Security Bulletin: IBM Maximo Application Suite - Monitor component uses multiple third-party libraries that are vulnerable to several security vulnerabilities.

Summary IBM Maximo Application Suite - Monitor component uses multiple third-party libraries that are vulnerable to several security vulnerabilities. The CVE details are listed below. This bulletin provides information about the affected components and the remediation for these vulnerabilities...

Security Bulletin: Vulnerability in adm-zip affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in adm-zip has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabili...

adm-zip_LPE-PoC

CVE-2026-102282: adm-zip Local Privilege Escalation via SUID Preservation Description adm-zip is an established, pure-JavaScript ZIP archive library for Node.js with over 20 million weekly downloads across the npm ecosystem. It is widely integrated into CI/CD pipelines, container build workflows,...

POC-CVE-2026-102282

CVE-2026-102282 — adm-zip setuid/setgid preservation during extraction Incorrect permission assignment in the npm package adm-zip. Extraction can keep setuid, setgid, and sticky bits from an untrusted zip when keepOriginalPermission is enabled, allowing a root-owned setuid executable to be plante...

CLEANSTART-2026-OQ97884 adm-zip before 0

Security vulnerability affects the sqlpad package. adm-zip before 0...

Security Bulletin: Security Vulnerabilities have been found in IBM Sovereign Core

Summary Security Vulnerabilities have been addressed in IBM Sovereign Core Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION: brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding ...

CLEANSTART-2026-GW41768 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node

Security vulnerability affects the renovate package. adm-zip is a JavaScript library for creating and extracting ZIP archives in Node...

CLEANSTART-2026-MM77502 adm-zip before 0

Security vulnerability affects the renovate package. adm-zip before 0...

CLEANSTART-2026-UF90597 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node

Security vulnerability affects the renovate package. adm-zip is a JavaScript library for creating and extracting ZIP archives in Node...

CLEANSTART-2026-LS57288 adm-zip 0

Security vulnerability affects the renovate package. adm-zip 0...

SUSE CVE-2026-116137

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

CLSA-2026-1793281815 TuxCare security update for adm-zip (2 CVEs)

TuxCare rebuilt adm-zip to address 2 CVEs. Fixed in 0.5.18-tuxcare.8...

Interpretation Conflict

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Interpretation Conflict via canonically equivalent ZIP entry names e.g., ./hello.txt and hello.txt, which causes readEntries to treat them as distinct entries...

0.extends.whistle (1.0.65), 0g-aura (>=0.1.0, <=0.4.31) +20077 more potentially affected by CVE-2026-116137 via adm-zip (>=0.1.4, <=0.6.1)

adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.2 and more Source cves: CVE-2026-116137 Source advisory: SNYK:JS-ADMZIP-21707815...

CVE-2026-116137

A flaw was found in adm-zip. A remote attacker can exploit this issue by providing a specially crafted ZIP archive containing duplicate entries with equivalent path names to bypass validation checks. Consequently, an application may inspect benign file content during validation but write maliciou...

CVE-2026-116137

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

CVE-2026-116137 adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

CVE-2026-116137 adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

CVE-2026-116137

The adm-zip library (through version 0.6.1 ) is vulnerable to a duplicate-entry validation bypass (CWE-436). The root cause is the failure to recognize canonically equivalent names , such as ./hello.txt and hello.txt, during validation. Attackers can craft ZIP archives where functions like getEnt...

CVE-2026-116137

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...