CVE-2026-93679

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to a denial of service (DoS) attack. The root cause is uncontrolled resource consumption occurring during the extraction of ZIP files . A remote authenticated attacker could exploit this to exhaust system resources. No specific exploit...

EUVD-2026-94118

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file extraction...

CVE-2026-93679 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file extraction...

PT-2026-107326

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description A remote authenticated attacker can cause a denial of service by triggering uncontrolled resource consumption during the extraction of ZIP files. Recommendations Update IBM Langflow OS...

CLEANSTART-2026-JD93552 When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory

Security vulnerability affects the python3 package. When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory...

CVE-2024-24919

Mass Auto Scanner for CVE-2024-24919 Este script está diseñado para escanear una lista de URLs en busca de la vulnerabilidad CVE-2024-24919 en firewalls remotos de Check Point. Intenta explotar la vulnerabilidad enviando una solicitud POST maliciosa para extraer archivos específicos de los...

CVE-2023-38831

CVE-2023-38831 Una demostración de prueba de concepto de CVE-2023-38831 Breve descripción de la vulnerabilidad CVE-2023-38831 es una vulnerabilidad de software. El software explotado es WinRAR, que es ampliamente utilizado por casi todo el mundo. Es un software que ayuda a comprimir diferentes...

cve-2025-8088

CVE-2025-8088: WinRAR Path Traversal Detection Overview This repository documents research and detection strategies for CVE-2025-8088, a path traversal vulnerability in WinRAR. Exploitation of this vulnerability can allow attackers to extract files outside the intended directory, leading to...

Powershell-Tools

PSUnzipper - PowerShell Unzipper Uses SharpZipLiB in .NET, loaded in runtime no file on disk - ref. https://github.com/icsharpcode/SharpZipLib Can be used with password zip, unzip Both encryption methods AES and ZipCrypto is supported. When zipping/unzipping - no file in temp is created - all...

PT-2026-103838

A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format TNEF file containing multiple message bodies. During extraction, improper memory management triggers a use-after-free and double-free condition,...

CVE-2026-102252 Path Traversal in VMDK Extractor in OSV-SCALIBR

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

CVE-2026-6103

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

vulnerabilities in Adobe Connect and the Adobe Connect Android Mobile App

Adobe has identified 9 vulnerabilities in Adobe Connect and the Adobe Connect Android Mobile App. These vulnerabilities are present in Adobe Connect 12.12 and Adobe Connect Android Mobile App 4.5. The vulnerabilities concern various security issues in Adobe Connect, including SQL injection,...

Directory Traversal

Overview mpxj is a Python wrapper for the MPXJ Java library for manipulating project files Affected versions of this package are vulnerable to Directory Traversal via the P3PRXFileReader and SureTrakSTXFileReader file extraction logic in the Primavera P3 PRX and SureTrak STX readers. An attacker...

Astra Linux – Vulnerability in unrar-nonfree

UnRAR before version 6.2.3 allowed extraction of files outside of the destination folder using symlink chains...

AZL-99087 CVE-2026-85396 affecting package rubygem-rubyzip 2.3.2-1

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

CVE-2026-85396

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

CVE-2026-79743 MCPHub: Path Traversal via Malicious MCPB Manifest Name

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

CVE-2026-79743 MCPHub: Path Traversal via Malicious MCPB Manifest Name

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

CVE-2026-79743: Improper Limitation of a Pathname to a Restricted Directory

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...