CVE-2026-5439

A memory exhaustion vulnerability exists in ZIP archive processing. Orthanc automatically extracts ZIP archives uploaded to certain endpoints and trusts metadata fields describing the uncompressed size of archived files. An attacker can craft a small ZIP archive containing a forged size value,...

CVE-2026-5439 Memory Exhaustion via Forged ZIP Metadata

A memory exhaustion vulnerability exists in ZIP archive processing. Orthanc automatically extracts ZIP archives uploaded to certain endpoints and trusts metadata fields describing the uncompressed size of archived files. An attacker can craft a small ZIP archive containing a forged size value,...

SUSE CVE-2026-27819

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP can bypass the...

PT-2026-24181

Name of the Vulnerable Software and Affected Versions affected versions not specified Description Attackers are utilizing a technique involving malformed ZIP metadata, referred to as 'shadow archives', to circumvent antivirus AV and Endpoint Detection and Response EDR systems. This method allows...

Denial Of Service (DoS)

github.com/sigstore/rekor is vulnerable to Denial Of Service DoS. The vulnerability exists because the archive metadata file size is not checked before the files are read to memory which can lead to out of memory conditions resulting in an application crash...

SUSE CVE-2023-30551

Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory OOM conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of...

Race condition

Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory OOM conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of...

PT-2023-22778

Name of the Vulnerable Software and Affected Versions Rekor versions prior to 1.1.1 Description Rekor is an open source software supply chain transparency log that may crash due to out of memory OOM conditions caused by reading archive metadata files into memory without checking their sizes first...

Safari Archive Metadata Command Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3...

Apple Mac OSX Safari Browser - 'Safe File' Remote Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be redistributed according to the licenses defined in the Authors field below. In the case of an unknown or missing license, this file defaults to the same license as the core Framework dual GPLv2 and Artistic. The latest version of the...