https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T14:01:28.947763+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349561 EUVD-2026-349561 2026-10-06T14:01:28.956661+00:00 EUVD-2026-349561 https://cve.radiocsirt.org/vuln/fkie_cve-2026-66486 fkie_cve-2026-66486 2026-10-06T14:01:28.956698+00:00

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.

This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

 https://cve.radiocsirt.org/vuln/ghsa-p5w5-qcg3-g8gx GHSA-p5w5-qcg3-g8gx 2026-10-06T14:01:28.956733+00:00

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.

This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-66486 msrc_CVE-2026-66486 — Improper Output Encoding in GNU cpio 2026-10-06T14:01:28.956752+00:00 msrc_CVE-2026-66486 https://cve.radiocsirt.org/vuln/oesa-2026-3540 OESA-2026-3540 — cpio security update 2026-10-06T14:01:28.956768+00:00

Affected: openEuler:24.03-LTS-SP1: cpio, openEuler:24.03-LTS-SP3: cpio, openEuler:24.03-LTS-SP4: cpio, openEuler:20.03-LTS-SP4: cpio, openEuler:22.03-LTS-SP4: cpio

GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe. Security Fix(es):

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.

This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30(CVE-2026-66486)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11618-1 openSUSE-SU-2026:11618-1 — cpio-2.15-8.1 on GA media 2026-10-06T14:01:28.956798+00:00

cpio-2.15-8.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2026:23355-1 SUSE-SU-2026:23355-1 — Security update for cpio 2026-10-06T14:01:28.956814+00:00

Security update for cpio

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-66486 UBUNTU-CVE-2026-66486 2026-10-06T14:01:28.956828+00:00

Affected: Ubuntu:Pro:14.04:LTS: cpio, Ubuntu:Pro:16.04:LTS: cpio, Ubuntu:Pro:18.04:LTS: cpio, Ubuntu:Pro:20.04:LTS: cpio, Ubuntu:22.04:LTS: cpio, Ubuntu:24.04:LTS: cpio, Ubuntu:26.04:LTS: cpio

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2722 WID-SEC-W-2026-2722 — cpio: Mehrere Schwachstellen 2026-10-06T14:01:28.956854+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cpio ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial of Service zu verursachen oder Daten zu manipulieren.