GHSA-VWC7-R8MQ-G2X9 adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...

adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...

CVE-2026-71364

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2026-71364

A path traversal vulnerability in AWX 's project_archive action plugin (part of Red Hat Ansible Automation Platform ) allows arbitrary file writes on the execution node. The plugin extracts zip/tar members by joining the project directory path with the member filename without path normalization o...

EUVD-2026-64918

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2026-71364 Awx: project archive extraction allows path traversal file writes

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

Security Bulletin: Langflow is affected by security vulnerabilities in Model Context Protocol features

Summary Langflow uses Model Context Protocol MCP features to manage external server connections, project access, file resources, and local client integration. Weaknesses in MCP command and configuration validation, authentication and authorization enforcement, file resource handling, and request...

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

CVE-2026-75904

A flaw was found in libmodplug. An out-of-bounds read vulnerability exists in the patsmplooped function when processing a specially crafted MIDI Musical Instrument Digital Interface file. This flaw occurs because the function incorrectly handles a sample index, leading to a read one byte before a...

CVE-2026-65609

A flaw was found in nnn. Due to insufficient validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who can place a malicious...

CVE-2026-65612

A flaw was found in nnn. An attacker can exploit this vulnerability by placing a file with a specially crafted name, containing shell syntax, on a shared filesystem, removable media, or within an extracted archive. If a victim then navigates to and opens this file using the preview-tabbed feature...

CVE-2026-65611

A flaw was found in nnn, a file manager. This vulnerability, known as Shell Command Injection, allows an attacker to execute arbitrary commands. By creating a specially crafted directory name containing shell syntax on a shared filesystem, removable media, or within an extracted archive, an...

CVE-2026-78381

RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the resulting path without verifying that...

CVE-2026-78385

RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained i...

CVE-2026-76844

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

CVE-2026-76845

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...

CVE-2026-76840

RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStreamRead in libs/clipboard/src/windows/wfcliprdr.c requests...

CVE-2026-78387 RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

CVE-2026-78385

RansomLook contains an insufficient resource validation flaw in its analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and rendered via WeasyPrint . Prior to the fix, WeasyPrint's default URL fetcher resolved resource references without restrictions, all...

CVE-2026-78385 RansomLook Analysis PDF Generation Allows Server-Side Request Forgery and Arbitrary Local File Access

RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained i...