CVE-2026-81838 Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...

CVE-2026-81838

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...

CVE-2026-81838

CVE-2026-81838 is a Zip Slip (arbitrary file write) vulnerability in AWS diagram-as-code (awsdac) , versions 0.10 through 0.23 . The zip extraction functionality fails to sanitize entry names, allowing a third party to craft zip entries with path traversal sequences that write arbitrary files to ...

EUVD-2026-67232

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...

CVE-2026-81838 Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...

CVE-2026-81727

NLTK versions before 3.10.3 are affected by a filesystem containment bypass in the Downloader.download and Downloader.incr_download methods. An attacker with write access to a shared downloader directory can create hardlinks pointing to files outside the install root, which are then overwritten d...

CVE-2026-76845

A flaw was found in adm-zip, a Node.js library used for handling zip archives. This vulnerability allows a local attacker to overwrite arbitrary files on the system. When extracting an archive, adm-zip follows symbolic links, which are special files that point to other files or directories. An...

magic-extractor v1.3.1

Magic Extractor Description Magic Extractor is a universal extraction tool for Windows that identifies a file with several detectors and routes it to the right bundled extractor. It aims to cover mainstream compression formats, the installers you actually see today, and a range of less common...

SUSE CVE-2026-32637

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

SUSE CVE-2026-74737

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix portid extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted usi...

androidReverse v20

Android Reverse A reverse engineering suite that runs entirely on Android. No PC, no ADB, no desktop tools — everything from APK extraction to native binary analysis happens on-device. MCP Server androidReverse includes a built-in Model Context Protocol server, allowing MCP-compatible AI clients ...

CVE-2026-37067: Improper Access Control

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

PT-2026-82670

Name of the Vulnerable Software and Affected Versions Veno File Manager Project version 4.4.9 Description Incorrect access control in the '/vfm-admin/admin-panel/view/save-cvs.php' endpoint allows an unauthenticated attacker to extract all application logs from a specified date onwards by sending...

EUVD-2026-67263

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

PT-2026-82751

Name of the Vulnerable Software and Affected Versions AWS diagram-as-code awsdac versions 0.10 through 0.23 Description A relative path traversal issue exists in the zip extraction functionality. This allows a third party to write arbitrary files to the local filesystem by using crafted zip entry...

Daydreaming: Stealing Hidden Agent Skills through Black-Box Task Interaction

Agent skills bundle instructions, reference data, and executable helpers that let a general agent perform specialized tasks. Hosted providers can keep these files secret while selling access to task results, making the skill itself a valuable target. Existing disclosure defenses can block request...

MiracleLinux 9 : python3.14-3.14.7-2.el9_8 (AXSA:2026-1673:06)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1673:06 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding...

MiracleLinux 9 : python3.12-3.12.14-1.el9_8 (AXSA:2026-1670:21)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1670:21 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-76845

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the...

CVE-2026-81838: Relative Path Traversal

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code awsdac in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third part...