PT-2026-105393

TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.12-tuxcare.1...

Debian dla-4785 : zip - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4785 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4785-1 [email protected] https://www.debian.org/lts/security/...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

PT-2026-105389

TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.16-tuxcare.1...

Linux Distros Unpatched Vulnerability : CVE-2026-77301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory...

PT-2026-105380

TuxCare rebuilt adm-zip to address 2 CVEs. Fixed in 0.6.0-tuxcare.2...

CVE-2026-77301

A flaw was found in adm-zip, a JavaScript library for handling ZIP archives. The getData function in zipEntry.js allocates memory based on the declared uncompressed size in a ZIP entry's central directory without validating this value against the actual compressed data. A remote attacker can...

Security Bulletin: extract-zip-2.0.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary extract-zip through 2.0.1 only checks the parent directory of each archive entry, allowing a symlink-then-regular-file pair with identical names to write through the planted symlink and achieve arbitrary file write outside the destination directory. CVSS: 8.1 High, CWE-22. Vulnerability...

Security Bulletin: extract-zip-2.0.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary extract-zip 2.0.1 does not validate symlink targets during zip extraction, allowing a malicious archive with relative symlink paths to read or write arbitrary files outside the extraction directory. CVSS: 8.1 High, CWE-22. Vulnerability Details CVEID:CVE-2026-56876 DESCRIPTION: extract-zi...

Linux Distros Unpatched Vulnerability : CVE-2026-65970

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted...

SUSE CVE-2026-77301

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A...

SUSE CVE-2026-92000

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service...

USN-8788-1 clamav vulnerabilities

It was discovered that ClamAV incorrectly handled certain zip archive files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. CVE-2026-20337, CVE-2026-20338 It was discovered that ClamAV incorrectly handled certain PESpin files. A remote...

`unzip` is unmaintained

The unzip crate has only ever released a single version, 0.1.0 published 2017-12-23, and has seen no further activity. It appears to be unmaintained, and its known path-traversal "zip-slip" vulnerability will not be fixed. Consider migrating to an actively maintained alternative such as zip...

RUSTSEC-2026-0296 `unzip` is unmaintained

The unzip crate has only ever released a single version, 0.1.0 published 2017-12-23, and has seen no further activity. It appears to be unmaintained, and its known path-traversal "zip-slip" vulnerability will not be fixed. Consider migrating to an actively maintained alternative such as zip...

vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass

A flaw was found in Vim's zip.vim plugin. A local user could be tricked into opening a specially crafted zip archive, which would allow a path traversal bypass. This vulnerability enables an attacker to overwrite arbitrary files on the system, potentially leading to data integrity issues or furth...

ROS-20260921-73-0025

The vulnerability of the CInStream::GetCuSize function in the 7-Zip NTFS archiver lies in the writing beyond buffer boundaries to memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause a service failure...

PT-2026-105965

The unzip crate has only ever released a single version, 0.1.0 published 2017-12-23, and has seen no further activity. It appears to be unmaintained, and its known path-traversal "zip-slip" vulnerability will not be fixed. Consider migrating to an actively maintained alternative such as zip...

ROS-20260921-73-0001

The vulnerability of the MixCoderCode function in the XZ Decoder component of the 7-Zip archive processor is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

OESA-2026-3920 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...