14765 matches found
PT-2026-63449
These are all security issues fixed in the 7zip-26.02-1.1 package on the GA media of openSUSE Tumbleweed...
EulerOS Virtualization 2.10.0 : vim (EulerOS-SA-2026-2873)
According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tarVimuntar in...
EulerOS Virtualization 2.12.0 : vim (EulerOS-SA-2026-2811)
According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tarVimuntar in...
Amazon Linux 2 : clamav1.4, --advisory ALAS2-2026-3820 (ALAS-2026-3820)
The version of clamav1.4 installed on the remote host is prior to 1.4.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3820 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS...
PT-2026-63256
Name of the Vulnerable Software and Affected Versions libarchive affected versions not specified Description A signed integer overflow occurs in the ZIP writer. Within the archive write zip header function in archive write set format zip.c, when ZIP encryption is active and the entry file size is...
EulerOS Virtualization 2.10.0 : sqlite (EulerOS-SA-2026-2870)
According to the versions of the sqlite package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attacke...
EulerOS Virtualization 2.10.1 : sqlite (EulerOS-SA-2026-2839)
According to the versions of the sqlite package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attacke...
Oracle Linux 10 : vim (ELSA-2026-38509)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38509 advisory. - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with...
EulerOS Virtualization 2.12.0 : python-requests (EulerOS-SA-2026-2800)
According to the versions of the python-requests package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a...
File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
Summary The fix for GHSA-gxjx-7m74-hcq8 / CVE-2026-54093 shipped in v2.63.6 added a strings.ReplaceAllnameInArchive, "\", "/" step to the archive builder; this was the advisory's recommended "Primary Fix." On a Linux host a backslash is a legal, non-separator filename character, so replacing it...
GHSA-83XP-526H-J3WW File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
Summary The fix for GHSA-gxjx-7m74-hcq8 / CVE-2026-54093 shipped in v2.63.6 added a strings.ReplaceAllnameInArchive, "\", "/" step to the archive builder; this was the advisory's recommended "Primary Fix." On a Linux host a backslash is a legal, non-separator filename character, so replacing it...
Malicious code in roles-royce (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 318b93ddaafba751bab93b48efbef99f4eb45f143b019d7ff0f74735e434f378 rolesroyce/init.py invokes a hidden checkenv routine at import time that spawns a background thread harvesting installer secrets — SSH private keys...
Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding
We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader. Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer. Amatera is ...
New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction
Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a heap-based buffer overflow in how the archiver processes XZ chunked data, and Trend Micro's Zero Day Initiative ZDI detailed it on July 15. A fix shipped on June 25 in 7-Zip 26.02...
Important: clamav1.5
Issue Overview: A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for...
Important: clamav1.4
Issue Overview: A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for...
Amazon Linux 2023 : clamav1.4, clamav1.4-data, clamav1.4-devel (ALAS2023-2026-1956)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1956 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory...
Oracle Linux 9 : php:8.2 (ELSA-2026-40416)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-40416 advisory. php 8.2.32-1 - rebase to 8.2.32 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd 2.0.3-4 - build for PHP 8.1 2070040 2.0.3-3 -...
Amazon Linux 2023 : clamav1.5, clamav1.5-data, clamav1.5-devel (ALAS2023-2026-1955)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1955 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory...
