cthackers has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 4. The median CVSS is 6.2 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.2
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-102282High· 7.1adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js51CVE-2026-114104Medium· 5.9adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass44CVE-2026-114103Medium· 5.3adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()41CVE-2026-92000High· 7.5adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size41CVE-2026-114105Medium· 6.2Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits34
cthackers vulnerabilities
CVEs affecting cthackers, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-114104Medium· 5.9PoCadm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns t…
CVE-2026-114103Medium· 5.3PoCadm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()
adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsifi…
CVE-2026-114105Medium· 6.2Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file a…
CVE-2026-102282High· 7.1PoCadm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPer…
CVE-2026-92000High· 7.5adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exha…