CVE-2026-114102High· 7.5▾ MidnightPoC availableA flaw was found in adm-zip. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by submitting a malformed or corrupted ZIP archive to an application using asynchronous decompression. Because the library fails to prope…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
Last analysed / modified upstream
0.3%
1 GitHub repo
0.3% → 0.5%
A flaw was found in adm-zip. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by submitting a malformed or corrupted ZIP archive to an application using asynchronous decompression. Because the library fails to properly handle decompression stream errors, processing the invalid file triggers an unhandled exception that crashes the entire application process.
adm-zip: adm-zip: Denial of Service via malformed ZIP archive decompression — rated Important by Red Hat. Released 2026-10-21, updated 2026-10-22.
Affected:
No fix planned:
Not affected:
Affected
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112915Medium· 5.5filelock: filelock: Denial of Service via crafted SQLite lock database (CVE-2026-112915)
CVE-2026-110220High· 7.1Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation
CVE-2026-109956High· 7.0NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths
CVE-2026-90560High· 8.2zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds
CVE-2026-78679Medium· 6.5GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard
CVE-2026-73619Medium· 6.5gitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()` (CVE-2026-73619)