CVE-2026-20337

CVE-2026-20337 concerns ClamAV’s zip archive parser. The issue arises from improper boundary checks for content in zip files during scanning, which can trigger an out-of-bounds write. An unauthenticated, remote attacker could submit a crafted zip file for scanning, potentially causing the ClamAV ...

EUVD-2026-54528

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition...

CVE-2026-20337

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition...

Security Bulletin:Vulnerability in Vim affects IBM Netezza Appliance

Summary The Vim package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2025-53905, CVE-2025-53906 Vulnerability Details CVEID:CVE-2025-53905 DESCRIPTION: Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issu...

OESA-2026-3258 libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...

PT-2026-69071

Name of the Vulnerable Software and Affected Versions ClamAV affected versions not specified Description A flaw in the zip archive parser allows an unauthenticated remote attacker to cause a Denial of Service DoS condition. The issue stems from improper memory handling during the scanning of zip...

PT-2026-69070

Name of the Vulnerable Software and Affected Versions ClamAV affected versions not specified Description An issue in the zip archive parser allows an unauthenticated remote attacker to cause a Denial of Service DoS condition. This occurs due to improper boundary checks for content within zip file...

CVE-2026-20337: Buffer Copy without Checking Size of Input

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition...

Oracle Linux 9 : php:8.3 (ELSA-2026-48197)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-48197 advisory. php 8.3.32-1 - rebase to 8.3.32 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 5.1.21-1 - update to 5.1.21 for PHP 8.1 2070040 php-pecl-redis...

php:8.3 security, bug fix, and enhancement update

php 8.3.32-1 - rebase to 8.3.32 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 5.1.21-1 - update to 5.1.21 for PHP 8.1 2070040 php-pecl-redis6 6.1.0-3 - use valkey for tests 6.1.0-2 - ignore 1 ONLINE test 6.1.0-1 - RHEL build 6.1.0-1 - update to 6.1.0 - drop patch merged upstrea...

CVE-2026-20338: Double Free

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this...

Directory Traversal

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Directory Traversal in the ensurePathIsContained function. An attacker can potentially access files outside the intended directory by manipulating file paths during the normalization process...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

NPM: Nx: Zip-Slip in the self-hosted remote cache

NPM: Nx: Zip-Slip in the self-hosted remote cache vulnerability discovered by ? in WordPress Npm nx versions = 20.8.0, 22.7.7...

GHSA-VP3H-GHGH-JR7G Nx: Zip-Slip in the self-hosted remote cache

Summary The Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious — or on-path MITM — remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the...

CVE-2026-71476

Nx: Zip-Slip in the self-hosted HTTP remote cache. From 20.8.0 up to 22.7.7 and 23.0.2, the self-hosted remote cache extractor can have tar entries escape the output directory, allowing writes to arbitrary locations on the host and potentially remote code execution. This affects workspaces using ...

CVE-2026-71476 Nx: Zip-Slip in the self-hosted remote cache

Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path MITM remote cache server can return a crafted...

CVE-2026-71476 Nx: Zip-Slip in the self-hosted remote cache

Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path MITM remote cache server can return a crafted...

CVE-2026-71476 Nx: Zip-Slip in the self-hosted remote cache

Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path MITM remote cache server can return a crafted...

EulerOS 2.0 SP15 : python-pip (EulerOS-SA-2026-2903)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior cou...