CVE-2026-63308 vulnerabilities

Vulnerabilities for packages: helm...

GO-2024-2482 vulnerabilities

Vulnerabilities for packages: goreleaser...

GO-2026-5273 vulnerabilities

Vulnerabilities for packages: goreleaser...

GO-2024-2482 vulnerabilities

Vulnerabilities for packages: goreleaser...

GO-2026-5607 vulnerabilities

Vulnerabilities for packages: goreleaser...

CVE-2026-73566

CVE-2026-73566 affects node-tar prior to 7.5.21. The filesFilter in src/list.ts uses a recursive mapHas to walk entry paths upward with path.dirname(), and with tar.t(...) or tar.x(...) and a non-empty member-selection list, a crafted GNU long-path header can reach Parser[CONSUMEHEADER] in src/pa...

CVE-2026-73030

A flaw was found in unearth. This path traversal vulnerability exists in the iswithindirectory function, which fails to normalize paths before validation. This allows ../ sequences to bypass directory containment checks. An attacker can exploit this by supplying malicious tar archives with symlin...

CVE-2026-66484

A flaw was found in GNU cpio. This vulnerability, known as Path Traversal, occurs during the extraction of tar archives in copy-in mode when the --no-absolute-filenames option is used. A remote attacker could craft a malicious tar archive containing a hard-link entry with an absolute path. This...

CVE-2026-57516

A flaw was found in Ray. This unsafe deserialization vulnerability in the WebDataset reader allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted malicious tar archive to the readwebdataset function, an attacker can trigger the unconditional deserializatio...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

DEBIAN-CVE-2026-73030

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

CVE-2026-73030

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

CVE-2026-73030 unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

CVE-2026-73030

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

EUVD-2026-55802

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

CVE-2026-73030

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

CVE-2026-73030

CVE-2026-73030 affects unearth 0.18.2. The vulnerability arises in the is_within_directory path validation, where path normalization is not performed, allowing ../ sequences and symlink traversal to bypass containment checks. Attackers could craft tar archives with symlink members or traversal se...

CVE-2026-73030 unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

DEBIAN-CVE-2026-68229

In the Linux kernel, the following vulnerability has been resolved: media: cedrus: skip invalid H.264 reference list entries Cedrus consumes H.264 refpiclist0/refpiclist1 entries from the stateless slice control and later uses their indices to look up decode-dpb in cedruswritereflist. Rejecting...

Astra Linux – Vulnerability in busybox

A flaw was discovered in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by creating a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead...