Malware in rampage-unpack

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

vmp-lazy-unpack

vmp-lazy-unpack An emulation-based unpacker and import resolver for Windows x64, x32 VMProtect 3.x binaries. The project started as a script used to unpack VMProtect 3 in our devirtualization pipeline. It does this without the need to attach a debugger or dump live. How The project uses Unicorn t...

asadbg

asadbg Preliminary note: we recommend you to use this as part of asatools but it can also be used standalone. asadbg is a framework of tools to aid in automating live debugging of Cisco ASA devices, as well as automating interaction with the Cisco CLI over serial/ssh to quickly perform repetitive...

CVE-2025-46817

CVE-2025-46817 – Redis Lua unpack Integer Overflow Potential RCE Redis Lua unpack integer overflow PoC causing stack blow-up and crash on 8.2.1. Overview Redis 8.2.1 ships Lua 5.1 with an unpack implementation that computes the result count using signed integers. Carefully chosen start/end indice...

SUSE-SU-2026:5201-1 Security update for containerd

This update for containerd fixes the following issues: - CVE-2026-39882: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: Memory exhaustion via uncapped HTTP response body reading bsc1274214. - CVE-2026-47262: Denial of Service DoS condition via a maliciously crafted image...

CVE-2026-77113

Apport apport-unpack Path Traversal CVE-2026-77113 https://youtu.be/CdM1Xtnx0uQ A path traversal issue in Apport's apport-unpack allowed attacker-controlled report keys to escape the specified extraction directory. A crafted report containing: ../escaped: owned-by-report could cause apport-unpack...

UBUNTU-CVE-2026-86692

In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack. The key-name validation added for CVE-2026-771...

CVE-2026-86692

In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack. The key-name validation added for CVE-2026-771...

CVE-2026-86692

The apport software (versions before 2.37.0 ) is vulnerable to a path traversal flaw during the processing of crash reports via apport-unpack. The root cause is that key-name validation (intended to mitigate CVE-2026-77113) fails to cover base64-encoded keys skipped by ProblemReport.load(binary=F...

CVE-2026-86692 apport: Arbitrary file creation or overwrite via path traversal in base64-encoded problem report keys

In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack. The key-name validation added for CVE-2026-771...

zt-zip: Path traversal in fluent API unpack

Summary ZipUtil.unpack... rejects ZIP entries that escape the target output directory, but the Zips fluent API appears to use a separate unpack implementation that does not apply the same destination-boundary check. A ZIP entry such as: text ../escape/poc.txt is written outside the configured...

PT-2026-141108

In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack. The key-name validation added for CVE-2026-771...

CVE-2026-86692: Canonical apport: In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to…

In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack. The key-name validation added for CVE-2026-771...

ZeroTurnaround ZIP – convenience methods path traversal vulnerability

ZeroTurnaround ZIP – Convenience methods versions prior to 1.18.0 contain a path traversal vulnerability. This vulnerability arises because the Zips.getzip.unpack.destinationoutputDir.process interface directly uses the name of a ZIP entry to construct the output file without performing any targe...

Linux Distros Unpatched Vulnerability : CVE-2026-106972

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in MessagePack\BufferUnpacker::unpack in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through...

`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

Decoder::unpack does not safely contain the paths it extracts, so a malicious NAR archive can create files outside the destination directory — a path traversal CWE-22. In src/dec.rs Decoder::unpack: - A symlink entry's target is written without checking where it points src/dec.rs:153, so the...

RUSTSEC-2026-0425 `nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

Decoder::unpack does not safely contain the paths it extracts, so a malicious NAR archive can create files outside the destination directory — a path traversal CWE-22. In src/dec.rs Decoder::unpack: - A symlink entry's target is written without checking where it points src/dec.rs:153, so the...

OESA-2026-4568 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

OESA-2026-4567 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

OESA-2026-4566 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...