CVE-2024-12853: Unrestricted Upload of File with Dangerous Type

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with Author-level access and above, to uploa...

Mattermost Denial of Service Vulnerability (CNVD-2025-12636)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial of service vulnerability that stems from a failure to limit the file size of slack import file uploads. An attacker could exploit this vulnerability to import data to...

Fake 7-Zip Exploit Code Traced to AI-Generated Misinterpretation

A recent claim that a critical zero-day vulnerability existed in the popular open-source file archiver 7-Zip has been met with skepticism from the software's creator and other security researchers...

PT-2026-2481

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.24.12 Go versions prior to 1.25.6 Description The Go programming language contains a flaw in the archive/zip functionality that can lead to denial-of-service. Specifically, crafted ZIP files can trigger super-linear...

PT-2025-54918

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.4.3 Description Dovecot includes a script for converting attachments to text that improperly handles zip-style attachments. An attacker could leverage specially crafted OOXML documents to cause unintended files on t...

PT-2025-41203

Name of the Vulnerable Software and Affected Versions 7-Zip versions prior to 25.01 7-Zip versions 21.02 through 25.00 Description 7-Zip contains a flaw in how it handles symbolic links within ZIP files. This issue allows attackers to perform directory traversal, potentially writing files to...

PT-2026-2490

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.26 Release Candidate 3 Description The issue resides within the crypto/tls package, specifically during TLS session resumption. If the underlying Config object has its ClientCAs or RootCAs fields modified between the...

PT-2026-2480

Name of the Vulnerable Software and Affected Versions Go net/url package affected versions not specified Description The net/url package does not limit the number of query parameters, potentially leading to excessive memory consumption when parsing large URL-encoded forms with many unique query...

PT-2025-25546

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 17.0 through 28.0.1 Erlang OTP version 27.3.4.1 Erlang OTP version 26.2.5.13 stdlib versions 2.0 through 7.0.1 stdlib version 6.2.2.1 stdlib version 5.2.3.4 Description The issue is related to a Path Traversal vulnerability...

PT-2026-20477

Name of the Vulnerable Software and Affected Versions nltk/nltk affected versions not specified Description A critical issue exists in the NLTK downloader component. The unzip iter function within nltk/downloader.py utilizes zipfile.extractall without validating file paths or implementing securit...

PT-2025-41204

Name of the Vulnerable Software and Affected Versions 7-Zip affected versions not specified Description The issue relates to incorrect handling of symbolic links when accessing files within ZIP archives. Exploitation can allow an attacker to execute arbitrary code if a user opens a specially...

Denial Of Service (DoS)

Mattermost is vulnerable to Denial Of Service DoS. The vulnerability is due to insufficient file size restrictions on Slack import file uploads, allowing a user to exploit this by uploading a zip bomb...

MAL-2024-12272 Malicious code in filecraft (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3d0eec02526b659b5e856c211e05be1842dc283ed0b7d07dc90574ea5c7dc34a During the installation, the package iterates its files and attempts to import a hidden module - which is embedded as ZIP archive in the image file --- Categor...

Malicious code in handyfiles (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 381cd796d4e5fce8fb62c337374b5303e0b2466d67467efc95cbc4d7d8248dd4 During the installation, the package iterates its files and attempts to import a hidden module - which is embedded as ZIP archive in the image file --- Categor...

MAL-2024-12282 Malicious code in handyfiles (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 381cd796d4e5fce8fb62c337374b5303e0b2466d67467efc95cbc4d7d8248dd4 During the installation, the package iterates its files and attempts to import a hidden module - which is embedded as ZIP archive in the image file --- Categor...

Malicious code in filecraft (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3d0eec02526b659b5e856c211e05be1842dc283ed0b7d07dc90574ea5c7dc34a During the installation, the package iterates its files and attempts to import a hidden module - which is embedded as ZIP archive in the image file --- Categor...

CLSA-2024-1734642829 python3.9: Fix of CVE-2024-0450

CVE-2024-0450: Reject zip archives with overlapping entries to prevent quoted- overlap zip-bombs...

unzip bug fix update

An update is available for unzip. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The unzip utility is used to list, test, and extract files from zip archives. B...

CVE-2024-11984 SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type

A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file...

PT-2024-17382 · Unknown · Corporate Training Management System

Name of the Vulnerable Software and Affected Versions: Corporate Training Management System versions prior to 10.13 Description: A vulnerability in the epaper draft function of the Corporate Training Management System allows remote authenticated users to bypass file upload restrictions and execut...