PT-2025-16365

Name of the Vulnerable Software and Affected Versions PeaZip versions 10.4.0 and earlier Description This issue allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this, where the target must visit a...

BIT-PYTHON-2024-8088 Infinite loop when iterating over zip archive entry names from zipfile.Path

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive for example, methods of "zipfile.Path" like "namelist", "iterdir", etc...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip in the Unarchive function. An attacker can overwrite sensitive files and potentially escalate privileges by supplying a malicious archive file containing symlinks, which is unarchived...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/mholt/archiver is a cross-platform, multi-format archive utility and Go library. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip in the Unarchive function. An attacker can overwrite sensitive files and potentially escala...

BIT-HELM-2025-32386 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed e.g., 800x difference. When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issu...

GO-2025-3601 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm...

Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

A Helm contributor discovered that a specially crafted chart archive file can cause Helm to use all available memory and have an out of memory OOM termination. Impact A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed e.g., 800...

GHSA-4HFP-H4CW-HJ8P Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

A Helm contributor discovered that a specially crafted chart archive file can cause Helm to use all available memory and have an out of memory OOM termination. Impact A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed e.g., 800...

Remote Code Execution (RCE)

github.com/jaredallard/archives is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper archive parsing due to insufficient validation of specially crafted archive files, which allows an attacker to execute arbitrary code or modify files in the context of the user running...

Azure Linux 3.0 Security Update: libarchive (CVE-2025-25724)

The version of libarchive installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-25724 advisory. - listitemverbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which...

CVE-2025-32386

Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed e.g., 800x difference. When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issu...

CVE-2025-32386 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed e.g., 800x difference. When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issu...

CVE-2025-32386 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed e.g., 800x difference. When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issu...

CVE-2025-32386 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed e.g., 800x difference. When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issu...

CVE-2025-32386

CVE-2025-32386: Helm memory exhaustion via crafted chart archives. A chart can expand uncompressed >800x, triggering memory exhaustion when loaded. Helm fixed in v3.17.3. IBM/Kubecost and related records reference Helm usage and confirm the vulnerability details and mitigation path (upgrade He...

CVE-2025-32386

Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed e.g., 800x difference. When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issu...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the LoadArchiveFiles function in archive.go. An attacker can cause a stack overflow by submitting a JSON Schema with excessive nested references. Workaround This vulnerability can be mitigated by ensuring that...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the LoadArchiveFiles function in archive.go. An attacker can disrupt service by supplying an archive whose decompressed size is very large. Remediation A fix was pushed into the...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the endpoints listed below. An attacker can manipulate user data or configuration settings, and perform unauthorized actions by convincing users to follow malicious links that execute unintended...

PT-2025-15897

Impact wallabag versions prior to 2.6.11 were discovered to contain multiple Cross-Site Request Forgery CSRF vulnerabilities across several endpoints. An attacker could craft a malicious link or page that, if visited by a logged-in wallabag user, could trick the user's browser into performing...