CLEANSTART-2026-WE84072 Security fixes in newrelic-infrastructure-bundle 3.3.31-r0

Package newrelic-infrastructure-bundle version 3.3.31-r0 fixes 1 vulnerabilities: CVE-2026-42504...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to access control errors. Exploiting this vulnerability could allow an attacker to gain full control over the...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to access control errors. Exploiting this vulnerability could allow a malicious actor to gain full control ov...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain full...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to access control errors. Exploiting this vulnerability could allow a malicious actor to gain full control ov...

github.com/sigstore/sigstore-go: sigstore-go: Signature bypass allows acceptance of bundles signed with expired keys

A flaw was found in sigstore-go, a software library used for verifying digital signatures. This vulnerability specifically affects the workflow for self-managed long-lived signing keys that do not use certificates. An attacker who possesses an expired signing key can exploit this by creating and...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to access control errors. Exploiting this vulnerability could allow an attacker to gain full control over the...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to access control errors. Exploiting this vulnerability could allow an attacker to gain full control over the...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker...

nono-cli'scregistry pack verification can fail open when provenance metadata is absent

Summary Registry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant: - /.config/nono/packages/lockfile.json - /.config/nono/packages///.nono-trust.bundle Testing shows that nono fails closed when a pack has a trust bundle b...

GHSA-HC4M-Q9JH-XW4J nono-cli'scregistry pack verification can fail open when provenance metadata is absent

Summary Registry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant: - /.config/nono/packages/lockfile.json - /.config/nono/packages///.nono-trust.bundle Testing shows that nono fails closed when a pack has a trust bundle b...

@wakaru/cli arbitrary file write during bundle unpack

Impact @wakaru/cli is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with --unpack. Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such ...

GHSA-7WPJ-VVMV-PGM8 @wakaru/cli arbitrary file write during bundle unpack

Impact @wakaru/cli is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with --unpack. Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such ...

CVE-2026-54545 @wakaru/cli arbitrary file write during bundle unpack

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...

CVE-2026-54545

CVE-2026-54545 affects the @wakaru/cli component of the Wakaru toolkit. From 1.0.0 through 1.4.0, bundle-controlled module filenames were sanitized only once before writing extracted modules. A crafted filename containing overlapping traversal sequences (e.g., ....//) can collapse to ../ after sa...

EUVD-2026-49869

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...

CVE-2026-54545 @wakaru/cli arbitrary file write during bundle unpack

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...

CVE-2026-54545 @wakaru/cli arbitrary file write during bundle unpack

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...