1931 matches found
CVE-2025-67435-PoC
CVE-2025-67435 शोधकर्ता : Chowdhury Faizal Ahammed PluckCMS Zip Slip दूरस्थ कोड निष्पादन भेद्यता रिपोर्ट कार्यकारी सारांश यह रिपोर्ट PluckCMS में पाई गई एक गंभीर सुरक्षा भेद्यता का दस्तावेजीकरण करती है जो प्रमाणित हमलावरों को Zip Slip आक्रमण वेक्टर के माध्यम से दूरस्थ कोड निष्पादन प्राप्त करने की...
CVE-2026-77679
A path traversal ZIP slip vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, the decompressxpithread function extracts XPI archives ZIP format to disk using libarchive. For each archive entry, the output path i...
GHSA-68MJ-5WR7-6FGG vulnerabilities
Vulnerabilities for packages: traccar-fips, logstash, traccar, logstash-fips, cassandra-reaper, thingsboard, zipkin, druid, conductor, nuxeo, conductor-fips...
GHSA-93J5-89VC-PPH4 vulnerabilities
Vulnerabilities for packages: traccar-fips, logstash, traccar, logstash-fips, cassandra-reaper, thingsboard, zipkin, druid, conductor, nuxeo, conductor-fips...
GHSA-5M9F-RPHJ-C435 vulnerabilities
Vulnerabilities for packages: traccar-fips, logstash, traccar, logstash-fips, cassandra-reaper, thingsboard, zipkin, druid, conductor, nuxeo, conductor-fips...
CVE-2026-44829
Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives...
Security update for python313
This update for python313 fixes the following issues: CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. CVE-2025-15367: control characters may allow the injection of additional commands bsc1257041. CVE-2026-0864: improper handling of...
CVE-2026-47699 Confidential Containers Guest Components image-rs: zip-slip-class arbitrary file write via absolute entry path in hardlink fallback
Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make imagers::stream::unpack::unpack create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs,...
CVE-2026-47699 Confidential Containers Guest Components image-rs: zip-slip-class arbitrary file write via absolute entry path in hardlink fallback
Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make imagers::stream::unpack::unpack create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs,...
CVE-2026-47699
Confidential Containers Guest Components (versions 0.16.0 through 0.19.x) contains a path traversal vulnerability in the image-rs crate's try_hardlink_fallback() function. When unpacking a crafted OCI image layer, the function computes the hardlink destination using destination.join(&entry_rel). ...
CVE-2026-57233
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...
CVE-2026-57233
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...
CVE-2026-57233 Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...
CVE-2026-57233 Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and...
CVE-2026-57233
In Notepad++ prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to the extraction destination without canonical containment validation, enabling a Zip Slip attack. A crafted entry like ../mimeTools/mimeTools.dll overwrites a sibling plugin DLL, achieving arbitrary code...
GO-2024-2482 vulnerabilities
Vulnerabilities for packages: goreleaser...
CVE-2026-13105
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration...
CVE-2026-13105
CVE-2026-13105 affects IBM i Access Client Solutions (ACS) versions 1.1.2.0–1.1.9.13. The vulnerability is a zip slip/path traversal issue that occurs when importing a configuration, arising from improper handling of archive paths. Impact is high (C:H/I:H/A:H) as per IBM’s CVSS vector, with netwo...
CVE-2026-13105 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration...
