937 matches found
CVE-2026-73327
The Initial Description states "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Joomla is a CNA in scope." This CVE ID is rejected/not used and does not represent an active vulnerability entry.
CVE-2026-70427
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction...
CVE-2026-63133
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...
CVE-2026-63134
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...
CVE-2026-63134 Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...
CVE-2026-63134 Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...
CVE-2026-63134
Malcolm (network traffic analysis tool) is affected by a path-traversal vulnerability in the archive extraction code prior to v26.07.0. safe-extract.py uses libarchive secure flags but creates directories with os.makedirs(dest/entry.pathname) without traversal protection, allowing a malicious arc...
CVE-2026-63134 Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...
EUVD-2026-56969
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...
CVE-2026-63133 Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...
CVE-2026-63133 Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...
CVE-2026-63133 Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...
CVE-2026-63133
Malcolm prior to v26.07.0 is affected by CVE-2026-63133, where safe-extract.py exposes unbounded archive extraction limits, enabling inode- and resource-exhaustion DoS in the file processing container when processing carefully crafted archives. The issue results in unbounded filesystem object cre...
CVE-2026-63133
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...
DEBIAN-CVE-2026-66485
GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a...
UBUNTU-CVE-2026-66485
GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a...
CVE-2026-66485
GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a...
EUVD-2026-55255
GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a...
CVE-2026-66485
GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a...
Security Bulletin:Vulnerability in Perl affects IBM Netezza Appliance
Summary The Perl package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-42496 Vulnerability Details CVEID:CVE-2026-42496 DESCRIPTION: Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extracti...