tar-fs can extract outside the specified dir with a specific tarball

Impact v3.0.8, v2.1.2, v1.16.4 and below Patches Has been patched in 3.0.9, 2.1.3, and 1.16.5 Workarounds You can use the ignore option to ignore non files/directories. js ignore , header // pass files & directories, ignore e.g. symlinks return header.type !== 'file' && header.type !== 'directory...

CVE-2025-5421

creationtimestamp| type| source ---|---|--- 2025-06-02 01:03:48+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqlleqjzuj42...

Malicious code in @seo-frontend-components/card-blog-carousel-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1eaa599a9c0235a5d52b5534f4177883c03e7ae19496ef98593fadfc3a7ccef8 The OpenSSF Package Analysis project identified '@seo-frontend-components/card-blog-carousel-mobile' @ 1.999.2 npm as malicious. It is considere...

CVE-2025-4857

creationtimestamp| type| source ---|---|--- 2025-05-31 11:40:51+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqho24zdplc2 2025-05-31 14:11:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqhwigwwnw2q...

CVE-2024-13915

creationtimestamp| type| source ---|---|--- 2025-05-30 16:29:10+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqfnoti27oe2 2025-05-30 20:06:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqfzsqmajr2q 2025-06-02...

ZITADEL 输入验证错误漏洞

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the container and serverless era from the Swiss ZITADEL open source. An input validation error vulnerability exists in ZITADEL versions prior to 3.2.2, which stems from a possible manipulation...

CVE-2024-37167

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that they should not see. This issue has been patched in Tuleap Community Edition version 15.9.99.97...

CVE-2024-55885

beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256...

CVE-2022-41532

Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /saccoshield/ajax.php?action=deleteplan...

CVE-2025-48373

Schule has a client-side RBAC bypass prior to version 1.0.1: the app trusts data.role in the browser to redirect users to panels, allowing an attacker to set data.role to values like “admin” and access restricted areas. The root cause is insecure client-side role handling. Affected: Schule open-s...

MAL-2025-3865 Malicious code in mfe-react-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f7835d0f6b232544302030371ac74d4c595860a04736a2ef54259a32993f9c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-47279

creationtimestamp| type| source ---|---|--- 2025-05-15 17:34:33+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16542 2025-05-15 19:02:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpa7b7wpv52p...

Malicious code in iconnect (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e53aae69656f138607d0de8abe11d4b48ed6156875f07ec0da7485dd776f7158 Packages that seem to be created by a legit bug bounty hunter. Designed to look like created by different organisations, they contain a couple of data...

Malicious code in @ai-document-translation/ui-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8c94ea05205ad6ac8c809be2fa22e18fae368f27f1f8bd34048528dc25daa90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-32389

creationtimestamp| type| source ---|---|--- 2025-04-18 16:58:59+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12489 2025-04-18 17:28:24+00:00| seen| https://bsky.app/profile/Minecraft.activitypub.awakari.com.ap.brid.gy/post/3ln45dxk5npy2 2025-04-18 18:31:46+00:00|...

CVE-2025-3692

creationtimestamp| type| source ---|---|--- 2025-04-16 13:55:53+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12040 2025-04-16 14:43:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmwtcbq4xi2h...

CVE-2025-26902

creationtimestamp| type| source ---|---|--- 2025-04-09 19:48:20+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11145 2025-04-09 23:38:03+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmg5uwdtkp2v...

CVE-2024-36246

creationtimestamp| type| source ---|---|--- 2025-04-08 04:46:30+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10842 2025-04-08 05:40:20+00:00| seen| https://bsky.app/profile/cyberalerts.bsky.social/post/3lmbr6vzdhz2c...

CVE-2024-11071

creationtimestamp| type| source ---|---|--- 2025-04-07 07:17:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lm7g64cshh2z 2025-04-07 07:48:48+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114295578822521194 2025-04-07 11:12:44+00:00| seen|...

CVE-2025-30155 Tuleap does not enforce read permissions on parent trackers in the REST API

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap does not enforce read permissions on parent trackers in the REST API. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742392651 and Tuleap Enterprise Edition 16.5-5 and 16.4-8...