PT-2026-73164

Name of the Vulnerable Software and Affected Versions OpenTofu versions prior to 1.11.4 Description A denial of service issue exists in the tofu init command when processing maliciously-crafted .zip archives used for provider or module packages. An attacker can control the content of the .zip...

Seo Panel SQL Injection Vulnerability

Seo Panel is a free SEO optimization software developed by Seo Panel. Versions of Seo Panel prior to 4.9.0 contained an SQL injection vulnerability. This vulnerability stemmed from a blind SQL injection in the archive.php page, which could allow authenticated attackers to manipulate database...

CVE-2025-58744 Hard-Coded Default Credentials Enable Document Archive Decryption in Milner ImageDirector Capture

Use of Default Credentials, Hard-coded Credentials vulnerability in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows decryption of document archive files using credentials decrypted with hard-coded application encryption key. This issue affects ImageDirector Capture: from...

CVE-2025-58744

Milner ImageDirector Capture (Windows) is affected by CVE-2025-58744 due to hard-coded credentials in C2SGlobalSettings.dll. The flaw allows decryption of document archive files using credentials embedded in the application encryption key, affecting versions 7.0.9.0 through 7.6.3.25808. Root caus...

CVE-2025-58744 Hard-Coded Default Credentials Enable Document Archive Decryption in Milner ImageDirector Capture

Use of Default Credentials, Hard-coded Credentials vulnerability in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows decryption of document archive files using credentials decrypted with hard-coded application encryption key. This issue affects ImageDirector Capture: from...

esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages

Summary The commit does not actually fix the path traversal bug. path.Clean basically normalizes a path but does not prevent absolute paths in a malicious tar file. PoC This test file can demonstrate the basic idea pretty easily: go package server import "archive/tar" "bytes" "compress/gzip"...

CVE-2026-23950

A flaw was found in node-tar, a library for Node.js. This race condition vulnerability occurs due to incomplete handling of Unicode path collisions within the path-reservations system on case-insensitive filesystems, such as macOS APFS. A remote attacker can exploit this by providing a specially...

MiracleLinux 9 : skopeo-1.20.0-2.el9_7 (AXSA:2025-11601:05)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-11601:05 advisory. golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 Tenable has extracted the preceding description block directly from the...

MiracleLinux 8 : go-toolset:rhel8 (AXSA:2024-8540:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8540:01 advisory. golang: archive/zip: Incorrect handling of certain ZIP files CVE-2024-24789 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped...

MiracleLinux 7 : cpio-2.11-28.el7 (AXSA:2020-579:01)

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-579:01 advisory. CVE-2019-14866 In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archiv...

MiracleLinux 8 : git-2.31.1-3.el8 (AXSA:2023-4991:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-4991:01 advisory. git: gitattributes parsing integer overflow CVE-2022-23521 git: Heap overflow in git archive, git log --format leading to RCE CVE-2022-41903 Tenable...

MiracleLinux 8 : file-roller-3.28.1-3.el8 (AXSA:2021-1271:01)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2021-1271:01 advisory. file-roller: path traversal vulnerability via a specially crafted filename contained in malicious archive CVE-2019-16680 file-roller: directory...

MiracleLinux 8 : php:7.3 (AXSA:2020-779:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-779:01 advisory. php: Out-of-bounds read due to integer overflow in iconvmimedecodeheaders CVE-2019-11039 php: Buffer over-read in exifreaddata CVE-2019-11040 php:...

The vulnerability of the node-tar library on the Node.js software platform allows attackers to bypass existing security mechanisms and execute arbitrary code.

The vulnerability of the node-tar library in the Node.js software platform is related to an incorrect path name limitation when processing the preservePaths parameter. Exploiting this vulnerability allows a attacker to bypass existing security mechanisms and execute arbitrary code during the...

Exploit-Archive

Exploit-Archive Proof-of-Concept PoC exploits and technical...

SUSE CVE-2026-21483

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user Super Admin views or previews this content, the...

OESA-2026-1093 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: GNU Tar through 1.35...

PT-2026-25023

Name of the Vulnerable Software and Affected Versions tarfile module affected versions not specified Description The 'tarfile' module incorrectly normalizes AREGTYPE blocks to DIRTYPE when processing multi-block members like GNUTYPE LONGNAME or GNUTYPE LONGLINK. This can cause crafted tar archive...

MiracleLinux 4 : libtar-1.2.11-17.AXS4.1 (AXSA:2014-078:01)

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2014-078:01 advisory. libtar is a C library for manipulating tar archives. It supports both the strict POSIX tar format and many of the commonly-used GNU extensions. Security issue...

MiracleLinux 4 : firefox-60.2.0-1.0.1.AXS4 (AXSA:2018-3323:06)

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2018-3323:06 advisory. Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 CVE-2018-12376 Mozilla: Use-after-free in driver timers CVE-2018-12377 Mozilla:...