Lucene search
+L

1388 matches found

RedhatCVE
RedhatCVE
added 2026/03/26 3:12 p.m.16 views

CVE-2026-3849

Stack Buffer Overflow in wcHpkeLabeledExtract via Oversized ECH Config. A vulnerability existed in wolfSSL 5.8.4 ECH Encrypted Client Hello support, where a maliciously crafted ECH config could cause a stack buffer overflow on the client side, leading to potential remote execution and client...

9.8CVSS6.2AI score0.00444EPSS
SaveExploits0References1
Veracode
Veracode
added 2026/03/26 11:22 a.m.10 views

Denial Of Service (DoS)

github.com/sigstore/fulcio is vulnerable to Denial of Service DoS. The vulnerability is due to inefficient handling of untrusted input in the extractIssuerURL function, which allows an attacker to supply a token with excessive period characters to trigger high memory allocations and degrade servi...

7.5CVSS6.8AI score0.00191EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2026/03/25 9:30 p.m.14 views

pf4j is vulnerable to Path Traversal or Zip Slip attack through improper handling of zip entry names

pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...

7.5CVSS5.9AI score0.00856EPSS
SaveExploits1References6Affected Software1
EUVD
EUVD
added 2026/03/25 9:30 p.m.7 views

EUVD-2025-209006

pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...

5.8AI score0.00856EPSS
SaveExploits1References5
OSV
OSV
added 2026/03/25 9:30 p.m.6 views

GHSA-5458-7HH9-V7P4 pf4j is vulnerable to Path Traversal or Zip Slip attack through improper handling of zip entry names

pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...

8.7CVSS5.9AI score0.00856EPSS
SaveExploits1References6
NVD
NVD
added 2026/03/25 7:16 p.m.8 views

CVE-2025-70952

pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...

7.5CVSS0.00856EPSS
SaveExploits1References4
UbuntuCve
UbuntuCve
added 2026/03/25 7:16 p.m.6 views

CVE-2025-70952

pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...

7.5CVSS5.9AI score0.00856EPSS
SaveExploits1References5
OSV
OSV
added 2026/03/25 7:16 p.m.6 views

UBUNTU-CVE-2025-70952

pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...

7.5CVSS5.8AI score0.00856EPSS
SaveExploits1References6
OSV
OSV
added 2026/03/25 5:16 p.m.4 views

PYSEC-2026-2275

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker...

5.5CVSS6.1AI score0.00182EPSS
SaveExploits0References3
OSV
OSV
added 2026/03/25 5:16 p.m.10 views

UBUNTU-CVE-2026-25645

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker...

5.5CVSS5.8AI score0.00182EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/03/25 5:2 p.m.4 views

CVE-2026-25645

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker...

4.4CVSS5.8AI score0.00182EPSS
SaveExploits0References4Affected Software1
Vulnrichment
Vulnrichment
added 2026/03/25 5:2 p.m.28 views

CVE-2026-25645 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker...

4.4CVSS5.8AI score0.00182EPSS
SaveExploits0References3
Debian CVE
Debian CVE
added 2026/03/25 5:2 p.m.8 views

CVE-2026-25645

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker...

5.5CVSS4.5AI score0.00182EPSS
SaveExploits0
CVE
CVE
added 2026/03/25 5:2 p.m.831 views

CVE-2026-25645

The CVE describes an insecure temp-file extraction in the Requests library prior to v2.33.0. The vulnerable function requests.utils.extract_zipped_paths() writes the CA bundle into /tmp using a predictable, non-unique filename (e.g., cacert.pem) and reuses an existing file if present, rather than...

5.5CVSS5.8AI score0.00182EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 2026/03/25 5:2 p.m.28 views

CVE-2026-25645 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker...

4.4CVSS0.00182EPSS
SaveExploits0References3
OSV
OSV
added 2026/03/25 5:2 p.m.5 views

CVE-2026-25645 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker...

4.4CVSS5.9AI score0.00182EPSS
SaveExploits0References5
Snyk
Snyk
added 2026/03/25 4:56 p.m.2 views

Insecure Temporary File

Overview Affected versions of this package are vulnerable to Insecure Temporary File via the extractzippedpaths function. An attacker can leverage unauthorized file replacement by pre-creating a malicious file in the system's temporary directory prior to extraction. Note: Only applications that...

5.5CVSS5.9AI score0.00182EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/03/25 4:56 p.m.8 views

EUVD-2026-15754

Requests has Insecure Temp File Reuse in its extractzippedpaths utility function...

4.4CVSS5.8AI score0.00182EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/03/25 4:56 p.m.6 views

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

Impact The requests.utils.extractzippedpaths utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could...

5.5CVSS5.8AI score0.00182EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/03/25 4:56 p.m.7 views

GHSA-GC5V-M9X4-R6X2 Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

Impact The requests.utils.extractzippedpaths utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could...

4.4CVSS5.8AI score0.00182EPSS
SaveExploits0References5
Rows per page
Query Builder