CVE-2026-48111

7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an off-by-one out-of-bounds read vulnerability in the ParseDepedencyExpression function of the UEFI firmware image parserCPP/7zip/Archive/UefiHandler.cpp. The function validates an attacker-controlled opco...

CVE-2026-48112

7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style .SYMDEF symbol table, the...

Directory Traversal

Overview bagisto/bagisto is a hand tailored E-Commerce framework designed on some opensource technologies such as Laravel a PHP framework, Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to Directory Traversal via ImageCacheController component. An...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the denied function. An attacker can access arbitrary files on the server by supplying crafted input to the filename argument. Details A Directory Traversal attack also known as path traversal aims to access file...

The vulnerability of the ParseDependencyExpression() function in the 7-Zip UEFI dependency parser allows a attacker to cause a service failure.

The vulnerability of the ParseDependencyExpression function in the 7-Zip UEFI dependency parser involves reading data beyond the permitted range of memory. Exploiting this vulnerability could allow a malicious actor to cause system failures...

MiracleLinux 8 : vim-8.0.1763-23.el8_10.ML.1 (AXSA:2026-765:13)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-765:13 advisory. vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass CVE-2026-35177 Tenable has extracted the preceding description block...

PT-2026-47332

Name of the Vulnerable Software and Affected Versions wojtekmach Req versions 0.1.0 through 0.6.0 Description Improper handling of highly compressed data allows attacker-controlled HTTP servers to exhaust memory in a client via decompression-bomb response bodies. The default response pipeline...

The vulnerability of the OpenCapsule function in UEFI capsule file parsers and 7-Zip archivers allows a hacker to exploit the protected information.

The vulnerability of the OpenCapsule function in UEFI capsule file parsers and 7-Zip archivers is related to the use of uninitialized resources. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

Amazon Linux 2023 : 7zip, 7zip-reduced, 7zip-standalone (ALAS2023-2026-1820)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1820 advisory. A heap buffer overflow vulnerability GHSL-2026-140 exists in 7-Zip version 26.00, caused by an under- allocation in the NTFS compressed stream buffer GetCuSize shift UB, potentially allowing attackers ...

Important: 7zip

Issue Overview: A heap buffer overflow vulnerability GHSL-2026-140 exists in 7-Zip version 26.00, caused by an under-allocation in the NTFS compressed stream buffer GetCuSize shift UB, potentially allowing attackers to exploit this issue for arbitrary code execution or application crashes...

The vulnerability of the ParseLibSymbols() function in the 7-Zip archive viewer allows a hacker to disclose protected information.

The vulnerability of the ParseLibSymbols function in the 7-Zip archive viewer is related to reading data beyond the permitted range of memory. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

The vulnerability of the ReadBlock() function in the SquashFS file processor of the 7-Zip archive creator allows a hacker to disclose protected information or cause service failures.

The vulnerability of the ReadBlock function, a handler for the SquashFS file compressor used by 7-Zip, relates to reading data outside of the permitted range in memory. Exploiting this vulnerability could allow an attacker to disclose sensitive information or cause service failures...

The vulnerability of the Parse function in the UDF format file archiver 7-Zip allows attackers to exploit it to disclose protected information.

The vulnerability of the Parse function in the UDF format file processing tool of the 7-Zip archive manager is related to reading data beyond the allowed range of memory. Exploiting this vulnerability allows a remote attacker to disclose the protected information...

7zip-26.01-1.1 on GA media (moderate)

7zip-26.01-1.1 on GA media Announcement ID: openSUSE-SU-2026:10942-1 Rating: moderate Cross-References: CVE-2026-48095 CVSS scores: CVE-2026-48095 SUSE : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...

CVE-2026-48959

A flaw was found in perl-IO-Compress. An attacker can exploit a vulnerability in the IO::Uncompress::Unzip module's fastForward function by providing a specially crafted zip file. When a named entry is extracted, a per-byte read loop occurs, leading to CPU exhaustion. This can result in a Denial ...

RHEL 9 : vim (RHSA-2026:22717)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:22717 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via...

RHEL 10 : vim (RHSA-2026:22711)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:22711 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via...

RHEL 8 : vim (RHSA-2026:22730)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:22730 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via...

EulerOS Virtualization 2.13.1 : python3 (EulerOS-SA-2026-2149)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : If the value passed to os.path.expandvars is user-controlled a performance degradation is possible when expanding environment...

CVE-2026-10662

A vulnerability was found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The affected element is the function requests.get of the file src/blendermcp/server.py of the component ZIP File Handler. The manipulation of the argument zipfileurl results in server-side request...