14645 matches found
PT-2026-104245
Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects,...
CVE-2026-104424: Incorrect Calculation of Buffer Size
Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim miner's mempool to shape templates into oversized blocks,...
PT-2026-104235
Name of the Vulnerable Software and Affected Versions Zebra versions prior to 6.1.0 Description An incorrect calculation in the ZIP-317 block template selector fails to account for the header and transaction-count size within the block budget. This allows attackers to submit valid selectable...
CVE-2026-104437: Improper Verification of Cryptographic Signature
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASHSINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts an...
openSUSE 16 Security Update : rclone (openSUSE-SU-2026:21999-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21999-1 advisory. Changes in rclone: - Update to version 1.75.1: boo1279548 - Security - archive - Fix zip slip path traversal in untrusted zip files...
CVE-2026-56660
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP...
CVE-2026-56660
The GetSimple CMS CE community edition (prior to version 1.5 ) is vulnerable to remote code execution (RCE) due to a flaw in the update handler located in UpdateCE.php . The application downloads and extracts ZIP archives into the web root without validating file types or extraction paths. This a...
CVE-2026-56660 GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP...
CVE-2026-56660 GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP...
EUVD-2026-91016
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP...
CVE-2026-101888
The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences...
CVE-2026-101888 Prime Mover < 2.2.1 Zip Slip Path Traversal File Write
The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences...
EUVD-2026-90911
The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences...
CLSA-2026-1790869902 TuxCare security update for adm-zip (1 CVE)
TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.17-tuxcare.4...
CLSA-2026-1790868332 TuxCare security update for adm-zip (1 CVE)
TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.18-tuxcare.6...
CLSA-2026-1790868324 TuxCare security update for adm-zip (1 CVE)
TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.10-tuxcare.2...
CLSA-2026-1790864771 TuxCare security update for adm-zip (1 CVE)
TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.12-tuxcare.2...
CVE-2026-103754
A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...
UBUNTU-CVE-2026-103754
A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...