6595 matches found
vim security update
9.1.083-9.0.1.el102.7 - Remove upstream references Orabug: 31197557 2:9.1.083-9.7 - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete 2:9.1.083-9.6 - RHEL-185867 CVE-2026-47167 vim: Code...
Oracle Linux 10 : vim (ELSA-2026-38509)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38509 advisory. - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with...
PT-2026-61977
Home Assistant Core before 2026.6.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute...
CVE-2026-59875
creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:12+00:00| published-proof-of-concept| https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j 2026-07-22 12:01:16+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmsdhlk24...
CVE-2026-59871
creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:05+00:00| published-proof-of-concept| https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp 2026-07-22 12:01:14+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmqeztj2n...
EUVD-2026-42308
node-tar: Process crash via PAX numeric path type confusion...
@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +916 more potentially affected by CVE-2026-59871 via tar (>=7.0.0, <=7.5.17)
tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59871 Source advisory: OSV:GHSA-W8WR-V893-VJVP...
NPM: node-tar: Process crash via PAX numeric path type confusion
NPM: node-tar: Process crash via PAX numeric path type confusion vulnerability discovered by ? in WordPress Npm tar versions = 7.5.17...
GHSA-W8WR-V893-VJVP node-tar: Process crash via PAX numeric path type confusion
Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls .split'/' on the numeric value. Error handlers and strict: false cannot...
node-tar: Process crash via PAX numeric path type confusion
Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls .split'/' on the numeric value. Error handlers and strict: false cannot...
@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +921 more potentially affected by CVE-2026-59873 via tar (>=7.0.0, <=7.5.18)
tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59873 Source advisory: OSV:GHSA-23HP-3JRH-7FPW...
node-tar: Decompression/parse DoS via unlimited input
Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...
GHSA-23HP-3JRH-7FPW node-tar: Decompression/parse DoS via unlimited input
Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...
NPM: node-tar: Decompression/parse DoS via unlimited input
NPM: node-tar: Decompression/parse DoS via unlimited input vulnerability discovered by ? in WordPress Npm tar versions = 7.5.18...
EUVD-2026-42305
node-tar: Decompression/parse DoS via unlimited input...
NPM: node-tar: Negative tar entry size causes infinite loop in archive replace
NPM: node-tar: Negative tar entry size causes infinite loop in archive replace vulnerability discovered by ? in WordPress Npm tar versions = 7.5.17...
node-tar: Negative tar entry size causes infinite loop in archive replace
Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make tar.replace loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service. Details The...
GHSA-8X88-C5MF-7J5W node-tar: Negative tar entry size causes infinite loop in archive replace
Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make tar.replace loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service. Details The...
@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +916 more potentially affected by CVE-2026-59874 via tar (>=7.0.0, <=7.5.17)
tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59874 Source advisory: OSV:GHSA-8X88-C5MF-7J5W...