CVE-2026-114104 adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry returns the last duplicate while extractAllTo writes the first, causing...

CVE-2026-114104

The adm-zip library before version 0.6.1 is vulnerable to an inconsistent entry resolution flaw. Attackers can bypass content validation by providing ZIP archives containing duplicate entry names . Specifically, the library's getEntry() method may return the last duplicate entry while the extract...

CVE-2026-114104 adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry returns the last duplicate while extractAllTo writes the first, causing...

CVE-2026-114104 adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry returns the last duplicate while extractAllTo writes the first, causing...

The Brain ADM-ZIP for NodeJS processing logic has a vulnerability in its handling of errors.

The Brain ADM-ZIP for NodeJS versions prior to 0.6.1 has a processing logic vulnerability. This vulnerability stems from inconsistent entry parsing: the getEntry function returns the last duplicate entry, while the extractAllTo function writes the first duplicate entry. This allows attackers to...

Crossplane input validation vulnerability

crossplane is a framework for building cloud-native control planes without writing code. An input validation error vulnerability exists in Crossplane versions prior to 1.11.5, 1.12.3, and 1.13.0, which stems from a mirroring backend that does not validate the byte content of Crossplane packages,...

CVE-2021-26955

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name calls std::str::fromutf8unchecked on unvalidated bytes from an X server...