CVE-2026-41245 Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix

Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Version 7.5.10 fixes th...

Firmware Extractor (Advanced)

Scan and extract firmware images: TRX headers, gzip/lzma layers, ELF blobs, squashfs detection extraction squashfs non implémentée. Nested structures are partially handled TRX → gzip. !/usr/bin/env python3 -- coding: utf-8 -- """ Module avancé : détection multi-formats TRX, gzip, lzma, ELF,...

CVE-2026-6616

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extractwithbs4/extractwith3k/extractwithlxml of the file superagi/helper/webpageextractor.py of the component WebScraperTool. Such manipulation leads to server-side request forgery. I...

CVE-2026-6616

TransformerOptimus SuperAGI up to version 0.0.14 contains a server-side request forgery in the WebScraperTool’s webpage_extractor.py, affecting functions extract_with_bs4, extract_with_3k, and extract_with_lxml. The issue arises in superagi/helper/webpage_extractor.py and is exploitable remotely;...

CVE-2026-6616

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extractwithbs4/extractwith3k/extractwithlxml of the file superagi/helper/webpageextractor.py of the component WebScraperTool. Such manipulation leads to server-side request forgery. I...

CVE-2026-6616 TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extractwithbs4/extractwith3k/extractwithlxml of the file superagi/helper/webpageextractor.py of the component WebScraperTool. Such manipulation leads to server-side request forgery. I...

PT-2026-33729

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extract with bs4/extract with 3k/extract with lxml of the file superagi/helper/webpage extractor.py of the component WebScraperTool. Such manipulation leads to server-side request...

Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix

Summary A path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Example Given an extraction directory set to /tmp/extract, a crafted archive with an entry...

Directory Traversal

Overview com.github.junrar:junrar is a rar decompression library in plain java. Affected versions of this package are vulnerable to Directory Traversal via the createDirectory and createFile methods in LocalFolderExtractor module. An attacker can write arbitrary files to sibling directories by...

GHSA-HF5P-Q87M-CRJ7 Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix

Summary A path traversal vulnerability in LocalFolderExtractor allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted. Example Given an extraction directory set to /tmp/extract, a crafted archive with an entry...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: GHSA-4P64-V8F5-R2GX...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-7808 via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-7808 Source advisory: OSV:GHSA-4P64-V8F5-R2GX...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-16083990...

Amazon Linux 2023 : tracker-miners (ALAS2023-2026-1580)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1580 advisory. A flaw was found in GNOME localsearch MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the extractperformerstags function can lead ...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-16032358...

article-extractor (>=0.5.8, <=0.5.9) potentially affected by CVE-2026-5751 via justhtml (1.13.0)

justhtml PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - article-extractor =0.5.8, =0.5.9 Source cves: CVE-2026-5751 Source advisory: OSV:GHSA-R758-8HXW-4845...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.13.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.5.9 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-15928878...

article-extractor (>=0.5.8, <=0.5.9) potentially affected by unknown CVE via justhtml (1.13.0)

justhtml PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - article-extractor =0.5.8, =0.5.9 Source cves: unknown CVE Source advisory: GHSA-R758-8HXW-4845...

CVE-2026-5470

A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractContent of the file src/services/content-extractor.service.ts of the component Model Context Protoc...

ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems

Existing research on LLM agent security mainly focuses on prompt injection and unsafe input/output behaviors. However, as agents increasingly rely on third-party tools and MCP servers, a new class of supply-chain threats has emerged, where malicious behaviors are embedded in seemingly benign tool...