EUVD-2026-25049

DDEV has ZipSlip path traversal in tar and zip archive extraction...

CVE-2026-32885

DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both Untar and Unzip functions in pkg/archive/archive.go. Downloads and extracts archives from remote sources without path validation. Version...

CVE-2026-32885 DDEV has ZipSlip path traversal in tar and zip archive extraction

DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both Untar and Unzip functions in pkg/archive/archive.go. Downloads and extracts archives from remote sources without path validation. Version...

CVE-2026-32885

DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both Untar and Unzip functions in pkg/archive/archive.go. Downloads and extracts archives from remote sources without path validation. Version...

CVE-2026-32885

CVE-2026-32885 (DDEV ZipSlip) affects the DDEV project prior to v1.25.2. The vulnerability resides in the archive extraction routines (pkg/archive/archive.go) for both Untar() and Unzip(), which unzip/downloaded archives from remote sources without validating the extraction path. This enables pat...

CVE-2026-35373 uutils coreutils ln Local Denial of Service via Improper Handling of Non-UTF-8 Filenames

A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms e.g., ln SOURCE... DIRECTORY. While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation...

CVE-2026-41586

creationtimestamp| type| source ---|---|--- 2026-04-22 12:54:53+00:00| published-proof-of-concept| https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7 2026-04-22 12:54:53+00:00| published-proof-of-concept|...

CVE-2026-41245

A flaw was found in Junrar, an open-source Java RAR archive library. A path traversal vulnerability in the LocalFolderExtractor allows a remote attacker to write arbitrary files with attacker-controlled content into sibling directories. This occurs when a specially crafted RAR archive is extracte...

CVE-2026-4119

creationtimestamp| type| source ---|---|--- 2026-04-22 09:00:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116447538532151230 2026-04-22 09:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mk353qm3xy2m 2026-04-22 11:16:16+00:00| published-proof-of-concept|...

CVE-2017-20230

creationtimestamp| type| source ---|---|--- 2026-04-22 01:24:36+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mk2dmksft72e 2026-04-22 01:29:37+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mk2dvjwak62b 2026-04-22 16:15:34+00:00| seen|...

PT-2026-34524

Name of the Vulnerable Software and Affected Versions DDEV versions prior to 1.25.2 Description DDEV is an open-source tool for running local web development environments for PHP and Node.js. The software performs unsanitized extraction of archives from remote sources without path validation with...

CVE-2026-33748

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is...

UBUNTU-CVE-2026-33748

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is...

CVE-2026-41445

creationtimestamp| type| source ---|---|--- 2026-04-20 18:29:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjx3wojlct2k 2026-04-20 18:46:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjx4wm5a4s2z 2026-04-20 21:22:08+00:00| seen|...

CVE-2026-25524

creationtimestamp| type| source ---|---|--- 2026-04-20 18:14:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjx33qbzqp2e 2026-04-20 19:11:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjx6cxu2zf2t 2026-04-20 21:21:58+00:00| seen|...

CVE-2026-24467

creationtimestamp| type| source ---|---|--- 2026-04-20 17:21:45+00:00| seen| Telegram/7kKxZY5KjVtNNq82uAZn6qPfMFkWsKJQXsAec31tFmY88 2026-04-20 18:09:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjx2srud322i 2026-04-20 18:50:23+00:00| seen|...

CVE-2026-5265

creationtimestamp| type| source ---|---|--- 2026-04-20 16:12:58+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mjwudarxe22v 2026-04-20 16:23:01+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mjwuv7lkt72h...

CVE-2026-6629

creationtimestamp| type| source ---|---|--- 2026-04-20 12:05:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjwgi72x5m2r 2026-04-20 13:16:52+00:00| published-proof-of-concept| Telegram/7GNSW27Y2N6zMsJzLht94-sDuqQRdO09nNnVciVhTSt0Y 2026-04-20 13:21:17+00:00| seen|...

Nginx UI 安全漏洞

Nginx UI is a web interface for Nginx developed by Jacky. Versions of Nginx UI prior to 2.3.5 contained security vulnerabilities. These vulnerabilities stemmed from WebSocket endpoints that did not validate sources and an insecure storage of authentication tokens, which could lead to cross-site...

CVE-2026-6574

creationtimestamp| type| source ---|---|--- 2026-04-19 15:00:14+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mju7sa6ety2v 2026-04-19 15:00:15+00:00| seen| https://infosec.exchange/users/offseq/statuses/116431966121032331 2026-04-19 15:15:14+00:00| seen|...