799 matches found
OESA-2026-3224 perl security update
Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects. Security Fixes: Perl versions through 5.43.10 have an...
SUSE-SU-2026:23075-1 Security update for perl
This update for perl fixes the following issues - CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date bsc1266361. - CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds...
CVE-2026-66756
CVE-2026-66756 affects Apache Tika, specifically the 4.0.0-alpha-1 series up to, but not including, 4.0.0-beta-1. The issue is described as an Improper Protection of Alternate Path vulnerability. Affected versions are listed as 4.0.0-alpha-1 through before 4.0.0-beta-1; the recommended remediatio...
CVE-2026-66756 Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false
Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...
CVE-2026-66756 Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false
Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...
@wakaru/cli arbitrary file write during bundle unpack
Impact @wakaru/cli is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with --unpack. Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such ...
GHSA-7WPJ-VVMV-PGM8 @wakaru/cli arbitrary file write during bundle unpack
Impact @wakaru/cli is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with --unpack. Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such ...
CVE-2026-54545
CVE-2026-54545 affects the @wakaru/cli component of the Wakaru toolkit. From 1.0.0 through 1.4.0, bundle-controlled module filenames were sanitized only once before writing extracted modules. A crafted filename containing overlapping traversal sequences (e.g., ....//) can collapse to ../ after sa...
CVE-2026-54545 @wakaru/cli arbitrary file write during bundle unpack
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...
EUVD-2026-49869
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...
CVE-2026-54545 @wakaru/cli arbitrary file write during bundle unpack
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...
CVE-2026-54545 @wakaru/cli arbitrary file write during bundle unpack
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...
SUSE-SU-2026:23008-1 Security update for perl
This update for perl fixes the following issues - CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date bsc1266361. - CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds...
CVE-2026-51244
...
CVE-2026-51244
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-50163
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...
perl: Fix of 2 CVEs
CVE-2026-13221: regex trie construction in Sstudychunk stored the branch-to-tail delta in a 16-bit field; an alternation of more than 65535 fixed-string branches overflowed it and produced silently incorrect matches GH23388 — decline the trie optimization when the span would overflow -...
perl: Perl: Information disclosure via integer overflow in pack/unpack operations
A flaw was found in Perl. An integer overflow vulnerability in the Smeasurestruct function, specifically when handling pack and unpack templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive...