CVE-2026-74859

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

EXPLOITER

EXPLOITER: Explotación automatizada para CVE-2024-0044 EXPLOITER es una herramienta sofisticada diseñada para la explotación automatizada de vulnerabilidades CVE-2024-0044. Este script simplifica el proceso de explotación de aplicaciones Android vulnerables automatizando el despliegue del payload...

Important: Red Hat Security Advisory: python3 security update

An update for python3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...

EulerOS 2.0 SP12 : perl-Archive-Tar (EulerOS-SA-2026-3365)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

Linux Distros Unpatched Vulnerability : CVE-2026-74859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can...

PT-2026-87028

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...

NewStart CGSL MAIN 7.02 : perl-Archive-Tar Multiple Vulnerabilities (NS-SA-2026-0090)

The remote NewStart CGSL host, running version MAIN 7.02, has perl-Archive-Tar packages installed that are affected by multiple vulnerabilities: - Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. makespecialfile passes...

PT-2026-87018

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

EulerOS 2.0 SP12 : perl-Archive-Tar (EulerOS-SA-2026-3290)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

RHEL 8 : python3 (RHSA-2026:64806)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:64806 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

CVE-2026-86437

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

CVE-2026-86437

Lara Dashboard before 1.3.2 incorrectly authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing any non-Superadmin administrator to upload and extract arbitrary zip archives over the live application source tree. An attacker with this per...

CVE-2026-77697

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction...

CVE-2026-77697 Privilege Escalation

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction...

CVE-2026-77697

ManageEngine Endpoint Central (by Zohocorp) versions below 11.4.2540.23 are affected by a Privilege Escalation vulnerability during JAR extraction. The flaw allows a locally authenticated user with low privileges to escalate their permissions, with changed scope impacting the confidentiality, int...

CVE-2026-77697 Privilege Escalation

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction...

EUVD-2026-72340

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction...

Security update for cpio

This update for cpio fixes the following issues: CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives bsc1274856. CVE-2026-66485: improper memory management in the makepath...

SUSE-SU-2026:4012-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives bsc1274856. - CVE-2026-66485: improper memory management in the makepath...

TencentOS Server 4: buildah (TSSA-2026:0954)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0954 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...