CVE-2026-39243

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...

CVE-2026-39243

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...

CVE-2026-39246

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries type === 'symlink', the x.linkname field from the archive is passed directly to fs.symlink without validation index.js line 121. The preventWritingThroughSymlink check on line 98...

Linux Distros Unpatched Vulnerability : CVE-2025-12506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain...

CVE-2026-39245

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function index.js line 29 and the extraction path validation index.js line 106 use String.indexOf to verify the resolved path is within the output...

CVE-2026-39245

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function index.js line 29 and the extraction path validation index.js line 106 use String.indexOf to verify the resolved path is within the output...

CVE-2026-39243

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...

CVE-2026-39246

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries type === 'symlink', the x.linkname field from the archive is passed directly to fs.symlink without validation index.js line 121. The preventWritingThroughSymlink check on line 98...

CVE-2026-39246

The connected documents confirm a concrete vulnerability in the decompression tool: before v4.2.2, symlink entries (type === 'symlink') pass the archive’s x.linkname directly to fs.symlink() without validation. The existing preventWritingThroughSymlink check only applies to file entries, not syml...

CVE-2026-39246

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries type === 'symlink', the x.linkname field from the archive is passed directly to fs.symlink without validation index.js line 121. The preventWritingThroughSymlink check on line 98...

CVE-2017-12226

creationtimestamp| type| source ---|---|--- 2026-07-08 23:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq6by5dfda2o...

CVE-2026-29057

creationtimestamp| type| source ---|---|--- 2026-07-08 23:25:03+00:00| seen| https://gist.github.com/itspokchop93/3608aed328d0052b908ae25501a3ecd0 2026-07-09 00:00:29+00:00| seen| https://gist.github.com/itspokchop93/3608aed328d0052b908ae25501a3ecd0...

CVE-2026-58210

creationtimestamp| type| source ---|---|--- 2026-07-08 23:10:14+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq6ai44tz62n...

CVE-2026-45367

creationtimestamp| type| source ---|---|--- 2026-07-08 23:00:13+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mq67w72ugf2l...

CVE-2026-54590

creationtimestamp| type| source ---|---|--- 2026-07-08 22:59:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq67v3wjmr2z 2026-07-20 09:53:36+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mr2zkmrplk2t 2026-07-20 09:53:36+00:00| seen|...

CVE-2026-8649

creationtimestamp| type| source ---|---|--- 2026-07-08 22:54:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq67m5hson27 2026-07-10 19:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcwa2beha2f 2026-07-11 01:47:04+00:00| seen|...

CVE-2026-58208

creationtimestamp| type| source ---|---|--- 2026-07-08 22:19:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq65o5u3x42x 2026-07-11 10:25:23+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqeh56pdjb27 2026-07-11 10:25:25+00:00| seen|...

CVE-2026-54777

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic when an attacker races NamedPipeListen...

CVE-2026-59803

creationtimestamp| type| source ---|---|--- 2026-07-08 22:02:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq64ouacqi2t 2026-07-09 00:15:02+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-59803...

CVE-2026-60105

creationtimestamp| type| source ---|---|--- 2026-07-08 22:01:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mq64ms7gqd2w 2026-07-09 09:14:21+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq7cadytwy26 2026-07-11 00:30:32+00:00| seen|...