Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes

Cybersecurity researchers have disclosed details of a new threat actor dubbed Lurking Lizard that has been operating an end-to-end malicious residential proxy business using an infrastructure comprising more than 230 lookalike domains. The activity dates back to at least August 2022, according to...

PT-2026-57042

Name of the Vulnerable Software and Affected Versions laravel-backup-restore versions prior to 1.9.4 Description An OS command injection can occur during the database restore process when handling a crafted backup archive. The restore workflow extracts a ZIP archive and identifies files under...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : ClamAV vulnerabilities (USN-8517-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8517-1 advisory. It was discovered that ClamAV incorrectly handled certain PE files. A remote attacker could possibly use this issue to cause Clam...

Directory Traversal

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Directory Traversal via path traversal in the skill archive extraction logic in SkillPromptInjectionHandler and SkillsSandboxExecutor. An authenticated user with access to...

Directory Traversal

Overview composer/composer is a Dependency Manager for PHP. Composer helps you declare, manage and install dependencies of PHP projects. It ensures you have the right stack everywhere. Affected versions of this package are vulnerable to Directory Traversal via the bin field when it contains .. pa...

Directory Traversal

Overview composer/composer is a Dependency Manager for PHP. Composer helps you declare, manage and install dependencies of PHP projects. It ensures you have the right stack everywhere. Affected versions of this package are vulnerable to Directory Traversal through improper validation of package...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper handling of AuthorizedKeysFile path expansion in the authentication. An attacker can gain unauthorized access to files outside the intended authorized-keys directory by supplying a path containing a...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the scp.py file when handling filenames provided by a remote server. An attacker can overwrite arbitrary files on the client filesystem by sending specially crafted filenames containing directory traversal...

Directory Traversal

Overview @appium/storage-plugin is a Server-side storage plugin for Appium Affected versions of this package are vulnerable to Directory Traversal via the POST /storage/delete handler, which passes user-supplied input directly into path.join and fs.rimraf without proper path sanitization. An...

CVE-2026-55195

A flaw was found in py7zr, a Python library for 7zip archive handling. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted .7z file. The Worker.decompress function fails to track the total decompressed size, enabling a small archive to...

CVE-2026-55195

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expan...

CVE-2026-55195 py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expan...

Directory Traversal

Overview copier is an A library for rendering project templates. Affected versions of this package are vulnerable to Directory Traversal via the trust process. An attacker can execute arbitrary commands by supplying a template reference that textually matches a trusted prefix but includes .. path...

Directory Traversal

Overview bbot is an OSINT automation for hackers. Affected versions of this package are vulnerable to Directory Traversal via the githubworkflows process. An attacker can write files outside the intended output directory by supplying a crafted CODEREPOSITORY URL containing directory traversal...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the Include.parse process. An attacker can access arbitrary files outside the intended markdown directory by supplying crafted include paths when markdown files are processed using md.read. Details A Directory...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the ScopedFs process. An attacker can create files outside of the intended user scope by exploiting dangling symlinks during file creation when possessing Create and Modify permissions. Details A Directory...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the ScopedFs process. An attacker can create files outside of the intended user scope by exploiting dangling symlinks during file creation when possessing Create and Modify permissions. Details A Directory...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the ScopedFs process. An attacker can create files outside of the intended user scope by exploiting dangling symlinks during file creation when possessing Create and Modify permissions. Details A Directory...

Directory Traversal

Overview github.com/filebrowser/filebrowser/v2/http is a web file browser. Affected versions of this package are vulnerable to Directory Traversal via the ScopedFs process. An attacker can create files outside of the intended user scope by exploiting dangling symlinks during file creation when...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the handling of the X-Amz-Copy-Source header in the S3 API gateway. An attacker can access objects from unauthorized buckets by submitting specially crafted requests containing dot-dot path segments. Details A...