compas-cloud (>=0.1.2rc1, <=0.3.3), evennia (>=1.0.0, <=6.1.0) +8 more potentially affected by CVE-2026-77528 via autobahn (20.12.3)

autobahn PYPI version 20.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - compas-cloud =0.1.2rc1, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =4.5.2, =1.0.2, =1.0.9 Source cves: CVE-2026-77528 Source advisory: OSV:PYSEC-2026-402...

UBUNTU-CVE-2026-103754

A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...

CVE-2026-103754

A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...

CVE-2026-103754

A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...

BIT-PHP-MIN-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

BIT-PHP-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

BIT-LIBPHP-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

CLEANSTART-2026-OX24018 archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened

Security vulnerability affects the cri-tools package. archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened...

CentOS Linux 7 [TuxCare] Security Update: bsdcpio / bsdtar / libarchive / libarchive-devel (CENTOS7:CLSA-2026:1780922803)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1780922803 advisory. - A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validatio...

CentOS Linux 8.4 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1782983048)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1782983048 advisory. - The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member...

CentOS Linux 8.4 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1779583115)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1779583115 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2022_1819)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221819 advisory. golang: Command-line arguments may overwrite global data CVE-2021-38297 golang: archive/zip: malformed archive may cause panic or memory exhaustion...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2025_23325)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523325 advisory. golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 Tenable has extracted the preceding description block directly from the CIQ...

AlmaLinux 9.6 [TuxCare] Security Update: perl-Archive-Tar (ALMALINUX9.6:CLSA-2026:1786097595)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786097595 advisory. - Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. readtar reads ea...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2021_3076)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20213076 advisory. golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader CVE-2021-27918 golang: net/http: panic in ReadRequest and...

Rocky Linux 9 [CIQ] Security Update: perl-Archive-Tar (crlsa-2026_49525)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202649525 advisory. perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size CVE-2026-9538 Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: osbuild-composer / osbuild-composer-core / etc (crlsa-2026_1380)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20261380 advisory. golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: git / git-all / git-core / git-core-debuginfo / git-core-doc / etc Multiple Vulnerabilities (crlsa-2023_0611)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230611 advisory. git: gitattributes parsing integer overflow CVE-2022-23521 git: Heap overflow in git archive, git log --format leading to RCE CVE-2022-41903 Tenable has...

CVE-2026-102514: Out-of-bounds Write

Out-of-bounds Write CWE-787 in the PEA archive extraction routine pea.pas, unpeaprocedure of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While...

AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.6:CLSA-2026:1781083045)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781083045 advisory. - The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as...