MAL-2026-11094 Malicious code in cfgzen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a904eba641878bae63f76595a468b0faaa66fd27104ac557249e457f005c3fb1 The package installs a site-wide cfgzen.pth containing import dotcfg, which Python's site machinery executes automatically at every interpreter start...

CVE-2026-43772

A path traversal issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to break out of its sandbox...

CVE-2026-65921

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...

CVE-2026-43772

A path traversal issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to break out of its sandbox...

CVE-2026-43772

A path traversal issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to break out of its sandbox...

EUVD-2026-49489

A path traversal issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to break out of its sandbox...

CVE-2026-43772

A path traversal issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to break out of its sandbox...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC [CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring MVC or WebFlux CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846. Spring MVC is used as part of our microservices. These vulnerabilities have been addressed. Please read the detail...

CVE-2026-65921

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...

CVE-2026-65921 Potential path traversal leading to unauthorized file writes

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...

CVE-2026-65921

Technical details, including affected product/version, root cause, and remediation, are not publicly available in the provided documents; monitor for updates.

CVE-2026-65921 Potential path traversal leading to unauthorized file writes

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...

CVE-2026-45623

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

GO-2026-5750 Ollama is Vulnerable to Path Traversal in github.com/ollama/ollama

Ollama is Vulnerable to Path Traversal in github.com/ollama/ollama...

CVE-2026-66397

phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existingimage field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete. Attackers can delete the database.php configuration file to...

DEBIAN-CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

UBUNTU-CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview org.webjars.npm:unzipper is a library for the Uzip cross-platform streaming AP.I Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip in the extraction path validation in lib/extract.js and lib/Open/directory.js, which check only that t...