GHSA-W75W-9QV4-J5XJ dbt-common's commonprefix() doesn't protect against path traversal

Impact What kind of vulnerability is it? Who is impacted? A path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that extracted files remain within the intended destination directory...

PT-2026-23610

Name of the Vulnerable Software and Affected Versions dbt-common versions prior to 1.34.2 dbt-common versions prior to 1.37.3 Description A path traversal issue exists in the safe extract function of dbt-common when extracting tarball archives. The function uses os.path.commonprefix to validate...

CVE-2019-25501

creationtimestamp| type| source ---|---|--- 2026-03-04 17:58:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgaucwyvbu2n 2026-03-06 05:40:10+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mgelybklex2w...

CLSA-2026-1772454796 zlib: Fix of CVE-2016-9843

CVE-2016-9843: avoid pre-decrement of pointer in big-endian CRC calculation...

CVE-2026-2746

creationtimestamp| type| source ---|---|--- 2026-03-04 12:16:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgab6gkioa27...

CVE-2026-29120

creationtimestamp| type| source ---|---|--- 2026-03-04 09:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116170085409421373 2026-03-04 09:00:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mg7waokems2w 2026-03-04 09:53:45+00:00| seen|...

Malicious code in @vk-cloud-billing/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b5a4d83fe25260e7b73b7d40a2d8827f8ebe841ace75e3f03140b4861eb836 The package @vk-cloud-billing/common was found to contain malicious code. Source: ghsa-malware...

org.apache.ranger:conditions-enrichers (1.2.0), org.apache.ranger:embeddedwebserver (1.2.0) +25 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (1.2.0)

org.apache.ranger:ranger-plugins-common MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - org.apache.ranger:conditions-enrichers 1.2.0 - org.apache.ranger:embeddedwebserve...

org.apache.nifi.registry:nifi-registry-ranger-assembly (>=0.3.0, <=0.5.0), org.apache.nifi.registry:nifi-registry-ranger-plugin (>=0.3.0, <=0.5.0) +26 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (1.1.0)

org.apache.ranger:ranger-plugins-common MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - org.apache.nifi.registry:nifi-registry-ranger-assembly =0.3.0, =0.3.0, =0.5.0 -...

org.apache.nifi:nifi-ranger-nar (>=1.1.0, <=1.3.0), org.apache.nifi:nifi-ranger-plugin (>=1.1.0, <=1.3.0) +23 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (0.6.0)

org.apache.ranger:ranger-plugins-common MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - org.apache.nifi:nifi-ranger-nar =1.1.0, =1.1.0, =1.3.0 -...

org.apache.nifi:nifi-ranger-nar (>=1.4.0, <=1.7.1), org.apache.nifi:nifi-ranger-plugin (>=1.4.0, <=1.7.1) +23 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (0.7.1)

org.apache.ranger:ranger-plugins-common MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - org.apache.nifi:nifi-ranger-nar =1.4.0, =1.4.0, =1.7.1 -...

com.expediagroup.apiary:apiary-ranger-metastore-plugin (>=7.2.1, <=8.2.7), com.witboost.provisioning:scala-mesh-ranger_2.13 (1.0.0) +64 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (>=2.0.0, <=2.7.0)

org.apache.ranger:ranger-plugins-common MAVEN version =2.0.0, =7.2.1, =0.8.44-4rc1, =466, =0.6.0-incubating, =0.8.0-incubating, =1.6.0-incubating, =1.6.0-incubating, =0.7.0, =0.7.0, =1.11.0, =1.11.0, =2.0.0, =1.3.0, =1.3.0, =2.0.0 and more Source cves: CVE-2025-59059 Source advisory:...

org.apache.ranger:conditions-enrichers (0.6.2), org.apache.ranger:embeddedwebserver (0.6.2) +21 more potentially affected by CVE-2025-59059 via org.apache.ranger:ranger-plugins-common (0.6.2)

org.apache.ranger:ranger-plugins-common MAVEN version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.ranger:ranger-plugins-common and may be impacted: - org.apache.ranger:conditions-enrichers 0.6.2 - org.apache.ranger:embeddedwebserve...

BIT-KIBANA-2026-26937 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in the Timelion component in Kibana can lead Denial of Service via Input Data Manipulation CAPEC-153...

@oneuptime/cli (>=10.0.5, <=10.0.11) potentially affected by CVE-2026-28787 via @oneuptime/common (>=10.0.5, <=10.0.11)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.11 Source cves: CVE-2026-28787 Source advisory: OSV:GHSA-GJJC-PCWP-C74M...

@oneuptime/cli (>=10.0.5, <=10.0.14) potentially affected by CVE-2026-28787 via @oneuptime/common (>=10.0.5, <=10.0.14)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.14 Source cves: CVE-2026-28787 Source advisory: SNYK:JS-ONEUPTIMECOMMON-15369565...

@oneuptime/cli (>=10.0.5, <=10.0.11) potentially affected by CVE-2026-28787 via @oneuptime/common (>=10.0.5, <=10.0.11)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.11 Source cves: CVE-2026-28787 Source advisory: GHSA-GJJC-PCWP-C74M...

DEBIAN-CVE-2026-27631

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an uncaught exception was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra...

CVE-2025-50187

creationtimestamp| type| source ---|---|--- 2026-03-02 16:00:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3mrteptp2k 2026-03-02 18:15:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3udbmqow2u 2026-03-03 20:00:16+00:00| seen|...

SIP Service Providers – Possible Impersonation of Poly Voice Device

An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools. This extracted certificate could be accepted by a SIP service provider if the service provider does not perform proper validation of the device certificate. Service...