026-23950 via org.webjars.npm:tar (>=0.1.20, <=4.4.19)

org.webjars.npm:tar MAVEN version =0.1.20, =2.5.0, =0.97.5, =0.2.0, =3.4.0, =0.6.19, =2.0.0, =3.1.4, =3.4.1 - org.webjars.npm:tar.gz 1.0.7 Source cves: CVE-2026-23950 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15038582...

CVE-2026-23950

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the path-reservations system. On case-insensitive or normalization-insensitive filesystems such as macOS APFS, In which it has...

CVE-2025-23950

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ezmarketing EZPlayer ezplayer allows Stored XSS.This issue affects EZPlayer: from n/a through = 1.0.10...

CVE-2025-23950

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ezmarketing EZPlayer ezplayer allows Stored XSS.This issue affects EZPlayer: from n/a through = 1.0.10...

CVE-2025-23950 WordPress EZPlayer plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ezmarketing EZPlayer ezplayer allows Stored XSS.This issue affects EZPlayer: from n/a through = 1.0.10...

CVE-2025-23950 WordPress EZPlayer plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ezmarketing EZPlayer ezplayer allows Stored XSS.This issue affects EZPlayer: from n/a through = 1.0.10...

CVE-2025-23950

Stored XSS in EZPlayer (Said Shiripour) due to improper input neutralization during web page generation. Affected EZPlayer versions: n/a through 1.0.10. Exploitation context: network access with user interaction required; impact is client-side script execution affecting confidentiality, integrity...

CVE-2024-23950

Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the...

CVE-2024-23950

The CVE-2024-23950 entry applies to libigl v2.5.0, where the readMSH functionality is affected. Specifically, the vulnerability lies in igl::MshLoader::parse_element_field while processing a binary .msh file, leading to an out-of-bounds write due to improper array index validation. The issue is t...

CVE-2024-23950

Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0. A specially crafted .msh file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the...