https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:45:16 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09561 bdu:2026-09561 https://cve.radiocsirt.org/vuln/bdu:2026-09561 https://cve.radiocsirt.org/vuln/euvd-2026-331440 EUVD-2026-331440 https://cve.radiocsirt.org/vuln/euvd-2026-331440 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56876 <p>extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like &#39;../../../../etc/passwd&#39;, extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.</p> <p>extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like &#39;../../../../etc/passwd&#39;, extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56876 https://cve.radiocsirt.org/vuln/ghsa-jmr9-qjv8-65gv <p><strong>Affected:</strong> npm: extract-zip</p> <p>extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like &#39;../../../../etc/passwd&#39;, extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.</p> <p><strong>Affected:</strong> npm: extract-zip</p> <p>extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like &#39;../../../../etc/passwd&#39;, extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.</p> https://cve.radiocsirt.org/vuln/ghsa-jmr9-qjv8-65gv https://cve.radiocsirt.org/vuln/opensuse-su-2026:11200-1 <p>heroic-games-launcher-2.22.0-4.1 on GA media</p> <p>heroic-games-launcher-2.22.0-4.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11200-1 https://cve.radiocsirt.org/vuln/rhsa-2026:57590 <p>webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration form-data: form-data: Form field override via CRLF injection brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input devalue: devalue: Excessive memory consumption via deserialization of sparse arrays tmp: path Traversal via unsanitized prefix/postfix enables directory escape postcss: PostCSS: Information disclosure and denial of service via crafted CSS input ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` protobufjs: protobufjs: Denial of Service via crafted JSON descriptors grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosur…</p> <p>webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration form-data: form-data: Form field override via CRLF injection brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input devalue: devalue: Excessive memory consumption via deserialization of sparse arrays tmp: path Traversal via unsanitized prefix/postfix enables directory escape postcss: PostCSS: Information disclosure and denial of service via crafted CSS input ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` protobufjs: protobufjs: Denial of Service via crafted JSON descriptors grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosur…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:57590 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56876 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-extract-zip, Ubuntu:24.04:LTS: node-extract-zip, Ubuntu:25.10: node-extract-zip, Ubuntu:26.04:LTS: node-extract-zip</p> <p>extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like &#39;../../../../etc/passwd&#39;, extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-extract-zip, Ubuntu:24.04:LTS: node-extract-zip, Ubuntu:25.10: node-extract-zip, Ubuntu:26.04:LTS: node-extract-zip</p> <p>extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like &#39;../../../../etc/passwd&#39;, extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56876 https://cve.radiocsirt.org/vuln/va-26-177-01 <p>extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like &#39;../../../../etc/passwd&#39;, extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.</p> <p>extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like &#39;../../../../etc/passwd&#39;, extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.</p> https://cve.radiocsirt.org/vuln/va-26-177-01