EUVD-2026-57261

An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability...

CVE-2026-69105 Potential package cache integrity issue in JFrog Artifactory

An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability...

CVE-2026-69105

CVE-2026-69105 describes an unauthenticated issue affecting JFrog Artifactory where, under specific conditions, untrusted package content can be cached, potentially compromising artifact integrity and availability. The connected sources (NVD, CVE List) reiterate that an unauthenticated attacker c...

PT-2026-71134

An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability...

PYSEC-2026-2970 Rattler vulnerable to package cache path traversal via conda package build string

rattlercache and py-rattler were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the rattercache code used the package record build string as part of a cache key that was joined into a filesystem path. A malicious or...

CVE-2026-41211 `vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, downloadPackageManager accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments or an absolute path to escape the VPHOME/packagemanager// cache root and...

CVE-2026-41211 `vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME`

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, downloadPackageManager accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments or an absolute path to escape the VPHOME/packagemanager// cache root and...

EUVD-2018-0279

Malware in sbrugna...

CVE-2017-16132

simple-npm-registry is a local npm package cache. simple-npm-registry is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16132

CVE-2017-16132 concerns simple-npm-registry, a local npm package cache. Multiple connected sources confirm a directory traversal vulnerability in simple-npm-registry: an attacker can craft a URL containing relative path sequences (e.g., ../../) to access files outside the intended directory root....

apt-cacher and apt-cacher-ng HTTP Response Splitting Vulnerability

apt-cacher is a set of software used to cache debian packages. apt-cacher-ng is an HTTP protocol proxy for Linux systems. An HTTP response splitting vulnerability exists in versions of apt-cacher before 1.7.15 and apt-cacher-ng before 3.4. An attacker can exploit this vulnerability to inject HTTP...