CVE-2026-114104

A flaw was found in adm-zip. An attacker can exploit this vulnerability by supplying a specially crafted ZIP archive containing duplicate file names. Because the library resolves duplicate names inconsistently between its lookup and extraction routines, an application that validates a file before...

CVE-2026-114104

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry returns the last duplicate while extractAllTo writes the first, causing...

CVE-2026-114104

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry returns the last duplicate while extractAllTo writes the first, causing...

EUVD-2026-106907

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry returns the last duplicate while extractAllTo writes the first, causing...

PT-2026-120834

Name of the Vulnerable Software and Affected Versions Pillow versions 5.1.0 through 12.11.0 Description The PdfParser.linearize page tree function in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When the Image.save function is used with...

PT-2026-120230

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry returns the last duplicate while extractAllTo writes the first, causing...

CVE-2026-112956

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an...

CVE-2026-112956

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an...

puma_header_normalization-CVE-2024-45614

Puma Header normalization CVE-2024-45614 Verification advisory: https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4 fix commit: https://github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043 Results Execution results of request.rb duplicate Target| Result ---|---...

CVE-2022-35501

CVE-2022-35501 Stored Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The post creation functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the title field, leading to XSS...

CVE-2026-110677

A flaw was found in perl-Cpanel-JSON-XS. When the dupkeysasarrayref configuration is enabled, the values of a duplicate object key are collected into a new array. However, an extra reference is never released, causing the array and every value within it to outlive the decoded structure. The array...

CVE-2026-110672

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...

CVE-2026-110672

The Cpanel::JSON::XS Perl module versions before 4.80 are vulnerable to a memory leak in the decode_hv function. The issue occurs when a quoted key of 24 or more bytes, or one containing non-ASCII bytes/escape sequences, is decoded into a new scalar. If the object is subsequently rejected due to ...

CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...

CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...

PT-2026-117570

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description A memory leak occurs in the decode hv function when an object is rejected due to a duplicate key or a missing colon. Specifically, if a quoted key is 24 bytes or longer, contains a non-ASCII...

nodejs-http-transfer-encoding-smuggling-poc

nodejs-http-transfer-encoding-smuggling-poc PoC of HTTP Request Smuggling in nodejs CVE-2020-8287 src/index.js header: 'Host', '127.0.0.1', 'Transfer-Encoding', 'chunked', 'Transfer-Encoding', 'eee' , body: 'A' header: 'Host', '127.0.0.1' , body: '' data: 'HTTP/1.1 200 OK\r\n' + 'Date: Tue, 05 Ja...

CVE-2026-98679

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject duplicate event disable The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013writeeventconfig already ignores repeated enable requests, but a repeated disable reques...

EUVD-2026-103724

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: skip expired catchall elements on insert and delete nftsetelemcatchallinsert looks up duplicates with nftsetelemactive only, while nftsetcatchalllookup and the dump path additionally skip expired elements. On...

PT-2026-116898

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject duplicate event disable The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013 write event config already ignores repeated enable requests, but a repeated disable...