39 matches found
EEF-CVE-2026-103060 Path traversal in rebar3 via unvalidated dependency app names
Summary Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package...
CVE-2026-25264
Privilege escalation due to weak configuration during package extraction process...
CVE-2026-25264 Uncontrolled Search Path Element in Qualcomm Software Center
Privilege escalation due to weak configuration during package extraction process...
CVE-2026-25264
Qualcomm Software Center is affected by an uncontrolled search path element vulnerability arising from weak configuration during its package extraction process. A local user with low privileges can exploit this to escalate privileges, with changed scope and high impact on confidentiality, integri...
CVE-2026-25264 Uncontrolled Search Path Element in Qualcomm Software Center
Privilege escalation due to weak configuration during package extraction process...
EUVD-2026-84347
Privilege escalation due to weak configuration during package extraction process...
CVE-2026-25264: Uncontrolled Search Path Element
Privilege escalation due to weak configuration during package extraction process...
PT-2026-96692
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Privilege escalation is possible due to a weak configuration during the package extraction process. Recommendations At the moment, there is no information about...
CVE-2026-81727
NLTK versions before 3.10.3 are affected by a filesystem containment bypass in the Downloader.download and Downloader.incr_download methods. An attacker with write access to a shared downloader directory can create hardlinks pointing to files outside the install root, which are then overwritten d...
PYSEC-2026-3729
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
UBUNTU-CVE-2026-63310
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
CVE-2026-63310 NLTK before 3.9.3 Missing Post-Download Integrity Verification
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
CVE-2026-63310
...
EUVD-2026-64335
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
Improper Validation of Integrity Check Value
Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the tarball extraction process when the integrity field is missing from the lockfile resolution. An attacker can introduce unauthorized...
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
Impact A crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. The root cause was the...
CVE-2026-23940: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of...
PT-2026-25321
Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of...
Dart path traversal vulnerability
Dart is an open-source programming language developed by Dartmouth. Dart has a path traversal vulnerability. This vulnerability arises when the pub client extracts packages, and files from malicious package archives may be extracted to locations outside of the PUBCACHE target directory, potential...