https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:49:45.250758+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-42497 BELL-CVE-2026-42497 2026-10-03T07:49:45.255810+00:00

Affected: Alpaquita:23: perl, Alpaquita:25: perl, Alpaquita:stream: perl, BellSoft Hardened Containers:23: perl, BellSoft Hardened Containers:25: perl, BellSoft Hardened Containers:stream: perl

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0986 certfr-2026-avi-0986 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T07:49:45.255862+00:00 certfr-2026-avi-0986 https://cve.radiocsirt.org/vuln/euvd-2026-322378 EUVD-2026-322378 2026-10-03T07:49:45.255882+00:00 EUVD-2026-322378 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42497 fkie_cve-2026-42497 2026-10-03T07:49:45.255895+00:00

Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.

_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.

A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.

 https://cve.radiocsirt.org/vuln/ghsa-fcfm-93gv-wh6f GHSA-fcfm-93gv-wh6f 2026-10-03T07:49:45.255924+00:00

Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.

_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.

A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-42497 msrc_CVE-2026-42497 — Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction direct… 2026-10-03T07:49:45.255943+00:00 msrc_CVE-2026-42497 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42497 UBUNTU-CVE-2026-42497 2026-10-03T07:49:45.255959+00:00

Affected: Ubuntu:Pro:14.04:LTS: perl, Ubuntu:Pro:16.04:LTS: perl, Ubuntu:Pro:18.04:LTS: perl, Ubuntu:Pro:20.04:LTS: perl, Ubuntu:22.04:LTS: perl, Ubuntu:24.04:LTS: perl, Ubuntu:25.10: perl, Ubuntu:26.04:LTS: perl

Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode. A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2666 WID-SEC-W-2026-2666 — cPanel cPanel/WHM (Archive-Tar): Mehrere Schwachstellen ermöglichen Manipulation von Dateien 2026-10-03T07:49:45.255990+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cPanel cPanel/WHM ausnutzen, um vertrauliche Informationen preiszugeben oder Daten zu manipulieren.