https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 12:54:32 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-362420 EUVD-2026-362420 https://cve.radiocsirt.org/vuln/euvd-2026-362420 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44604 <p>A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive&#39;s top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.</p> <p>A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive&#39;s top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44604 https://cve.radiocsirt.org/vuln/ghsa-q856-29gm-xf3x <p>A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive&#39;s top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.</p> <p>A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive&#39;s top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.</p> https://cve.radiocsirt.org/vuln/ghsa-q856-29gm-xf3x https://cve.radiocsirt.org/vuln/opensuse-su-2026:11193-1 <p>librpmbuild10-4.20.1-8.1 on GA media</p> <p>librpmbuild10-4.20.1-8.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11193-1 https://cve.radiocsirt.org/vuln/rhsa-2026:28491 <p>rpm: Command injection in rpmuncompress doUntar() via unescaped archive top-level directory name in popen() shell command</p> <p>rpm: Command injection in rpmuncompress doUntar() via unescaped archive top-level directory name in popen() shell command</p> https://cve.radiocsirt.org/vuln/rhsa-2026:28491 https://cve.radiocsirt.org/vuln/suse-su-2026:23787-1 <p>Security update for rpm</p> <p>Security update for rpm</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23787-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44604 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: rpm, Ubuntu:Pro:16.04:LTS: rpm, Ubuntu:Pro:18.04:LTS: rpm, Ubuntu:Pro:20.04:LTS: rpm, Ubuntu:22.04:LTS: rpm, Ubuntu:24.04:LTS: rpm, Ubuntu:25.10: rpm, Ubuntu:26.04:LTS: rpm</p> <p>A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive&#39;s top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: rpm, Ubuntu:Pro:16.04:LTS: rpm, Ubuntu:Pro:18.04:LTS: rpm, Ubuntu:Pro:20.04:LTS: rpm, Ubuntu:22.04:LTS: rpm, Ubuntu:24.04:LTS: rpm, Ubuntu:25.10: rpm, Ubuntu:26.04:LTS: rpm</p> <p>A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive&#39;s top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44604