https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T17:33:02.597580+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-362420 EUVD-2026-362420 2026-10-12T17:33:02.725693+00:00 EUVD-2026-362420 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44604 fkie_cve-2026-44604 2026-10-12T17:33:02.725729+00:00

A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.

 https://cve.radiocsirt.org/vuln/ghsa-q856-29gm-xf3x GHSA-q856-29gm-xf3x 2026-10-12T17:33:02.725762+00:00

A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11193-1 openSUSE-SU-2026:11193-1 — librpmbuild10-4.20.1-8.1 on GA media 2026-10-12T17:33:02.725780+00:00

librpmbuild10-4.20.1-8.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:28491 RHSA-2026:28491 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-12T17:33:02.725799+00:00

rpm: Command injection in rpmuncompress doUntar() via unescaped archive top-level directory name in popen() shell command

 https://cve.radiocsirt.org/vuln/suse-su-2026:23787-1 SUSE-SU-2026:23787-1 — Security update for rpm 2026-10-12T17:33:02.725815+00:00

Security update for rpm

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44604 UBUNTU-CVE-2026-44604 2026-10-12T17:33:02.725830+00:00

Affected: Ubuntu:Pro:14.04:LTS: rpm, Ubuntu:Pro:16.04:LTS: rpm, Ubuntu:Pro:18.04:LTS: rpm, Ubuntu:Pro:20.04:LTS: rpm, Ubuntu:22.04:LTS: rpm, Ubuntu:24.04:LTS: rpm, Ubuntu:25.10: rpm, Ubuntu:26.04:LTS: rpm

A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.