3227 matches found
CVE-2026-102514 Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive
Out-of-bounds Write CWE-787 in the PEA archive extraction routine pea.pas, unpeaprocedure of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While...
CVE-2026-102514 Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive
Out-of-bounds Write CWE-787 in the PEA archive extraction routine pea.pas, unpeaprocedure of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While...
esco-skill-extractor (>=0.1.9, <=0.1.10), graphreader (0.0.1) +2 more potentially affected by CVE-2026-68770 via sentence-transformers (3.2.0)
sentence-transformers PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - esco-skill-extractor =0.1.9, =0.1.10, =0.1.11 - openexcept 0.1.0 Source cves: CVE-2026-68770 Source advisory:...
CLEANSTART-2023-UR27020 autoar-extractor
Security vulnerability affects the gnome-autoar package. autoar-extractor...
SAGE: Similarity-Based Cleaning of Poisoned Training Data from Verified Examples
As machine learning increasingly relies on public, untrusted data sources, data poisoning attacks, which inject malicious examples into training data to induce misclassification of a chosen target, pose a growing threat. Existing defenses either assume zero ground-truth information about which...
A Hybrid Approach to Malware Detection: Integrating Few-Shot Model-Agnostic Meta-Learning with Autoencoders
Ransomware has emerged as a major cybersecurity threat, with incidents increasing in frequency and impact across critical sectors. These attacks are typically launched through phishing emails, malicious downloads, or exploitation of software vulnerabilities to gain system access. Once inside, the...
CVE-2026-102252
A flaw was found in OSV-SCALIBR. This vulnerability allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning a crafted Virtual Machine Disk VMDK image, insufficient validation of archive path entries in the embedded filesystem extractor allows...
CVE-2026-102252
A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...
CVE-2026-102252 Path Traversal in VMDK Extractor in OSV-SCALIBR
A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...
CVE-2026-102252
A path traversal vulnerability (CWE-22) exists in the embedded VMDK filesystem extractor within Google OSV-SCALIBR versions 0.3.6 through 0.5.0 . The root cause is insufficient validation of archive path entries , which enables an attacker controlling the scan target to extract files outside of t...
EUVD-2026-89370
A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...
CVE-2026-102252 Path Traversal in VMDK Extractor in OSV-SCALIBR
A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...
CVE-2026-102252 Path Traversal in VMDK Extractor in OSV-SCALIBR
A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...
argostranslate (>=1.4.0, <=1.9.5), audim (>=0.0.6, <=0.0.7) +64 more potentially affected by CVE-2026-102567 via ctranslate2 (>=1.20.1, <=4.7.2)
ctranslate2 PYPI version =1.20.1, =1.4.0, =0.0.6, =0.2.1, =2.1.0, =0.0.1, =1.4.0, =0.0.9, =0.1.0, =0.2.0, =0.3.1, =0.0.15, =0.0.30 and more Source cves: CVE-2026-102567 Source advisory: MEND:CVE-2026-102567...
PT-2026-102831
A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...
CVE-2026-102252: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...
CVE-2026-76805 Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...
EUVD-2026-82426
rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...
CVE-2026-88069 Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis
Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...