RUSTSEC-2026-0307 `uncbv`: archive extraction is vulnerable to path traversal (zip-slip)

Summary uncbv extract writes each archive entry to outputdir.joinentryfilename using the filename stored in the archive with no check for .. components or absolute paths. A malicious .cbv / .cbz archive whose entry name contains ../ or an absolute path can therefore cause files to be written...

`uncbv`: archive extraction is vulnerable to path traversal (zip-slip)

Summary uncbv extract writes each archive entry to outputdir.joinentryfilename using the filename stored in the archive with no check for .. components or absolute paths. A malicious .cbv / .cbz archive whose entry name contains ../ or an absolute path can therefore cause files to be written...

PT-2026-105970

Summary uncbv extract writes each archive entry to output dir.joinentry filename using the filename stored in the archive with no check for .. components or absolute paths. A malicious .cbv / .cbz archive whose entry name contains ../ or an absolute path can therefore cause files to be written...

RUSTSEC-2026-0296 `unzip` is unmaintained

The unzip crate has only ever released a single version, 0.1.0 published 2017-12-23, and has seen no further activity. It appears to be unmaintained, and its known path-traversal "zip-slip" vulnerability will not be fixed. Consider migrating to an actively maintained alternative such as zip...

`unzip` is unmaintained

The unzip crate has only ever released a single version, 0.1.0 published 2017-12-23, and has seen no further activity. It appears to be unmaintained, and its known path-traversal "zip-slip" vulnerability will not be fixed. Consider migrating to an actively maintained alternative such as zip...

PT-2026-105965

The unzip crate has only ever released a single version, 0.1.0 published 2017-12-23, and has seen no further activity. It appears to be unmaintained, and its known path-traversal "zip-slip" vulnerability will not be fixed. Consider migrating to an actively maintained alternative such as zip...

RUSTSEC-2026-0328 `decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

The tar-family extractors in decompress .tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal CWE-2...

`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

The tar-family extractors in decompress .tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal CWE-2...

BIT-RCLONE-2026-88014 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

PT-2026-105981

The tar-family extractors in decompress .tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal CWE-2...

SUSE CVE-2026-90057

In the Linux kernel, the following vulnerability has been resolved: slip: remove sliphangup to fix use-after-free in slipreceivebuf Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slipreceivebuf when racing against tty hangup. ttyldischangup calls ld-ops-hangup while holding...

Linux Distros Unpatched Vulnerability : CVE-2026-90057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - slip: remove sliphangup to fix use-after-free in slipreceivebuf Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slipreceivebuf when racing...

DEBIAN-CVE-2026-90057

In the Linux kernel, the following vulnerability has been resolved: slip: remove sliphangup to fix use-after-free in slipreceivebuf Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slipreceivebuf when racing against tty hangup. ttyldischangup calls ld-ops-hangup while holding...

AZL-102930 CVE-2026-90057 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: slip: remove sliphangup to fix use-after-free in slipreceivebuf Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slipreceivebuf when racing against tty hangup. ttyldischangup calls ld-ops-hangup while holding...

CVE-2026-90057 slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

In the Linux kernel, the following vulnerability has been resolved: slip: remove sliphangup to fix use-after-free in slipreceivebuf Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slipreceivebuf when racing against tty hangup. ttyldischangup calls ld-ops-hangup while holding...

kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change

A flaw was found in the Linux kernel's SLIP Serial Line Internet Protocol network component. A race condition exists during an MTU Maximum Transmission Unit change when the system reallocates receive buffers. This can allow a remote attacker to trigger an out-of-bounds write or write to a freed...

kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change

A flaw was found in the Linux kernel's SLIP Serial Line Internet Protocol network component. A race condition exists during an MTU Maximum Transmission Unit change when the system reallocates receive buffers. This can allow a remote attacker to trigger an out-of-bounds write or write to a freed...

kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change

A flaw was found in the Linux kernel's SLIP Serial Line Internet Protocol network component. A race condition exists during an MTU Maximum Transmission Unit change when the system reallocates receive buffers. This can allow a remote attacker to trigger an out-of-bounds write or write to a freed...

PT-2026-94405

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free read occurs in the slip receive buf function during a race condition with tty hangup. The tty ldisc hangup function calls ld-ops-hangup while holding only a read lo...

AlmaLinux 9 : kernel (ALSA-2026:67470)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67470 advisory. kernel: vhost: move vdpa group bound check to vhostvdpa CVE-2026-43248 kernel: security/keys: fix missed RCU read section on lookup CVE-2026-64015 kernel...